How long can you keep personal data under UK GDPR?

Part of the guide What are the UK GDPR principles? All seven, in plain English

Does UK GDPR say how long to keep data?

No. UK GDPR does not set a time limit for each type of data. The ICO says the choice is yours, based on how long your purposes need the data.

The rule behind this is storage limitation, one of the UK GDPR principles. Article 5(1)(e) says personal data must be kept in a form that identifies people for no longer than is necessary for its purposes.

You also carry the proof. Article 5(2) makes the controller, the organisation in charge of the data, responsible for showing that it meets the principles.

The ICO says its storage limitation guidance is under review because of the Data (Use and Access) Act, so the detail may change.

How long should you keep common business records?

Common business records often have a period set by another UK rule, not by UK GDPR. The ICO says keeping data to meet a legal requirement, such as tax or audit records, is not keeping it too long.

The table shows records most UK employers hold, with the period GOV.UK gives for each. It is not a full list, and your sector may have its own rules.

Keeping too little also causes problems. Without full payroll records, GOV.UK says HMRC may estimate what you owe and charge a penalty of up to £3,000.

How long should you keep employee records?

Employee records have no single period under UK GDPR. Parts of the file have their own rules, such as payroll records and right to work copies.

When someone leaves, the ICO gives an example. The employer should delete what it is unlikely to need again, such as emergency contact details, previous addresses or death-in-service beneficiary details.

Then there are job applicants you did not hire. The ICO says not to keep their recruitment records beyond the legal period for bringing a claim about the recruitment. The exception is a clear business reason.

What is a data retention policy, and do you need one?

A data retention policy, or retention schedule, lists the records you hold, what you use them for and how long you plan to keep them.

The ICO describes it as a document that sets out how you manage, store and delete records. If a law makes you keep something for a set time, record that reason in the policy.

A small organisation doing occasional low-risk processing may not need a written policy. It must still review its data regularly, and delete or anonymise what it no longer needs.

The ICO's starting point is simple. Have a reason to keep information, not a reason to get rid of it. Do not keep data just in case you might use it one day.

What should you do when the retention period ends?

When a retention period ends, the ICO says review whether you still need the data. Erase or anonymise it unless there is a clear reason to keep it for longer.

Deleting means deleting everywhere. The ICO says that if you delete data from a live system, you should also delete it from that system's backups. Backups and archives need their own retention periods.

An email moved to a Deleted items folder has not been deleted, the ICO says. Destroy personal data securely.

How does retention affect subject access requests and breaches?

Retention affects a subject access request, where a person asks for a copy of their data. The ICO says the request covers the information you hold when it arrives.

Old data makes requests harder. The ICO says it may be more difficult to answer one if you kept information too long. Searching thousands of old documents takes longer than searching a few hundred current ones.

Routine deletion can carry on while you deal with a request. Deleting or changing data only because of the request is not acceptable. Under the DPA, the ICO says, changing requested information to stop it being disclosed is an offence.

You do not need to rebuild data you deleted as part of your normal records management to answer a request.

UK GDPR Article 5(1)(f) requires appropriate security for personal data, including against accidental loss. The ICO adds that the more personal data you hold, the more security you need.

If old records are lost or stolen, our guide to when to report a personal data breach sets out the next steps. For payroll, GOV.UK says tell HMRC as soon as possible if you do not have records and cannot replace them.

What to do

1. List the personal data you hold, what you use it for and how long you plan to keep each type.
2. Check GOV.UK for any period another UK rule sets, such as payroll or company records.
3. Write your reasons in a retention policy, unless your processing is occasional and low risk.
4. At the end of each period, erase or anonymise what you no longer need, including copies in backups.
5. Tell staff not to delete or change data because a subject access request has arrived.

Common questions

Can you keep personal data forever under UK GDPR?

Not as a general rule. The ICO says not to keep data indefinitely just in case. The exception is data kept only for public interest archiving, research or statistics.

Is there a 6 year rule for keeping data under UK GDPR?

No. UK GDPR sets no period. A 6 year period comes from other rules, such as limited company accounting records and minimum wage records.

Where next

• What are the UK GDPR principles? All seven, in plain English
• DSAR: what to do when a subject access request arrives
• When must you report a personal data breach?
• What must your UK privacy notice say?
• Does GDPR apply to small businesses and sole traders?

This is an independent editorial guide, not legal advice.