How long can HR keep employee and candidate data? EU retention periods
The short answer. Rejected candidates: about four weeks without their consent, up to a year with it, and around six months in Germany. Payroll and wage tax records: 5 to 10 years. Employment contracts: the length of employment plus 2 to 7 years. The general personnel file: 2 to 5 years after someone leaves. The table below covers every category, and national law can move each number in both directions.
There is no single EU retention period for HR records. Each category is driven by a different law, and the two failure modes point in opposite directions: keep data too long and you breach the storage limitation principle, delete it too early and you breach a tax or labor obligation.
This is a working reference for the most common HR categories, the typical retention range, and the rule that sets it. Treat the numbers as orientation. The exact period is fixed by national law, and it changes between member states.
Why retention is a two-sided obligation
Retention is a two-sided obligation: a floor set by tax and labor law, and a ceiling set by the GDPR. Most people only see the floor, which says keep records at least this long. The ceiling is the part that gets missed.
Article 5(1)(e) is the storage limitation principle. Personal data must be kept in a form that permits identification for no longer than necessary. A personnel file you held onto for a decade after someone left, with no legal reason to keep it, is a breach even if nobody ever looked at it. So a retention schedule is not just about surviving a tax audit. It is about deleting on time, every time, and being able to show you did.
HR retention periods at a glance
The table below gives typical EU ranges. National law overrides them in both directions.
| HR record category | Typical retention | What drives it |
|---|---|---|
| Payroll and wage tax records | 5 to 10 years | National tax law (for example the Dutch Belastingdienst at 7 years, German records under the Abgabenordnung and GoBD) |
| Employment contracts and amendments | Duration plus 2 to 7 years | Limitation periods for labor and contract claims |
| General personnel file (non-tax parts) | 2 to 5 years after exit | Storage limitation plus national HR guidance |
| Recruitment data, rejected candidates | 4 weeks to 12 months | Anti-discrimination claim windows and consent |
| Working time and leave records | 2 to 4 years | Working Time Directive as implemented nationally |
| Sick leave and occupational health data | Short for administration, long for exposure | Health and safety law, special-category data rules |
| Workplace accident records | 5 years to several decades | Occupational health and safety law |
| Pension and long-service records | Until well after retirement | Pension and social security law |
The categories that catch people out
Recruitment data for rejected candidates. This is the shortest and the most commonly ignored. Without consent, the window is short. Dutch guidance from the Autoriteit Persoonsgegevens points to about four weeks. With the candidate’s consent, up to a year is common so you can approach them for a future role. German employers often hold for around six months because of the claim window under the Allgemeines Gleichbehandlungsgesetz. If you keep a rejected applicant’s CV for years “just in case,” you are almost certainly over the line.
Sick leave and health data. This is special-category data under Article 9. HR should hold the minimum needed to administer absence and pay, not diagnoses. The administrative record is short-lived. Exposure and occupational health records are the exception and can carry very long retention because a health claim may surface decades later.
The personnel file is not one object. A single file mixes a payroll record you must keep for years with performance notes you should have deleted. Treating the file as one unit is how organizations both over-retain and under-retain at the same time. Split it by category, and give each category its own clock.
Retention and legal hold
A retention period sets when data may be deleted. A legal hold overrides it. Between those scheduled dates, the right to erasure can also force an earlier deletion on request. If a document is relevant to litigation, a regulatory investigation, or a dispute, you must suspend its deletion until the matter closes, even if its normal retention period has expired. Deleting data that is under a duty to preserve is spoliation, and it is treated far more seriously than keeping data slightly too long. A working retention schedule always has a hold mechanism that can freeze the clock. See WORM storage and legal hold for how this is enforced at the storage layer.
Building a retention schedule that holds up
A schedule that survives an audit has four properties:
- Category, not file. Every retention rule attaches to a category of data, not to a folder or a person.
- A named legal basis. Each period cites the law or purpose that sets it, so you can defend it.
- An automatic clock. Deletion is triggered by the schedule, not by someone remembering. Storage limitation fails most often through inaction, not decision.
- A hold that overrides. The schedule can be suspended for specific records under a legal hold, and resumed when the hold lifts.
The general EU document retention picture, across invoices, contracts, and compliance records, is covered in EU document retention periods. This article narrows it to the HR file.
How SealDoc handles retention for HR files
SealDoc gives each document a retention category when it is created: 1, 7 or 10 years, or permanent. That category is recorded in the document’s hash-chained audit trail, next to a SHA-256 hash of the document, so the retention decision for a file is itself tamper-evident and auditable.
That matters because storage limitation is an accountability obligation, not just an operational one. When a regulator asks why a record still exists, or why it was deleted, the answer is a dated record of the decision rather than a best guess. SealDoc’s API refuses to erase a document within its retention period, and once the period allows it, an erasure on request is recorded in the same audit trail. That record is the groundwork for defensible deletion.
All of it runs on EU infrastructure with no US hyperscaler in the path, which keeps the retention record from becoming a cross-border transfer question of its own.