An employee leaves on Friday. On Monday, HR receives a subject access request, while Finance asks for payroll evidence and a manager mentions that a tribunal claim may be coming. The team searches shared drives, email attachments, payroll exports and paper files, then discovers that nobody can say confidently which records should be retained, which should be deleted and which must be frozen.
That situation exposes the weakness in a blanket employee records retention policy. “Keep everything for six years” sounds practical, but recruitment records, PAYE data, holiday evidence, occupational-health information, disciplinary files and right-to-work documents don't all follow the same clock. A defensible programme connects each category to its purpose, trigger date, review decision and disposal evidence.
Table of Contents
- Why UK Employee Records Need a Real Retention Policy
- What UK Rules Actually Require for Retention Periods
- Retention Periods by Record Category
- Building a Defensible Retention Schedule
- Implementing Retention in HRManagement365, Dynamics 365 and SharePoint
- Auditability, Legal Holds and Disposing Records Defensibly
- Common Pitfalls and a Practical Retention Checklist
Why UK Employee Records Need a Real Retention Policy
The UK GDPR storage-limitation principle requires organisations to keep workers' personal information no longer than necessary for the purpose for which it was collected. The Information Commissioner's Office guidance on keeping employment records doesn't prescribe one universal employment-record period. Employers must decide appropriate periods by record type, business purpose, legal obligations, and litigation or regulatory risk.
That distinction matters during an audit or DSAR. A single employee file may contain a contract, payroll information, sickness details, performance notes, disciplinary correspondence and right-to-work evidence. Applying one deletion date to all of it can create two opposite failures. You may retain sensitive information longer than necessary, or remove evidence before a legal, payroll or regulatory need has ended.
Start with the record, not the folder
The most reliable approach is to identify the individual record category before deciding how long it should remain available. For each category, document:
- Purpose: Why does the organisation hold the information?
- Trigger: Which event starts the retention clock?
- Period: How long is the record retained?
- Owner: Who approves exceptions and disposal?
- Outcome: Is the record deleted, anonymised, archived or retained under a hold?
This also reduces everyday security risk. HR teams can reinforce the same discipline through practical Slack-native security awareness, especially where employees share personal information in messages or channels that sit outside the formal HR record.
Practical rule: A retention schedule isn't operational until the system can identify records approaching review, prevent deletion where a hold applies and prove what happened at expiry.
A written policy isn't operational proof
A document that says “retain personnel records for six years” may satisfy a governance conversation, but it won't show whether a payroll export was deleted, whether a SharePoint copy remained, or whether an investigation file was frozen. Operational proof requires category-based rules, automated triggers, controlled access, review queues and a disposal log.
For Microsoft-centric employers, that means connecting HR records with payroll, time and attendance, Finance and operations rather than leaving retention decisions in disconnected spreadsheets. The policy should become a workflow that HR can run repeatedly, with clear exceptions for litigation, investigations and regulatory enquiries.
What UK Rules Actually Require for Retention Periods
A payroll file may need a different disposal date from an employee's personnel file, even when both relate to the same person. UK employee records retention is governed by purpose, necessity and record category. The ICO expects employers to justify how long information is kept, identify the relevant purpose and review whether continued storage remains necessary. The period can also depend on the event that starts the clock and the risk of a claim or investigation.
The UK Government's core HR records schedule shows how widely periods can vary. It includes employment records reviewed when the employee reaches age 85, pay records such as payslips, P45s, P60s and P11Ds kept for seven years from the last date of service, and annual leave and flexible-working timesheets kept for three years from the end of the leave year.
Read the rules by authority and category
The ICO provides the data-protection framework. Personal information should not be held longer than needed, but that principle does not create one schedule for every employment record. Government schedules offer category examples, while HMRC rules impose separate controls for payroll and tax evidence.
A usable mapping separates the record from its trigger:
- PAYE: The clock follows the relevant tax year, not just the employee's leaving date.
- National Minimum Wage: Retention is tied to the relevant pay-reference period.
