Employers hold a lot of personal data about staff and candidates, and the UK GDPR says you must not keep it longer than necessary. But "necessary" is not a single fixed number; it depends on why you hold each piece of data. This guide explains how to set sensible retention periods for former employees and unsuccessful applicants in England and Wales.
The governing principle: storage limitation
Under the UK GDPR, the storage limitation principle requires you to keep personal data only for as long as you need it for the purpose you collected it. There is no single statutory retention period for HR records, instead, you justify each period by reference to a legal requirement or a genuine business need, and delete when that need ends.
Unsuccessful job applicants
For candidates you did not hire, you usually only need their data for a short period after the recruitment decision, commonly around 6 months. Reasons to keep it briefly include:
- defending a potential discrimination claim (an employment tribunal claim is generally brought within 3 months, so a few months' retention covers that risk); and
- considering the candidate for future roles, but only if you told them you would, and they did not object.
Keeping unsuccessful applicants' data indefinitely is hard to justify.
Former employees
For people who have left, you typically keep core records longer, because of ongoing legal and practical needs:
- General employment records are often kept for around 6 years after employment ends, reflecting the six-year limitation period for many contract claims.
- Payroll and tax records must be kept to meet HMRC requirements (typically several years).
- Some records have their own minimum retention rules (for example, certain health and safety or pension records may need to be kept longer).
The key is to set a schedule that matches each category of data to a justified period, rather than keeping everything forever.
Build a retention schedule
Good practice is to:
- create a data retention policy / schedule listing categories of HR data and how long you keep each;
- base periods on legal requirements (tax, limitation periods, sector rules) and genuine need;
- securely delete or anonymise data when the period ends; and
- tell people, in your privacy notice, how long you keep their data.
The ICO's employment practices guidance is a useful reference.
Key takeaways
- The UK GDPR's storage limitation principle means keep data only as long as necessary, there is no single fixed period.
- Unsuccessful applicants: usually a short period (often around 6 months), mainly to cover discrimination-claim risk.
- Former employees: core records often kept around 6 years (limitation period), with payroll/tax and some other records to their own rules.
- Use a retention schedule, delete when no longer needed, and explain retention in your privacy notice.
Sources
- UK GDPR and Data Protection Act 2018 (storage limitation principle)
- Limitation Act 1980 (six-year limit for contract claims) and HMRC record-keeping requirements
- ICO guidance on employment practices and data retention
--- This article is general information about the law of England & Wales as at 2026, not legal advice. For advice on your circumstances, consult a qualified solicitor.