How long to keep employee records in the EU: HR data retention periods
There is no single EU retention period for HR records. Each category is driven by a different law, and the two failure modes point in opposite directions: keep data too long and you breach the storage limitation principle, delete it too early and you breach a tax or labor obligation.
This is a working reference for the most common HR categories, the typical retention range, and the rule that sets it. Treat the numbers as orientation. The exact period is fixed by national law, and it changes between member states.
Why retention is a two-sided obligation
Retention is a two-sided obligation: a floor set by tax and labor law, and a ceiling set by the GDPR. Most people only see the floor, which says keep records at least this long. The ceiling is the part that gets missed.
Article 5(1)(e) is the storage limitation principle. Personal data must be kept in a form that permits identification for no longer than necessary. A personnel file you held onto for a decade after someone left, with no legal reason to keep it, is a breach even if nobody ever looked at it. So a retention schedule is not just about surviving a tax audit. It is about deleting on time, every time, and being able to show you did.
HR retention periods at a glance
The table below gives typical EU ranges. National law overrides them in both directions.
| HR record category | Typical retention | What drives it |
|---|---|---|
| Payroll and wage tax records | 5 to 10 years | National tax law (for example the Dutch Belastingdienst at 7 years, German records under the Abgabenordnung and GoBD) |
| Employment contracts and amendments | Duration plus 2 to 7 years | Limitation periods for labor and contract claims |
| General personnel file (non-tax parts) | 2 to 5 years after exit | Storage limitation plus national HR guidance |
| Recruitment data, rejected candidates | 4 weeks to 12 months | Anti-discrimination claim windows and consent |
| Working time and leave records | 2 to 4 years | Working Time Directive as implemented nationally |
| Sick leave and occupational health data | Short for administration, long for exposure | Health and safety law, special-category data rules |
| Workplace accident records | 5 years to several decades | Occupational health and safety law |
| Pension and long-service records | Until well after retirement | Pension and social security law |
The categories that catch people out
Recruitment data for rejected candidates. This is the shortest and the most commonly ignored. Without consent, the window is short. Dutch guidance from the Autoriteit Persoonsgegevens points to about four weeks. With the candidate’s consent, up to a year is common so you can approach them for a future role. German employers often hold for around six months because of the claim window under the Allgemeines Gleichbehandlungsgesetz. If you keep a rejected applicant’s CV for years “just in case,” you are almost certainly over the line.
Sick leave and health data. This is special-category data under Article 9. HR should hold the minimum needed to administer absence and pay, not diagnoses. The administrative record is short-lived. Exposure and occupational health records are the exception and can carry very long retention because a health claim may surface decades later.
The personnel file is not one object. A single file mixes a payroll record you must keep for years with performance notes you should have deleted. Treating the file as one unit is how organizations both over-retain and under-retain at the same time. Split it by category, and give each category its own clock.
Retention and legal hold
A retention period sets when data may be deleted. A legal hold overrides it. Between those scheduled dates, the right to erasure can also force an earlier deletion on request. If a document is relevant to litigation, a regulatory investigation, or a dispute, you must suspend its deletion until the matter closes, even if its normal retention period has expired. Deleting data that is under a duty to preserve is spoliation, and it is treated far more seriously than keeping data slightly too long. A working retention schedule always has a hold mechanism that can freeze the clock. See WORM storage and legal hold for how this is enforced at the storage layer.
Building a retention schedule that holds up
A schedule that survives an audit has four properties:
- Category, not file. Every retention rule attaches to a category of data, not to a folder or a person.
- A named legal basis. Each period cites the law or purpose that sets it, so you can defend it.
- An automatic clock. Deletion is triggered by the schedule, not by someone remembering. Storage limitation fails most often through inaction, not decision.
- A hold that overrides. The schedule can be suspended for specific records under a legal hold, and resumed when the hold lifts.
The general EU document retention picture, across invoices, contracts, and compliance records, is covered in EU document retention periods. This article narrows it to the HR file.
How SealDoc handles retention for HR files
SealDoc attaches a retention state to each protected file and records every change to that state as timestamped, tamper-evident evidence. Assigning a retention period, releasing it when the clock runs out, and placing or lifting a legal hold are each written to an append-only audit trail with an RFC 3161 timestamp, so the history of a file’s retention is itself auditable.
That matters because storage limitation is an accountability obligation, not just an operational one. When a regulator asks why a record still exists, or why it was deleted, the answer is a dated record of the decision rather than a best guess. When a file reaches the end of its retention and is cleared for destruction, SealDoc produces an evidence pack and a certificate artifact that document the timeline honestly, including the assurance behind each step. That is the mechanism behind defensible deletion: destruction that carries its own proof.
All of it runs on EU infrastructure with no US hyperscaler in the path, which keeps the retention record from becoming a cross-border transfer question of its own.