- Holiday records: Evidence covers leave taken, holiday pay and payments in lieu, not only the entitlement policy.
- Disciplinary and grievance records: The trigger may be the last action in the case.
- Health information: Retention requires a specific justification, limited access and careful handling.
- Recruitment records: Application and interview evidence can follow a different trigger from active employment records.
For employers operating across the UK and EU, UK rules do not answer every question. EU GDPR also applies storage limitation, while employment, payroll, tax and works-council requirements can vary by member state. A UK schedule may provide a starting point, but European employee populations require local legal and operational review before one common rule is adopted.
HRManagement365's workplace compliance guidance helps connect retention decisions with day-to-day HR processes. In a Microsoft-centric implementation, those category rules can then be assigned to records in Dynamics 365, Dataverse and SharePoint, with evidence of reviews and disposal retained for audit.
Retention Periods by Record Category
The table below is designed for schedule design, not as a substitute for legal review. It separates the retention period from the trigger, because the trigger is where many otherwise careful policies fail.
| Record category | Typical retention period | Trigger that starts the clock |
|---|---|---|
| PAYE records | Three years from the end of the relevant tax year | End of the tax year to which the records relate |
| National Minimum Wage records created from 1 April 2021 | At least six years | The day the pay-reference period following the covered period ends |
| Annual leave, holiday pay and payments in lieu | At least six years from 6 April 2026 | Creation and transaction history for the relevant leave and pay records |
| Employee files and personal-development records | ICO example of six years after employment ends | End of employment |
| Disciplinary, grievance, accident and ill-health records | ICO example of six years after the last action | Last action in the case |
| Unsuccessful job applications | Cabinet Office example of one year | Advert-closing or interview date |
| Some recruitment supporting documents | Cabinet Office example of three years | Advert-closing or interview date |
| Certain employment records | Government schedule examples of three or seven years | Last date of service, depending on category |
| Health information | No universal period. Retain only while justified and necessary | Record-specific purpose, review date or end of relevant need |
| Right-to-work evidence | No single universal period in the provided UK guidance | Expiry, employment event or documented operational and legal need |
| Training and development data | Category-specific schedule required | Training event, employment end or continuing business need |
HMRC's PAYE guidance states that employers must retain records for three years from the end of the tax year to which they relate. The records should demonstrate accurate payroll reporting, including payments, Income Tax, National Insurance, Student Loan deductions, benefits, expenses and statutory payments. They shouldn't be scheduled solely from the employee's termination date. GOV.UK PAYE record-keeping guidance explains that tax-year relationship directly.
National Minimum Wage evidence uses a different calculation. Records created from 1 April 2021 must be retained for at least six years, calculated from the day on which the pay-reference period following the covered period ends. A record covering a pay-reference period ending in May 2021 must therefore be retained until 29 June 2027, as shown in HMRC's National Minimum Wage manual.
A useful schedule records the event that starts the clock, not only the final deletion date.
Retention guidance also needs to cover information that isn't stored in the main personnel file. The IamVera.AI data retention guide is useful background when teams are deciding how audit logs and generated records should be treated alongside formal employee documents.
Building a Defensible Retention Schedule
A payroll audit finds an accurate PAYE record, but the supporting absence note sits in an email attachment, a disciplinary file remains on a shared drive, and an occupational health report is stored with a provider. A defensible schedule starts by mapping those locations before anyone writes a policy.
List each HR record category across the employee lifecycle, including contracts, absence, performance, disciplinary matters, right-to-work evidence, occupational health, recruitment, training, payroll and employee communications. Include paper files, exports, email attachments and shared-drive copies. The formal HR platform is rarely the only place where information exists.
Use a schedule that can be loaded into a system
Each row should give a workflow enough detail to act without asking HR to interpret the policy manually:
- Inventory record categories: Name the record type and identify every storage location.
- Document purpose: State why the organisation holds it and which process it supports.
- Record the lawful basis: Connect the retention decision to the relevant legal, regulatory, operational or litigation need.
