Keeping records as an employer

What records to keep

There are certain employee and employer records that you must keep by law. There are other records you may want to keep as a matter of good practice.

It may be helpful to think about the ‘must keep’ records in three separate chunks – basic information, payroll records and other records and we talk about these in detail below.

In terms of the ‘may want to keep’ records, here we are thinking of information on matters like:

• training and appraisals
• records of lateness
• any disciplinary action you have taken
• terms and conditions of employment including any correspondence relating to changes to terms and conditions, CV/application form, references and other essential checks and details of termination of employment.

You can find templates on the ACAS website to help your record things like your employee's absence.

Such documents may be particularly important in the event of a dispute with your employee. The information may be stored in a variety of ways such as paper files or on a computer. However, where documents have been signed on paper, e.g. an employment contract signed by the employee, it may be best to keep a hard copy of the signed document.

See GOV.UK for information about other personal information you may want to keep on your employee, e.g. emergency contact details, details of any work relevant disability, qualifications and so on.

Basic information

As part of the starter procedure, you must gather and keep some personal information about your employees. This is explained on our page: Taking on an employee.

Payroll records

It is essential you keep accurate payroll records so that:

• HMRC can make sure that you and your employees are paying the right amount of tax and National Insurance (NIC), and
• your employees are getting any statutory payments they are entitled to (such as Statutory Sick Pay and so on).

You should note that the required details will be recorded automatically if you use payroll software to help you with your payroll tasks. As with any computer program it is recommended you keep regular backups. A backup is a snapshot of the information on the computer program at a specific date, saved to a different place, such as a USB stick. In any loss of data, you can then at least start off from the point of your last back up.

Users of HMRC’s Basic PAYE Tools (BPT) should check the user guide which contains step by step help on the most common functions of BPT, including how to back up your data. However, we understand that in an emergency, BPT automatically creates full data backups as zip files when the software is updated and every time the system is closed and these are stored on your computer in C:\Users\User_Name\AppData\Roaming\HMRC\payetools-rti\backups.

HMRC Online Services or an IT specialist may be able to restore them up to the point of the last file. However, this won’t help you if your laptop or computer breaks or is stolen and you need to transfer BPT on to a new one. If you do not have a backup file to restore the information from, you will have to manually re-enter the lost weeks/months of data (working from payslips you have issued for instance). Make sure you do not resend any payroll information that HMRC have already received.

If you are going to carry out your payroll tasks manually (i.e. on paper), your records must include:

• employee’s gross pay (before deductions)
• their National Insurance contributions
• the amount of tax you deduct under Pay As You Earn (PAYE)
• student loan deductions
• tax code
• any statutory payments made, like Statutory Sick Pay and Statutory Maternity, Paternity or Adoption pay
• details of any taxable benefits and expenses.

Much of this will be satisfied if you keep copies of your employee’s payslips, however you must also keep your calculations for working out the tax, employee's NIC and employer's NIC and so on, along with details of all payments you have made to HMRC. Form RT11 will help you here.

Both online and paper filers should make sure they keep any supporting hard-copy documents somewhere safe in case HMRC want to see them. Such documents may include your employee's P45 from their previous job or Starter Checklist.

  Tip: Take a photocopy of all submissions you physically post to HMRC or your employees, e.g. RT2 if you are a paper filer, P11D, P60 and send them registered post or something similar if you can.

You can find more information on keeping payroll records on GOV.UK and if you are a paper filer, in booklet RT7 – Guidance for employers exempt from filing Real Time Information online.

Other records

You are also required to keep other records to prove that you are complying with things like the minimum wage, auto-enrolment and other legal matters (see our employment law guidance for more information). You may need to supply these records in the event of a check on your compliance with the relevant laws.

When it comes to the minimum wage, it is up to you to determine what records you need to keep for these purposes, but you may be able to use existing records maintained for other purposes, such as pay, to help you. You should keep details of rate of pay and hours worked, including any overtime and bonuses.

For auto-enrolment, by law, there are two different types of records that an employer must keep. These are:

• records about workers: e.g. name, National Insurance number, date joined scheme, opt-out notices, and
• records about the pension scheme: e.g. employer pension scheme reference and scheme name and address.

You can find out more in The Pensions Regulator guidance.

In addition, you should keep records on things like:

• Accidents, injuries and dangerous occurrences – to meet health and safety requirements.
• Holidays and other days of leave, e.g. details of any absences for sickness (you should also keep records of supporting medical evidence), maternity/paternity leave (you should also keep records of supporting evidence that the employee provided you with to claim their statutory pay) or leave for any other reason, authorised or unauthorised.
• You must also keep records to ensure that daily and weekly working time limits and night time working time limits (under the Working Time Regulations) are being complied with.
• Evidence of the employee's right to work in the UK.

