Introduction

HR Data includes a wide range of information relating to individuals working within the organisation. This for example includes pay or absence levels, hours worked and recruitment documents.  This includes both electronic and paper stored records too. Types of data are outlined in the organisation’s Data Protection Policy.
A vital part of the Cielo Costa Data Protection Policy and practice, and in line with the General Data Protection Regulation (GDPR), is that personal data is retained for the appropriate period and no longer than necessary. The Data Protection Policy states that it is Cielo Costa’s policy to:  

  • Retain all data only for as long as specified in this Data Retention Policy and, in general, no longer than necessary.   

This document is a summary of the Data we collect, and the periods we intend to hold this data for, as well as the reasoning for the chosen retention periods. 

Data Disposal

Disposal of paper copies is to be made via secure disposal/destruction. Electronically Stored Data must be deleted off the file and deleted from any ‘trash’ folder.

Data Retention

Section (category of data)

Records Held (types of data)

Retention Timescales (how long do we keep the data?)

Action following retention (what happens following retention period?)

Action complies with (why do we keep the data for this period?)

Recruitment

Data for unsuccessful candidates including but not exhaustive to CVs, Application forms and information, LinkedIn messages, email communication during the recruitment process, candidate spreadsheets including scoring matrix, interview confirmation, interview notes, psychometric testing and profiles, interview tools, online assessments, proof of right to work documents, records of qualifications, reference information, unsuccessful letters,

application forms and documentation

3 months from when the role is appointed, or the search is stopped.

 

If CV has been received unsolicited, 6 months from receiving.

 

Destruction

Ensures we can provide feedback to candidates, deal with any legal challenges and keep a second choice candidate as appropriate.

Proof of right to work

For the period of employment and two years post-employment.

Destruction

Immigration, Asylum and Nationality Act 2006 s.21 and Immigration (Restrictions on Employment) Order 2007 (SI 2007/3290), art.6.

Qualification records

For the period of employment and removed at the end of the employment period.

Destruction

Required to ensure a record of competence / qualification for period of employment.

Unsuccessful application data including references

6 months from when the role is appointed, or the search is stopped.

 

If CV has been received unsolicited, 6 months from receiving.

 

Destruction

To provide any feedback as required to candidates and deal with any request for reference information.

References for successful candidates

6 months from when the role is appointed, or the search is stopped.

 

Destruction

To provide any feedback as required.

Onboarding

Offer letters

For the period of employment and 6 years after the date employment ceases

Destruction

Required to meet HMRC requirements.

Contract of employment

For the period of employment and 6 years after the date employment ceases

Destruction

Required to meet HMRC requirements.

Service Agreements

For the period of employment and 6 years after the date employment ceases

Destruction

Required to meet HMRC requirements.

Personal details form inclusive of: Name/address/DOB/gender/telephone no./email/next of kin & emergency contact details/ health information

For the period of employment and 6 years after the date employment ceases

Destruction

Required to meet HMRC requirements.

Benefit information including cycle to work/childcare/healthcare

For the period of employment and 6 years after the date employment ceases

Destruction

Required to meet HMRC requirements.

Pension scheme policies

12 years from the ending of any benefit payable under the policy

Destruction

Required to ensure documents are available for pension queries / and to meet requirements.

Payroll details: Bank details/ NI no/ P45

For the period of employment and 6 years after the date employment ceases

Destruction

Required to meet HMRC requirements.

During Employment

Absence and leave records containing special categories of personal data (including details of absence or leave taken, the reasons for absences, the type of leave, information about medical or health conditions, reasonable adjustments, records of absence management discussions, correspondence with employees and written warnings)

For the period of employment and 6 years after the date employment ceases

Destruction

Required to ensure data regarding payments made during and at the end of employment.  HMRC requirement

Return to work discussion forms (where self-certification forms are in place)

2 Years post last day of sickness absence. If no return to work form is retained – records must be kept for the period of employment and 6 years after the date employment ceases.

