There is no single retention period for personnel data. Under the GDPR you may keep data only as long as you need them for the purpose you collected them for; Dutch tax law then sets fixed minimum periods for payroll records, the wage tax statement and the copy of the employee’s identity document.
In practice this gives Dutch employers three anchors: two years after the employment ends for most of the personnel file, five years for the wage tax statement and the ID copy, and seven years for the payroll administration. Our article on what may be kept in a personnel file deals with the content; this one deals with how long.
What is the basic rule under the GDPR?
Keep personal data no longer than necessary. Article 5(1)(e) GDPR (storage limitation) requires you to decide, per category of data, how long you actually need them and to be able to explain that choice.
The GDPR itself contains no table of periods. The periods below come from Dutch tax law and from the guidance of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP).
Which data do you keep for two years?
Most of the personnel file. The AP’s guidance is that data without a statutory retention period are generally kept for two years after the employee has left.
This covers, for example, the employment contract and its amendments, appraisals and performance reports, correspondence about appointment, promotion, demotion and dismissal, training records, warnings, references and absence records.
If there is or has been an employment dispute with the employee, or a court case is pending, you may keep the data relevant to it for longer, until the matter is resolved. That justifies keeping the relevant material, not the whole file indefinitely.
Which data do you keep for five or seven years?
The fiscal records. Here you have no discretion: the tax obligation sets the period and overrides the general principle of keeping data as briefly as possible.
- The wage tax statement (loonbelastingverklaring) and the copy of the identity document you verified when the employee started: five years after the end of the employment.
- The payroll administration (loonadministratie): seven years, the general fiscal retention period for basic records set by the Dutch Tax and Customs Administration (Belastingdienst).
Only the records that the tax obligation covers fall under these longer periods. The rest of the file still follows the two-year rule.
How long may you keep data of applicants?
Normally up to four weeks after the end of the application procedure. With the candidate’s consent you may keep the data for up to one year, for instance for a talent pool.
Consent must be a real choice, asked for separately and recorded. A line in your privacy statement is not enough.
What about sickness and medical data?
Health data belong with the company doctor (bedrijfsarts) or occupational health service, not with you as the employer. They are subject to medical confidentiality and their own retention rules.
As employer you keep only absence dates and the information you need for reintegration and wage payment during illness. Those data follow the ordinary periods for the personnel file.
How do you make retention work in practice?
Three things turn the rules into compliance.
- A retention schedule that sets the period per category, recorded in your record of processing activities (Article 30 GDPR).
- A fixed moment each year at which you actually apply the schedule. Retention policies usually fail through inaction, not through disagreement.
- Real deletion. Removing a file from the HR system while copies remain in mailboxes, shared drives and backups is not deletion, and an access request by the employee will quickly expose it.
In summary
- The GDPR sets no fixed periods: keep data only as long as necessary for their purpose.
- Most of the personnel file: two years after the employment ends, longer only for data relevant to a dispute.
- Wage tax statement and ID copy: five years after the employment ends; payroll administration: seven years.
- Applicants: up to four weeks after the procedure, or up to one year with recorded consent.
- Health data stay with the company doctor; you keep only absence dates and what you need for reintegration and wage payment.
Frequently asked questions
Can an employee demand that data be deleted?
Sometimes. The right to erasure in Article 17 GDPR applies where the data are no longer necessary or were processed unlawfully. It does not override a statutory retention obligation, such as the fiscal one.
May we keep a file longer in case of a future claim?
Only where a claim is realistically foreseeable, and then only the material relevant to it. A general possibility of some future dispute does not justify keeping everything.
What about references and exit documents?
They fall within the general two-year category. Keeping the settlement agreement (vaststellingsovereenkomst) for the fiscal period is defensible where it has payroll consequences, such as a severance payment.
Unsure where you stand? Tell us about your situation. We will let you know your options within one working day.
How Law & More can help you with this is explained on our employment lawyer page.
