PA employment records: a retention schedule that uses the right periods
A record-by-record retention guide for payroll, pensions, right-to-work checks, holiday, working time, DBS information and general employee data.
For Direct Payment employers and organisations supporting them
In brief
- There is no single six-year rule for every PA employment record.
- PAYE records are normally kept for three years after the end of the relevant tax year; right-to-work evidence lasts through employment plus two years.
- DBS information should not be stored indefinitely, while Great Britain holiday records made from 6 April 2026 have a six-year requirement.
Use a retention schedule, not a blanket rule
A retention schedule identifies each record, why it is held, who can access it, how long it remains necessary and what happens at the end. This is safer than telling employers to keep everything for six years or forever.
| Record | Retention period | Important detail |
|---|---|---|
| PAYE and payroll records | 3 years from the end of the tax year they relate to | HMRC's rule covers payments, deductions, employee leave and reports needed for payroll. |
| Automatic-enrolment pension records | Usually 6 years; opt-out notices 4 years | Keep the assessment, communications, scheme and contribution records required by The Pensions Regulator. |
| Right-to-work check | Throughout employment and 2 years after it ends | Applies to manual and online check evidence; destroy securely after the period. |
| Holiday entitlement and holiday-pay records made under the Great Britain duty from 6 April 2026 | 6 years from the date made | Keep enough to demonstrate entitlement, leave taken, carry-over and pay compliance. |
| General Working Time Regulations records in Great Britain | 2 years from the date made | Covers records needed to show compliance with working-time limits; holiday records now have their separate period. |
| DBS certificate information | Only as long as necessary; DBS sample policy suggests normally no longer than about 6 months after the decision | Keep minimal outcome details longer only where there is a justified purpose; do not routinely retain a full certificate. |
| Current employers' liability certificate | Display or make available while current; no current statutory 40-year retention rule | The old 40-year certificate rule was removed in 2008. Historical retention may still be sensible but is not that old legal duty. |
| Other employment data | No single fixed period | Set and justify the period under the UK GDPR storage-limitation principle and any relevant claim or legal need. |
Do not confuse council instructions with HMRC rules
Some council policies tell Direct Payment recipients to keep financial evidence for six years. The employer should follow the funding agreement where that is a condition, but should not describe it as HMRC's universal payroll rule. HMRC's published PAYE retention period is three years from the end of the relevant tax year.
A record can fall under more than one purpose. For example, a payroll report may be subject to HMRC's period and also be required under a council agreement for longer. Record both reasons in the schedule and use the longer justified period.
Use a practical file structure
- —Recruitment: advert, applications, scoring, references and outcome.
- —Identity and checks: right-to-work evidence and the minimum safeguarding-check record.
- —Terms: written statement, contract variations and policies provided.
- —Working records: timesheets, working-time exceptions and approvals.
- —Leave and absence: requests, decisions, balances, sickness dates and payroll evidence.
- —Payroll and pensions: input packs, payslips, reports, HMRC liabilities and pension schedules.
- —Performance or concerns: restricted notes and formal correspondence.
- —Leaver: notice, final inputs, P45, access closure and retention review.
Restrict access by sensitivity
Payroll staff need approved hours and employee identifiers; they do not need detailed care notes. Council reviewers may need payroll evidence; they do not automatically need a DBS certificate or diagnosis. Other PAs do not need access to a colleague's file.
Use named accounts, remove leaver access, avoid personal information in filenames and record external downloads. Do not use a shared family login for employment documents.
Run a yearly deletion review
Once each year, identify records whose period has ended. Check for a live dispute, statutory hold or funding requirement, document the decision and delete securely. Keep a deletion log containing the record category, period and deletion date—not the deleted personal information itself.
Sources and further guidance
These links are provided so readers can check the underlying official guidance. Local Direct Payment agreements and individual employment circumstances still need to be considered.