Destruction

Required to ensure data regarding payments made during and at the end of employment.  HMRC requirement

Appraisal documents, performance reviews and ratings, targets and objectives, performance improvement plans, records of performance improvement meetings and related correspondence, and warnings

For the period of employment and 6 years after the date employment ceases

Destruction

Required to ensure data regarding payments made during and at the end of employment.  HMRC requirement

Disciplinary and grievance records (including records of investigations, notes of disciplinary or grievance meetings and appeal hearings, correspondence with employees and written warnings)

12 months after the end of the disciplinary action or 12 months after the penalty

Destruction

Penalty held on file as per discipline policy

Settlement Agreements

For the period of employment and 6 years after the date employment ceases

Destruction

Required to meet HMRC requirements.

 

Statutory Sick Pay records including calculations, certificates, self-certificates

For the period of employment and 6 years after the date employment ceases

Destruction

Required to meet HMRC requirements.

 

Redundancy details including calculation of payments, refunds, notifications, redundancy scoring matrix

For the period of employment and 6 years after the date employment ceases

Destruction

Required to meet HMRC requirements.

 

Statutory Maternity Pay records, calculations, certificates (including MATB1) or any other medical evidence in relation including absences during pregnancy

3 years after the end of the tax year in which the maternity period ends

Destruction

The Statutory Maternity Pay (General) Regulations 1986 (SI/ 1986/ 1960) as amended

 

Statutory Paternity Pay records, statutory shared parental pay and statutory adoption pay

3 years after the end of the tax year in which payments of SPP, ShPP or SAP were made.

 

Statutory Paternity Pay and Statutory Adoption Pay (Administration) Regulations 2002 (SI 2002/2820), reg.9 and Statutory Shared Parental Pay (Administration) Regulations 2014 (SI 2014/2929), reg.9

 

Accidents at work and work-related illness

Minimum of 3 years from the date on which the record was made.

Destruction

 

Social Security (Claims and Payments) Regulations 1979 (SI 1979/628), reg.25.

 

Injuries, fatalities, diseases and dangerous occurrences

Minimum of 3 years from the date on which the record was made.

Destruction

Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (SI 2013/1471), reg.12.

 

Working time records

2 years from the date on which records were created

Destruction

The Working Time Regulations 1998 (SI 1998/ 1833)

 

Wages and deductions including Income Tax and NI returns, income tax records and correspondence with HMRC

Three years after the end of the income tax year to which the records relate.

Destruction

Income Tax (Pay As You Earn) Regulations 2003 (SI 2003/2682), reg.97.

 

Records of National Minimum Wage: Records sufficient to establish that every worker is being, or has been, remunerated at a rate at least equal to the national minimum wage.

3 years after the end of the pay reference period following the one that the records cover

Destruction

National Minimum Wage Regulations 2015 (SI 2015/621), reg.59

 

Employee pay, including bonuses and commission payments

For the period of employment and 6 years after the date employment ceases

Destruction

Required to meet HMRC requirements.

 

Retirement benefit schemes and information including records of notifiable events e.g. relating to incapacity

6 years from the end of the scheme year in which the event took place

Destruction

The Retirement Benefits Schemes (Information Powers) Regulations 1995 (SI 1995/ 3103)

Leavers/ Former Employees

Resignation letter/Resignation acceptance letter

For the period of employment and 6 years after the date employment ceases

Destruction

Required to meet HMRC requirements.

Processing of leavers in HR Systems

Sufficient data is retained for an indefinite period

 

To meet the requirements of references and details of former employees

Payroll documents including P45/final payslip

For the period of employment and 6 years after the date employment ceases

Destruction

Required to meet HMRC requirements.

Reference Information.  This will include dates of employment, role titles and periods, final salary, ex-employee address and date of birth

Indefinite Period. 

Archive

To maintain a record of previous employees and personal data is retained to ensure that the correct employee is identifiable.

Pension Records

Pension Contributions / deductions from salary.

12 years from the ending of any benefit payable under the policy

Archive / Destruction

Required to ensure documents are available for pension queries / and to meet requirements.