What Data an Old Employer Can Keep About You

Why an old employer keeps records at all

Leaving a job does not wipe you from your former employer's systems, and that is usually by design rather than neglect. An employer is treated as the data controller for the information it holds about you, which means it decides why and how that data is kept. Under UK GDPR it must have a lawful basis to hold each piece of information, and once that basis runs out, the data should be reviewed, minimised, or deleted.

For a former employee, several lawful reasons commonly keep records alive. Some data is held to meet a legal obligation, such as tax and payroll records HMRC expects employers to retain. Some is kept for the employer's legitimate interests, such as being able to answer a future reference request or defend against a claim. Pension contributions create their own long retention needs. None of this means an employer can keep everything forever for any reason.

This article is general information, not legal advice. Retention periods and lawful bases vary by sector and by the type of record, and an employer should be able to point to a retention policy if you ask. If your situation is complex or contested, a qualified adviser can look at the specifics.

What typically stays, and for how long

In practice, certain categories of data tend to remain on file after you leave, each for a different reason. The exact periods below are common UK norms rather than fixed universal rules, and a particular employer's policy may differ. The point is to recognise that a kept record is not automatically an improper one.

Knowing which category a piece of data falls into helps you judge whether keeping it still makes sense. If something sits well outside its expected purpose or period, that is a reasonable thing to question.

• Payroll and tax records: held to satisfy HMRC obligations, commonly for around six years after the relevant tax year.
• Pension records: often kept much longer, because they may be needed for decades to administer your benefits.
• Your contract and core HR file: typically retained for a period after employment ends so the employer can handle references, disputes, or legal claims.
• Right-to-work and immigration checks: kept for set statutory periods to evidence the employer met its duties.
• Disciplinary or grievance records: usually retained for a limited time, then reviewed; old, spent matters should not linger indefinitely without reason.
• Sickness and health information: more sensitive, so it should be held for shorter periods and with tighter limits.

The rights you still have over those records

Leaving the organisation does not strip you of your data-protection rights. You can make a data subject access request (a DSAR) to ask what your former employer still holds about you, why, and how long they intend to keep it. They must normally respond within one month and cannot charge you in most cases. This is often the clearest way to find out what is actually on file rather than guessing.

If something is wrong, such as an inaccurate leaving date or a mistaken note, you can ask for it to be corrected through your right to rectification. You can also ask for data to be deleted under the right to erasure, though that right is not absolute. Where the employer still has a genuine legal obligation or a strong legitimate interest in keeping a record, it can lawfully refuse erasure for that specific data while the reason holds.

OSINTA is built to help you understand your own footprint and prepare your own requests; it does not act for you or contact your employer on your behalf. The decision and the wording always stay with you. If you believe a former employer is keeping data it has no proper basis to hold, you can raise it with them first and, if unresolved, complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator. This remains general information, not legal advice.

Frequently asked questions

Related terms

• Personal data
• Data Subject Access Request (DSAR)
• Right to erasure
• Data controller