Staff file checklist

What you need to know

The plain-English guidance that comes with this document.

• Why bother with this. A tidy, complete file is what turns a stressful "where's that form?" moment — an inspection, a dispute, a reference request — into a two-minute job. It also keeps you on the right side of data protection: your staff privacy notice promises you only hold what you need, and this is how you check you're keeping that promise.
• Keep the sensitive stuff separate. Health information and disciplinary or grievance records shouldn't sit loose in the main file. Hold them apart, with tighter access — health details are "special category" data and get extra legal protection.
• Only keep what earns its place. If you're holding something you don't actually need, the safest thing is to securely get rid of it. More paperwork isn't more protection — it's more to keep safe and account for.
• Have a retention schedule, and stick to it. Don't keep everything forever. As a rough guide, payroll and tax records are usually kept for around six years, and right-to-work evidence for the length of employment plus two years — but set your own schedule, write it down, and be able to explain it. Check gov.uk or the ICO for current specifics.
• One person, one file — don't mix people. Keep each person's records to themselves. It's tidier, and it stops one person's data leaking into a conversation about someone else.
• When someone leaves, don't just forget the file. Securely archive what you're keeping, delete what you're not, and diary the point at which the rest should go too.
• Same across the UK. Data protection law is UK-wide, so this applies the same in England, Wales, Scotland and Northern Ireland.