A check only protects you if you can prove you did it. Here is exactly what to keep, in what form, and for how long — so your statutory excuse holds.
The statutory excuse depends on being able to demonstrate that you carried out a compliant check at the right time. If you cannot produce the evidence — or it is undated, altered or lost — you may have no protection even though you did check. Good record keeping is therefore not admin; it is the excuse.
Keep a clear copy of the evidence appropriate to the route used: for a manual check, copies of the acceptable documents you saw; for an online check, the profile page the GOV.UK service produces; for a digital identity check, the output the certified provider gives. Crucially, record the date the check was carried out, and where permission is time-limited, the date any follow-up check is due.
Copies must be kept securely and in a format that cannot later be altered — for example a read-only PDF or image — whether electronic or hard copy. The point is that the evidence, and its date, can be shown to be contemporaneous and unmodified if you are ever asked to produce it.
Retain the evidence for the duration of the person’s employment and for a further two years after it ends, then dispose of it securely. Keeping it for the right period — not indefinitely, not too briefly — is part of doing it correctly, and the two-year tail is easy to lose track of manually.
The evidence differs by how you checked. For a manual check, keep clear copies of the actual documents you examined (the relevant pages), showing photographs and dates. For an online share-code check, keep the profile page the GOV.UK service produces — not just the share code itself. For a digital identity check, keep the result the certified provider returns. In every case, record the date the check was made, and for time-limited permission, the follow-up date.
These copies contain personal — and sometimes special category — data, so UK data-protection rules apply. Keep them securely, limit access to those who need it, do not collect more than the check requires, and dispose of them securely once the retention period ends. “Keep everything forever” is not a safe default: holding the records beyond the required period without a reason is itself a data-protection problem, which is why the two-year tail after employment matters in both directions.
For anyone with time-limited permission (List B documents or a six-month Employer Checking Service notice), the record is only as good as the follow-up attached to it. A check with no diarised recheck date is how excuses quietly expire. The retention record and the follow-up reminder need to travel together on the worker’s record — which is the core of what compliance software adds over a folder of PDFs.
In a compliance visit or after an enforcement referral, you may be asked to produce the evidence for named individuals. The test is simple: can you show, for each worker, a compliant check made before they started, dated, in an unaltered format, with any follow-ups done on time? If yes, your statutory excuse holds; if the records are missing, undated or altered, it may not — regardless of whether you actually checked.
The retention rule is “duration of employment plus two years,” and it is worth making concrete. If a worker joins in March 2026 and leaves in March 2028, you keep their right to work evidence for the whole two years of employment and then until March 2030 — two years after they stopped working — before securely destroying it. The clock for the two-year tail runs from the end of employment, not from the date of the check, which is why a single “delete after N years from upload” rule tends to get it wrong in both directions.
The recurring errors are: deleting too early (disposing of evidence while the person is still employed, or before the two-year tail ends, leaving you unable to prove a past check); keeping everything forever (a data-protection problem, since there is no lawful basis to retain it indefinitely); storing copies that are undated or editable; and losing the link between the evidence and its follow-up date. Getting retention right is as much a part of compliance as the check itself, and it is precisely the kind of dated, lifecycle-aware record a system should manage for you rather than a person having to remember.
Right to work evidence is sensitive personal data, so access should be on a need-to-know basis — the people who run onboarding and compliance, not the whole organisation. Collect only what the check requires(you do not need to copy every page of a passport), store it where access is controlled and logged, and keep it separate from information that could invite discriminatory decisions. Good access control is part of doing record keeping lawfully, not an optional extra.
Either paper or digital records are acceptable, provided they are secure, unalterable and dated; in practice digital records are far easier to retain consistently, find on request, and dispose of on schedule. The piece most organisations miss is tying disposal to the leaver process: when someone leaves, the two-year retention clock starts, and something needs to trigger secure destruction at the end of it. Linking retention to the worker’s lifecycle — rather than a person remembering years later — is exactly the kind of thing a compliance system should carry for you.
The most reliable way to keep right to work records is one structured entry per worker, holding: the route used (manual, online or digital identity), the evidence itself in an unalterable form, the date of the check, whether the permission is indefinite or time-limited, and, if time-limited, the follow-up date. Kept that way, the record answers every question an audit asks — who, what, when, and what happens next — without anyone having to reconstruct it from emails. A pile of undated document scans in a shared drive does none of that, even if every check was genuinely done.
Right to work is not the only worker record with a retention rule, and the periods differ — which is a trap if you apply one blanket policy. Right to work evidence is kept for employment plus two years; other records have their own periods (for example, employers must keep annual-leave records under the Employment Rights Act for a longer period). The safe approach is to attach the correct retention rule to each type of record rather than deleting or hoarding everything on one schedule — and to tie disposal to the point the relevant clock actually runs out. This is precisely the kind of per-record lifecycle a compliance system should track for you.
This dated, tamper-aware, expiry-driven record keeping is core to what Complys does. It stores each worker’s right to work evidence with the check date in the worker record, reminds you before a follow-up is due, and helps you manage retention and secure disposal — across employees and contractors alike. It does not perform the check itself. See Right to Work compliance software and the employer guide.
General information for UK employers, not legal advice. Retention and evidence requirements are set by the Home Office; confirm against current guidance. Reviewed 26 September 2026.