- Set the trigger and period: Specify whether the clock starts at employment end, last action, tax-year end, pay-reference-period end or another event.
- Assign an owner: Name the HR, payroll, legal or business owner responsible for review.
- Define the outcome: Select deletion, anonymisation, restricted archive, review or continued retention under an exception.
- Review and approve: Record who approved the rule, when approval occurred and when the rule must be reviewed.
The ICO's employment-records guidance recommends documenting each information category, its purpose, intended retention period and expiry action, such as deletion or anonymisation. Its examples retain employee files for six years after employment ends and disciplinary records for six years after the last action. Treat these as benchmarks, not automatic rules for every employer.
Build exceptions into the workflow
A legal hold must suspend normal deletion when records relate to a tribunal claim, investigation, audit or anticipated dispute. Identify the affected employee, record categories, systems and owner. Store the reason and review date, then require the owner to release the hold formally when the matter ends so normal retention can resume.
Disposal needs the same discipline. A review queue should identify records that have reached their threshold, give the owner a chance to approve or reject disposal, and create an entry showing the date, category, decision, approver and outcome. That evidence helps demonstrate that deletion followed the approved rule rather than an accidental file removal.
For a practical model of structured document storage and governance, see HR document management software from HRManagement365. The schedule then becomes a usable control for system configuration, reviews, holds and disposal evidence.
Implementing Retention in HRManagement365, Dynamics 365 and SharePoint
A retention rule fails when it exists only in a policy document. In a Microsoft-centric HR environment, the rule must connect the record category, trigger date, access controls, review task and disposal evidence across the systems that hold the record.
HRManagement365 is a UK and EU HR solution powered by Hubdrive and Microsoft technology, using Microsoft Dynamics 365, Power Platform and Dataverse. The implementation should distinguish Microsoft and Hubdrive platform capabilities from the configuration, integrations, workflows and HR applications set up for each customer.
Dataverse can hold structured employee, contract, absence and right-to-work data, with category and trigger fields available for automation. SharePoint can store supporting documents and apply Microsoft 365 information-management controls. Power Automate can generate review tasks, notifications and legal-hold workflow steps. Power BI can show records nearing review, overdue decisions and active holds.
Separate standard capability from customer-specific configuration
Microsoft supplies the platform services, identity controls, Dataverse, Power Automate, SharePoint and Power BI. Hubdrive supplies HR capabilities that operate within that Microsoft environment. HRManagement365 can extend that foundation through implementation and consultancy, customer-specific fields and entities, integrations, approval workflows, Power Apps, Power Automate solutions and applications for recurring employee-lifecycle processes.
A workable design includes:
- Dataverse classification: Store the record category, purpose, trigger date, retention period, review date, hold status and disposal outcome as structured fields.
- Document evidence: Link employee documents to the relevant HR record, then apply appropriate SharePoint storage and access controls.
- Automated review: Create owner tasks as a record approaches review, with approval options for deletion, anonymisation or continued retention.
- Cross-system reconciliation: Compare HR data with payroll, Business Central or Finance & Operations data before a deletion decision is completed.
- Reporting: Use Power BI to display approaching reviews, active holds, overdue decisions and completed disposal actions.
HMRC uses a default model of six years plus the current year, keeping records for six complete years after the last entry, followed by an additional review or disposal year. Longer retention requires a documented statutory, regulatory, legal, security or historical reason, as set out in HMRC's records-management and disposal policy.
The audit trail should identify the source record, rule applied, trigger date, approver, reason code, affected systems and final action. The HR document centre from HRManagement365 illustrates how employee documents and record actions can be managed through a structured operational process.
Auditability, Legal Holds and Disposing Records Defensibly
Retention is successful only when the organisation can reconstruct what happened. For an HMRC enquiry, an employment tribunal or a DSAR, HR may need to provide live operational data, historical versions, approval records, immutable evidence exports and a disposal log. A policy document alone won't establish that the retained record is complete or that an expired copy was removed across connected systems.
