Data Protection Principle 5 - Not kept for longer than is necessary

The retention of payroll records is defined in law. Pay records and related SSP, SMP, SPP, SAP tax credit and student loan deduction details must be kept for at least three years beyond the current tax year. However, many employers use the same six-year retention period that is used for accounting records.

Principle 5 does not specify any retention periods. The issue for each data controller to consider is whether any particular data is still required for the business purpose for which it was obtained. A good indication of this would be the number of times that it has been accessed over a number of years. Some employers keep information about former employers for many years in order to respond to reference requests. In practice, however, very few requests are received for most former employees after five years, so a value judgement needs to be made between the work involved in searching for leaver records and the few occasions when it will be necessary to disappoint an employer seeking a reference. However, leaver records that contain information relating to an accident or injury at work should be retained for many years.

An alternative approach to the problem of leaver records is to reduce the record to just a summary of the employee's details, retaining perhaps just the employee's name, job and employment dates. Even thought that is, in principle, still personal data, the DPA allows information to be retained indefinitely for research, historical and statistical purposes if

• the data is not used to make decisions about the data subject, and
• the data is not used in any way that could cause damage or distress to the data subject.

The Information Commissioner's Code of Practice does not suggest any retention periods for personal data. Each data controller should determine appropriate periods that will support the needs of the business. Some personnel data, such as references received, holiday dates and spent disciplinary records might to be deleted after a year or two. There may be a need to keep appraisal documents for a longer period. Accident and injury at work records may need to be kept indefinitely. Principle 5 puts the responsibility for retention decisions on the data controller.