This is general information about UK rules, checked on the date above. It is not legal advice, and rules change. For a decision that matters, check the sources below or ask a qualified adviser.
Staff records have different clocks. Payroll records run from the end of the tax year, holiday records run from the date they were made, and right to work copies run from the day someone leaves. If you keep everything in one folder with one rule, you will probably keep some things too long and delete others too early.
The short version
| Record | Keep for | Clock starts |
|---|---|---|
| Payroll records | 3 years | End of the tax year they relate to1 |
| Holiday and holiday pay records | 6 years | The date they were made2 |
| Right to work document copies | Employment plus 2 years | The date they stop working for you3 |
These are the minimums in the guidance we have checked. Other records, such as accident and pension records, have their own rules, and this article does not cover everything an employer might hold.
Payroll records
HMRC requires you to collect and keep records of what you pay your employees and the deductions you make, your reports to and payments to HMRC, employee leave and sickness absences, tax code notices, taxable expenses or benefits, and more.1
You must be able to show you have reported accurately, and keep the records for 3 years from the end of the tax year they relate to. If you do not keep full records, HMRC may estimate what you have to pay and charge a penalty of up to £3,000.1
Holiday records
Since 6 April 2026, employers must keep records of annual leave and holiday pay for at least 6 years from the date they were made. That includes holiday taken, holiday carried over, holiday pay with details of what it includes, and payments in lieu.2 Our article on the holiday records duty covers this in detail, because failing to keep them could be a criminal offence.2
Right to work checks
Before you employ someone, you must check they have the right to work in the UK. As part of that check, you make and keep copies of the documents, and record the date you made the check. The copy must be one that cannot be changed, for example a photocopy, and must be clear enough to read.3
You keep these copies during the person’s employment and for 2 years after they stop working for you. If their right to work is time-limited, you need to check their documents again when it is due to expire.3
The penalties are serious. If you employ someone without the right to work and did not carry out the correct checks, you could face a civil penalty of up to £60,000 for each illegal worker. Knowingly employing an illegal worker, or having reasonable cause to believe they had no right to work, can lead to 5 years in prison and an unlimited fine.4
Keeping too much is also a problem
It might seem safest to keep everything forever, but data protection law does not work like that. Personal data should only be kept as long as you need it, and the Information Commissioner’s Office has guidance specifically on keeping employment records, including what kinds of records you might keep and the lawful basis for keeping them.5
In practice, this means setting a deletion date for each type of record. When someone leaves, some of their records will still need to be kept for years, while others can go. A good record system should be able to tell you which is which.
Access and security
Staff files often contain bank details, home addresses, passports and health information. Information about workers’ health needs particular care, and the ICO has separate guidance on sickness and injury records.6
Our own suggestions for a small employer are:
- Keep files in one controlled place. Avoid scattered copies in email attachments, downloads folders and personal phones.
- Limit access by role. A line manager needs to see holiday dates, but not necessarily payroll.
- Keep an audit trail. Know who changed what, particularly for pay and holiday balances.
- Back up, and check you can restore. A backup you have never tested may not work when you need it.
- Decide what happens when someone leaves. Make it part of your leaver process, not something you think about years later.
A practical record map
If you are starting from scratch, this is a simple way to organise things. It is our suggestion, so adapt it to your business and take advice where the stakes are high.
| Folder | What goes in it | Deletion rule |
|---|---|---|
| Payroll | Pay, deductions, reports to HMRC, leave and sickness | 3 years after the tax year ends |
| Holiday | Leave taken, carried over, holiday pay, payments in lieu | 6 years after each record was made |
| Right to work | Document copies and the date of the check | 2 years after employment ends |
| Contract | Contract, changes, handbook version | Take advice on your own position |
| Health | Fit notes and absence notes | Restricted access; take advice |
From folders to a system
Paper and spreadsheets can work for a very small team, and Acas confirms a spreadsheet is acceptable for holiday records.2 The trouble comes as you grow, because nothing reminds you that a visa expires in March, or that a set of records can now be deleted.
That is what our HR and rota software is designed for: holiday, absence and staff details kept in one place, with reminders for dates that matter. If you are still on spreadsheets and want to judge when to move, our article on spreadsheet errors is a useful place to start.
Sources
-
GOV.UK, PAYE and payroll for employers: keeping records, accessed 7 November 2026. ↩ ↩2 ↩3
-
Acas, Keeping records: holiday entitlement, last updated 1 October 2026, accessed 7 November 2026. ↩ ↩2 ↩3 ↩4
-
GOV.UK, Checking a job applicant’s right to work, accessed 7 November 2026. ↩ ↩2 ↩3
-
GOV.UK, Penalties for employing illegal workers, accessed 7 November 2026. ↩
-
Information Commissioner’s Office, Employment practices and data protection: keeping employment records, accessed 7 November 2026. ↩
-
Information Commissioner’s Office, Employment information, accessed 7 November 2026. ↩
HR and rota software
Holiday requests, rotas and absence in one place your staff can reach from their phones.
See how it works