Data Retention Policy
1. Introduction
This policy sets out how Vested Talent Ltd retains and securely disposes of personal, employment, recruitment, financial and other business records. Retention periods are based on applicable legal and regulatory requirements, legitimate business needs and the principle that personal data should not be kept for longer than necessary.
2. Responsibility
The Data Protection Officer (DPO) is responsible for implementing and monitoring compliance with this policy. The DPO will review this policy at least annually and following material changes in legislation, regulatory guidance, business activities or the systems used to store records.
Managers and employees are responsible for following the retention periods that apply to the records they create or use and for ensuring that records are stored securely.
3. Retention and Disposal Process
- Records may be held in paper or electronic format, provided they are secure and can be retrieved when required.
- Records must be retained for the period specified in the schedule below, unless a longer period is required by law or a documented business/legal need applies.
- Before deletion or destruction, records must be reviewed to identify any litigation, complaint, investigation, regulatory request, audit or other legal hold that requires retention to continue.
- When the retention period ends, records must be securely deleted, anonymised or destroyed. Paper records must be securely shredded.
- Any departure from a stated retention period should be documented and approved by the DPO or a Director of Vested Talent Ltd.
4. Recruitment and Work-Seeker Records
Vested Talent Ltd operates as a permanent recruitment business. The Conduct of Employment Agencies and Employment Businesses Regulations 2003 require recruitment agencies to maintain appropriate records about work- seekers and hirers. Records must generally be retained for at least 2 years after the agency last provided work-finding
services to the relevant work-seeker or hirer and must be readily accessible if requested by the Fair Work Agency.
| Record type | Retention period | Basis / notes |
|---|---|---|
| Work-seeker records used for work-finding services, including contact details, CV/application, qualifications, experience, authorisations, introductions, resulting engagement and relevant enquiries. | At least 2 years after Vested Talent Ltd last provided work-finding services to the work- seeker. | Conduct Regulations 2003 / Regulation 29. Longer retention may apply where there is a documented legal or legitimate business need. |
| Hirer/client records relating to vacancies, including vacancy details, requirements, enquiries, introductions, fees/invoices and relevant communications. | At least 2 years after Vested Talent Ltd last provided work-finding services to the hirer. | Conduct Regulations 2003 / Regulation 29. Records must be readily accessible for regulatory inspection. |
| Unsolicited/speculative CVs where no work-finding action is taken. | Delete when no longer necessary and, where retained, normally within 2 years unless a clear lawful basis and business need justify longer retention. | Data minimisation applies. The Conduct Regulations do not require records to be retained where no action is taken to find work. |
| Rejected candidate/application records where Vested Talent Ltd has actively assessed or progressed the candidate. | Normally 2 years after the candidate is notified of the outcome, unless a longer period is justified and documented. | Legitimate interests, including defending claims and considering candidates for suitable future roles where appropriate. |
| Successful candidate recruitment records that form part of an employee file. | Normally for the duration of employment and up to 6 years afterwards where necessary for legal/business purposes. | Retention should remain proportionate to the type of record and applicable legal requirements. |
5. Employee Records
| Record type | Retention period | Basis / notes |
|---|---|---|
| Employment contracts, written particulars, variations, offer letters and core employment correspondence. | Normally 6 years after employment ends. | Legitimate interests / legal requirements. Longer periods may apply where a deed or other specific legal obligation requires it. |
| Performance, conduct, probation, appraisal, promotion and disciplinary records. | Normally for the duration of employment and up to 6 years afterwards where necessary. | Retention must be proportionate to the nature of the record and any potential claim. |
| Annual leave and working-time records required to demonstrate compliance. | 6 years from the date the record was made, where applicable. | Applicable working-time and employment legislation. |
| Sickness and absence records. | Normally no longer than 3 years after the relevant record, unless a longer period is necessary for a specific legal claim or obligation. | Special category health data must be minimised and securely restricted. |
| Parental leave, maternity/paternity/adoption records. | Normally 3 years after the end of the tax year in which the relevant statutory payment period ends, where applicable. | Applicable statutory-pay requirements. |
| Redundancy and termination records. | Normally 6 years after employment ends. | Legitimate interests / legal claims and employment law requirements. |
6. Right-to-Work and Identity Records
| Record type | Retention period | Basis / notes |
|---|---|---|
| Copies/evidence of right-to-work checks and relevant identity documents used for the check. | For the duration of employment and 2 years after employment ends. | Home Office right-to-work guidance. Records must be securely stored and then destroyed. |
| Recruitment identity information not required for a completed right-to-work check. | Only for as long as necessary for the recruitment purpose, subject to the applicable recruitment retention period. | UK GDPR storage limitation and data minimisation. |
7. Criminal Records and DBS Information
Vested Talent Ltd will only process criminal offence data where there is a lawful basis and where the processing is necessary and permitted by applicable law. Access will be restricted to authorised individuals.
