Staff file checklist

What you need to know

The plain-English guidance that comes with this document.

• Why bother with this. A tidy, complete file is what turns a stressful "where's that form?" moment — an inspection, a dispute, a reference request — into a two-minute job. It also keeps you on the right side of data protection: your staff privacy notice promises you only hold what you need, and this is how you check you're keeping that promise.
• Keep the sensitive stuff separate. Health information and disciplinary or grievance records shouldn't sit loose in the main file. Hold them apart, with tighter access — health details are "special category" data and get extra legal protection.
• Only keep what earns its place. If you're holding something you don't actually need, the safest thing is to securely get rid of it. More paperwork isn't more protection — it's more to keep safe and account for. Interview notes for the person you hired are a good example: useful for a few months, then bin them.
• DBS certificates have their own rule. You can note the certificate number, date and level, but you shouldn't keep a copy of the certificate itself for more than six months. Record it, then destroy it.
• Have a retention schedule, and stick to it. Don't keep everything forever. As a rough guide, payroll and tax records are usually kept for around six years, and right-to-work evidence for the length of employment plus two years — but set your own schedule, write it down, and be able to explain it. Check gov.uk or the ICO for current specifics.
• One person, one file — don't mix people. Keep each person's records to themselves. It's tidier, and it stops one person's data leaking into a conversation about someone else.
• When someone leaves, run the last section. Final pay (including holiday owed — every untaken day is a day's pay), the P45, and getting keys and logins back are the things that get forgotten in the rush. Then securely archive what you're keeping, delete what you're not, and diary the point at which the rest should go too.
• Same across the UK. Data protection law is UK-wide, so this applies the same in England, Wales, Scotland and Northern Ireland.