Holiday data needs transaction-level evidence
From 6 April 2026, UK employers must keep records of annual leave, holiday pay and payments in lieu, with records retained for at least six years. Acas guidance on keeping holiday records says the evidence needs to show leave taken, pay and unused-holiday payments, while maintaining accuracy and access controls.
That creates a practical audit challenge when data moves between HR, time and attendance, payroll and Finance. A corrected value should not overwrite the original without preserving the timestamp, approver, reason code and historical version. A central system can help, but centralisation alone does not prove that the audit trail is reliable.
Audit-grade evidence should answer five questions: what changed, when it changed, who approved it, why it changed and which systems received the change.
Freeze, review and dispose
A legal hold should prevent scheduled deletion of relevant records and linked evidence exports. The hold process must cover copies in Dataverse, SharePoint, payroll, Finance, email attachments, reporting stores and paper files. When the hold ends, an authorised owner should record the release and reassess the ordinary retention rule.
For records that reach expiry, defensible disposal normally includes:
- Eligibility check: Confirm the category, trigger date and applicable schedule.
- Exception check: Search active holds, investigations, audits and unresolved disputes.
- Approval: Obtain the named owner's decision.
- Linked deletion: Remove or anonymise copies across identified systems.
- Disposal log: Record the action, date, category, approver and outcome.
Where HR teams are reviewing large document sets, tools such as browse AI document analysis can help with document review workflows, but any use of automated analysis should sit within the organisation's access, confidentiality, retention and approval controls.
Common Pitfalls and a Practical Retention Checklist
The most persistent mistake is treating six years as an automatic rule. The ICO's example uses six years for particular categories, but the UK framework doesn't turn that figure into a universal employee-file period. Health information, PAYE, National Minimum Wage records, holiday evidence, recruitment documents and disciplinary files can all use different purposes and triggers.
Other failures are more operational:
- Mixing triggers: Employment-end dates, tax-year ends, pay-reference-period ends and last-action dates aren't interchangeable.
- Keeping payroll indefinitely: Cheap storage doesn't remove the need to justify continued retention or control access.
- Deleting one copy: Removing a Dataverse record while leaving a SharePoint export, email attachment, backup or finance extract creates an incomplete disposal.
- Ignoring health information: Occupational-health records need a specific reason for continued retention, controlled access and erasure or anonymisation when no longer needed.
- Skipping the disposal log: A successful deletion without recorded approval and scope is difficult to defend later.
The ICO guidance on using employment records says retention decisions should relate to the purpose for which information is held, with a documented policy and periodic review. It gives health information particular attention, including justification for continued retention, documented schedules and erasure or anonymisation when the information is no longer needed.
Use the checklist during each review cycle
- Check the schedule: Confirm each category has a purpose, trigger, period, owner and expiry action.
- Test legal holds: Review open holds and verify that protected records can't enter the deletion queue.
- Trace the data: Select a record and follow it through HR, SharePoint, payroll, Finance, reports and exports.
- Validate holiday evidence: Confirm leave taken, holiday pay and payments in lieu can be produced with their change history.
- Review sensitive access: Check that occupational-health and other confidential records are limited to appropriate roles.
- Test disposal proof: Confirm that an approved deletion creates a complete disposal log and addresses linked copies.
- Record exceptions: Capture the reason, approver, affected systems and new review date for every extension.
Employee records retention works best as an ongoing operating programme, not a one-off implementation project. HR, payroll, Finance, IT and legal stakeholders should review the schedule when regulations, systems, integrations or business processes change, then use audit evidence to test whether the controls work in practice.
HRManagement365 can help UK and EU organisations design category-based employee records retention across Dynamics 365, Dataverse, SharePoint and the wider Microsoft ecosystem, including custom workflows, integrations, legal-hold processes and auditable disposal actions. Speak to an HRManagement365 specialist and visit HR Management 365 to discuss how your HR, payroll and employee-lifecycle records can be connected and managed more defensibly. Phone +44 1522 508096 today or send us a message.
