How long should HR files be kept in the UK?

It varies by document type. Payroll records should be kept at least 3 years after the tax year (6 is commonly advised), working time records 2 years, right to work checks for employment plus 2 years, and general personnel files around 6 years after employment ends to match the limitation period for contract claims. A retention schedule mapped to each record type is essential.

Is it compliant to store HR files in an office cupboard?

Rarely. UK GDPR requires appropriate technical and organisational measures, and HR files often contain special category data such as health information. An unlocked or unmonitored cupboard usually fails to meet that standard. Access-controlled, monitored storage with a documented chain of custody is the safer route.

What happens if we lose an HR file during a Subject Access Request?

You have 30 days to respond to a SAR. Being unable to locate records can turn a routine request into an ICO complaint and potential tribunal exposure. Keeping indexed digital copies alongside securely stored originals makes accurate, on-time responses far more reliable.

Should HR files be stored physically or digitally?

A hybrid model is strongest: store the physical originals in a secure off-site facility while using indexed digital copies for day-to-day access. This protects the masters, limits handling, and speeds up retrieval for queries and Subject Access Requests.

Best Way to Store HR Files Securely and Stay Compliant

The best way to store HR files securely and stay compliant is to keep them off-site in an access-controlled facility, separate special category data from general personnel records, apply documented retention schedules, and maintain a full audit trail of who touches each file and when. HR records are among the most sensitive data a UK business holds — names, salaries, bank details, medical notes, disciplinary history — and they sit squarely under UK GDPR and the Data Protection Act 2018. Get the storage wrong and you are not just risking a lost file; you are risking an ICO investigation, employment tribunal exposure, and the trust of your own staff.

Why HR Files Need Stricter Handling Than Ordinary Records

HR files routinely contain “special category data” as defined by UK GDPR — information about health, disability, trade union membership, ethnicity, religion, or sexual orientation. This data carries a higher bar: you need an Article 9 condition to process it, and the ICO expects “appropriate technical and organisational measures” to protect it. A cardboard box in an unlocked office cupboard does not meet that bar.

The risk is concrete. ICO fines under UK GDPR can reach £17.5 million or 4% of annual global turnover, whichever is higher. But the more common damage is quieter: an employee submits a Subject Access Request, you have 30 days to respond, and you cannot locate half their file. That gap alone can turn a routine request into a complaint and a tribunal claim.

The Core Principles of Compliant HR Storage

Whatever method you choose, compliant HR storage rests on five principles drawn directly from UK GDPR:

Storage limitation — keep files only as long as there is a lawful reason. Indefinite “just in case” archiving is a breach in itself.
Integrity and confidentiality — protect against unauthorised access, loss, and damage with physical and procedural controls.
Accountability — be able to demonstrate compliance, which means documented retention schedules and access logs, not just good intentions.
Data minimisation — don’t store more than you need; weed out duplicate copies and obsolete forms.
Accuracy — keep records current and retrievable so corrections can actually be made when requested.

How Long Should You Keep HR Records in the UK?

“Stay compliant” is impossible without a retention schedule, because both over-retention and premature destruction are problems. UK guidance and statutory rules give clear anchors:

Payroll and PAYE records — at least 3 years after the end of the tax year (HMRC), with 6 years commonly recommended for wider tax purposes.
Statutory Maternity, Paternity and Sick Pay — 3 years after the end of the tax year in which the period ended.
Working time and holiday records — 2 years from when they were made.
Right to work checks — for the duration of employment plus 2 years after it ends.
General personnel files — typically 6 years after employment ends, matching the limitation period for contract claims.
Accident and ill-health records — 3 years under RIDDOR, but records relating to hazardous substances can require 40 years.

The practical lesson: different documents in the same employee file expire at different times. A storage method that lets you retrieve, review, and dispose at the file or even document level — rather than treating every box as one lump — is what makes a retention policy enforceable rather than aspirational.

The Best Storage Setup in Practice

1. Move physical files off-site to a secure facility

An office filing room rarely offers the controls UK GDPR expects: 24/7 monitoring, fire suppression, intruder alarms, restricted keyholders, and an environment that won’t let paper degrade. A professional document storage facility provides all of these as standard, and crucially gives you a barcoded chain of custody so every box and file is tracked from collection to retrieval.

2. Separate special category data

Keep occupational health notes, disability adjustments, and similar sensitive material in clearly distinguished files with tighter access permissions. This makes Subject Access Requests easier to fulfil accurately and limits exposure if a single file is ever accessed in error.

3. Digitise for day-to-day access

Storing the physical originals securely while keeping indexed digital copies for daily use is the strongest hybrid model. Document scanning with accurate indexing means your HR team answers a query in seconds without anyone handling the master file — and a 30-day SAR deadline stops being a scramble. Originals stay locked away; access is logged.

4. Build disposal into the system

Storage limitation means secure destruction at end of life. A provider that combines storage with certificated shredding closes the loop: when a retention date passes, the file is destroyed and you hold a certificate proving it. That certificate is exactly the kind of evidence the ICO looks for under the accountability principle.

A Simple Compliance Checklist

Off-site, access-controlled storage with a documented chain of custody
Written retention schedule mapped to each record type
Special category data segregated with restricted access
Indexed digital copies for SAR and day-to-day access
Access logs showing who retrieved what and when
Certificated secure destruction at end of retention

Tick all six and you have a setup that is both genuinely secure and demonstrably compliant — the two things an ICO investigation or a tribunal will actually test. For more guidance on choosing a provider, see our resources library.