| Record type | Retention period | Basis / notes |
|---|---|---|
| DBS certificate information. | Usually no longer than 2 years after the relevant recruitment decision. | DBS guidance states certificate information should usually be destroyed after a suitable period, normally no longer than 6 months, unless there is a specific reason for longer retention. |
| Limited record that a DBS check was completed and the outcome, where necessary. | Only for as long as necessary to demonstrate the recruitment decision or safeguarding process. | The certificate itself should not be retained unnecessarily. Any retained record must be proportionate and securely stored. |
8. Payroll, Tax and Financial Records
| Record type | Retention period | Basis / notes |
|---|---|---|
| PAYE/payroll records, including pay, deductions, HMRC reports/payments, tax codes, taxable benefits and relevant leave/sickness information. | 3 years from the end of the tax year to which the records relate. | HMRC PAYE record-keeping requirements. |
| records, including sales/purchases, VAT invoices and VAT account. | Normally 6 years. | HMRC VAT record-keeping requirements, subject to any specific statutory exception. |
| Company accounting records and supporting financial records. | Normally 6 years from the end of the relevant financial year. | Business/tax record-keeping requirements. Longer retention may apply to records needed for an ongoing legal matter. |
| National Minimum Wage records, where applicable. | At least 6 years from the end of the relevant pay- reference period as required by the NMW rules. | National Minimum Wage Regulations 2015. |
9. Pension and Auto-Enrolment Records
| Record type | Retention period | Basis / notes |
|---|---|---|
| Automatic enrolment and pension records, including enrolment, contributions and relevant communications. | Generally 6 years, subject to the specific record type. | The Pensions Regulator record-keeping requirements. |
| Pension opt-out notices. | 4 years. | Specific auto-enrolment record-keeping requirement. |
10. Complaints, Legal Claims and Investigations
Records relating to complaints, grievances, disciplinary matters, investigations, data protection complaints, legal claims and regulatory enquiries will be retained for as long as reasonably necessary to investigate, resolve or defend the matter and to comply with any applicable legal or regulatory requirement.
Where a formal legal hold or investigation is in place, the normal deletion date will be suspended for the records relevant to that matter until the DPO or a Director confirms that the hold can be lifted.
11. Data Protection and Special Category Data
Personal data, including health information and other special category data, must only be retained for as long as necessary for the purpose for which it is processed. Retention periods must not be extended simply because the information is convenient to keep.
Where criminal offence data or special category data is retained, Vested Talent Ltd will apply appropriate access controls, security measures and any additional documentation required by applicable data protection law.
12. Records Not Listed in This Schedule
If Vested Talent Ltd creates or receives a type of record that is not listed in this policy, the record owner should contact the DPO before setting a retention period where the appropriate period is unclear. The DPO will determine an appropriate period based on the purpose, legal requirements, business need and data protection principles.
13. Review of this Policy
This policy will be reviewed at least annually and whenever there is a material change to data protection law, employment or recruitment regulation, tax requirements, Vested Talent Ltd’s services, or the systems used to store records.
This policy should be read alongside Vested Talent Ltd’s Privacy Notice, Data Protection Policy, Complaints Policy and Procedure and other relevant internal policies.
Key Legal and Regulatory References
- UK GDPR and Data Protection Act 2018 – storage limitation, lawful processing and security.
- Conduct of Employment Agencies and Employment Businesses Regulations 2003 – recruitment agency record keeping (including Regulation 29).
- Home Office right-to-work guidance – retention of right-to-work evidence for the duration of employment and 2 years afterwards.
- HMRC PAYE guidance – payroll records generally retained for 3 years from the end of the relevant tax year.
- HMRC VAT guidance – VAT records generally retained for 6 years.
- National Minimum Wage Regulations 2015 – relevant NMW records retained for at least 6 years under current rules.
- DBS Code of Practice / DBS guidance – certificate information usually retained for no longer than 2 years unless a specific reason justifies longer retention.
- Pensions Regulator guidance – record-keeping requirements for automatic enrolment and pension records.
Note: Retention periods in this policy are internal rules designed to meet applicable legal, regulatory and business requirements. Where a specific legal requirement changes, the legal requirement takes precedence and this policy will be updated at the next review or
Contact sales
We’d love to see how we can streamline your hiring together.
Request a demo
Contact sales
We’d love to see how we can streamline your hiring together.
Request a demo
Contact sales
We’d love to see how we can streamline your hiring together.
