Retention of personnel data: how long may an employer keep it?

There is no single retention period for personnel data. Under the GDPR you may keep data only as long as you need them for the purpose you collected them for; Dutch tax law then sets fixed minimum periods for payroll records, the wage tax statement and the copy of the employee’s identity document.

In practice this gives Dutch employers three anchors: two years after the employment ends for most of the personnel file, five years after the end of the calendar year in which the employee left for the wage tax statement and the ID copy, and seven years for the payroll administration. Our article on what may be kept in a personnel file deals with the content; this one deals with how long.

What is the basic rule under the GDPR?

Keep personal data no longer than necessary. Article 5(1)(e) GDPR (storage limitation) requires you to decide, per category of data, how long you actually need them and to be able to explain that choice.

The GDPR itself contains no table of periods. The periods below come from Dutch tax law and from the guidance of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP).

Which data do you keep for two years?

Most of the personnel file. The AP’s guidance is that data without a statutory retention period are generally kept for two years after the employee has left.

This covers, for example, the employment contract and its amendments, appraisals and performance reports, correspondence about appointment, promotion, demotion and dismissal, training records, warnings, references and absence records.

If there is or has been an employment dispute with the employee, or a court case is pending, you may keep the data relevant to it for longer, until the matter is resolved. That justifies keeping the relevant material, not the whole file indefinitely.

Which data do you keep for five or seven years?

The fiscal records. Here you have no discretion: the tax obligation sets the period and overrides the general principle of keeping data as briefly as possible.

• The wage tax statement (loonbelastingverklaring) and the copy of the identity document you verified when the employee started: five years after the end of the calendar year in which the employment ended.
• The payroll administration (loonadministratie): seven years, the general fiscal retention period for basic records set by the Dutch Tax and Customs Administration (Belastingdienst).

Only the records that the tax obligation covers fall under these longer periods. The rest of the file still follows the two-year rule.

How long may you keep data of applicants?

Normally up to four weeks after the end of the application procedure. With the candidate’s consent you may keep the data for up to one year, for instance for a talent pool.

Consent must be a real choice, asked for separately and recorded. A line in your privacy statement is not enough.

What about sickness and medical data?

Health data belong with the company doctor (bedrijfsarts) or occupational health service, not with you as the employer. They are subject to medical confidentiality and their own retention rules.

As employer you keep only absence dates and the information you need for reintegration and wage payment during illness. Those data follow the ordinary periods for the personnel file.

What should you check as an employer?

• Does your record of processing activities (Article 30 GDPR) set a retention period per category of personnel data?
• Do you delete applicant data within four weeks after the procedure, unless you have recorded consent for up to one year?
• Are health data kept only by the company doctor, with you holding only absence dates?
• Do you keep the ID copy and wage tax statement for five years after the calendar year of leaving, and the payroll records for seven years?
• Are copies in mailboxes, shared drives and backups deleted as well, and do you apply the schedule at a fixed moment each year?

What should you check as an employee?

• Have you used your right of access (Article 15 GDPR) to see which data your employer still holds?
• Is your former employer keeping data longer than two years after you left without a dispute or statutory reason?
• Does the file contain medical information that belongs with the company doctor?
• Have you requested erasure under Article 17 GDPR, and did the employer respond within one month?

What can we do for you with retention of personnel data?

Our employment lawyers advise employers and employees on personnel data:

• We draw up a retention schedule per category of personnel data.
• We review your personnel files and identify data that must be deleted.
• We draft the procedure for access and erasure requests from (former) employees.
• We assess which data you may keep longer because of a pending or foreseeable dispute.
• We submit an access or erasure request on behalf of an employee.

Summary

• The GDPR sets no fixed periods: keep data only as long as necessary for their purpose.
• Most of the personnel file: two years after the employment ends, longer only for data relevant to a dispute.
• Wage tax statement and ID copy: five years after the end of the calendar year in which the employment ended; payroll administration: seven years.
• Applicants: up to four weeks after the procedure, or up to one year with recorded consent.
• Health data stay with the company doctor; you keep only absence dates and what you need for reintegration and wage payment.

Frequently asked questions