You may be able to find templates on the ACAS website to help you with some of these things.

How long to keep records

For PAYE purposes, it is sufficient that you retain your records for the current and three previous tax years. Records for 2023/24 should therefore be kept until at least 5^th April 2027.

Since 1 April 2021, minimum wage records must be retained for a minimum of six years (the previous requirement was three years). Further information can be found in the HMRC’s National Minimum Wage manual.

For auto-enrolment, you must keep records for a minimum of six years (except for records of opt-outs, which you must keep for four years).

You should ensure that you check all of the record-keeping requirements carefully for your own situation.

Sometimes your employees may ask you how long they need to keep their payslips for. All in all, it’s really in their best interests to keep hold of their payslips for as long as possible. Note that people who are required to submit a tax return have a legal obligation to keep them for a certain period.

Failure to keep accurate records

It’s in your interests to keep accurate payroll records, as it will help you pay the correct amount of PAYE tax and NIC on time. If you do not, you could face a penalty of up to £3,000.

HMRC can ask to see your records as part of a PAYE check.

Hopefully you will not need it, but for information on what to do if your records are lost, stolen, or destroyed see GOV.UK or for paper filers, see booklet RT7 – Guidance for employers exempt from filing Real Time Information online.

Data protection

You must follow rules on data protection if you handle and store personal information about your staff.

Under general principles, any personal information you keep on your staff should be adequate, relevant and not excessive. It must also be accurate, up to date and kept no longer than is necessary. When employers really no longer need to keep certain data, destruction must take place securely and effectively, for example by shredding.

Employees have the right to access their records. Before releasing employee data to a third party, the employer must seek the permission of the individual concerned.

You must make sure the information is kept secure – e.g. in a locked cupboard or on a password protected and virus protected computer.

There are even greater security requirements in respect of ‘sensitive personal data’ including physical/mental health conditions, as if this information is compromised or lost then there could be greater harm caused to the individual.

You can find out more on data protection on GOV.UK.

GDPR

The EU’s General Data Protection Regulations (GDPR), came into force across the UK in May 2018 via the Data Protection Act 2018. Although we have now left the EU, the law still applies.

You do not need to register with the data protection authority, the Information Commissioner’s Office, if you are only processing personal data for the purposes of staff administration. However there are several things for employers to take into consideration when ensuring compliance with the GDPR.

Identifying what personal data you have about employees, and why, will be a helpful first step. For example, you may collect identity data (name, date of birth and gender); contact information (email address and telephone number) and financial data – this includes bank account information and payment details.

Also think about the different purposes for which you process personal data, and different grounds for doing so – for example:

• Consent: the individual has given clear consent for you to process their personal data for a specific purpose;
• Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract or because you have a legitimate interest.

You should then consider the key principles of GDPR and how you can comply with them, including lawfulness, fairness and transparency, accuracy and integrity and confidentiality (security).

Other things to understand include are set out below.

Data protection – information to give to employees

Employers will need to provide detailed information, in plain English, to employees when they start their jobs (in their employment contracts for example, or a privacy notice – see a template here). This includes:

• your identity and contact details (as the data controller),
• how long data will be stored for,
• if data will be transferred to other countries, and
• information on their rights (for example the right to make a subject access request; and information on the right to have personal data deleted or rectified in certain instances).

Data breaches

There is a requirement to notify data breaches (such as an accidental or unlawful loss, or disclosure of personal data), to the Information Commissioner’s Office within 72 hours of becoming aware of them. Where the breach poses a high risk e.g. to the reputation of the employee, or could cause them financial loss, the individual concerned will also have to be notified. Employers should have adequate procedures in place to assess and respond to any data breach.

Employee consent

Questions have been raised about the idea of employers handling and storing their personal employee’s data based on an employee’s ‘consent’, given the likely imbalance of power in many employer/employee relationships. Employers will therefore have to ensure that any consent is ‘freely given, informed, specific and explicit’. You should be able to prove this by getting a clear, affirmative, statement from the employee that they consent to you handling/storing their data, however it should still be okay for employers to handle and store certain employee data based on other laws – e.g. where it is necessary for the performance of the employment contract (e.g. where you require bank details to be able to pay your employee).

GDPR – more information

You can find out more about GDPR on the ICO’s website. There is a hub for small business, here. Their guidance explains the data protection regime that applies to most UK businesses and organisations. It explains each of the data protection principles, rights and obligations. It summarises the key points you need to know, answers frequently asked questions, and contains practical checklists to help you comply.