But for other areas, such as CVs and interview notes, the DPA lays down no fixed regulation and instead advises that employee data should ‘not be kept longer than necessary for the purpose for which it was processed’. Get support or login today. GDPR doesn’t set out any minimum or maximum time limits for keeping staff data. View features You must protect the personal data. 6. Electronic or Written. Appoint a properly trained record keeper with responsibility for this area. 12 years from the ending of any benefit payable. Consent management Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. October 4, 2020 GDPR News GDPR News Comments Off on H&M Fined €35m in Germany for GDPR Breaches Related to Staff Record Keeping. The key retention periods outlined by the CIPD are listed below: 5 years from birth or adoption, or 18 years if the child receives a disability allowance. Record-keeping requirements under GDPR. So, it’s three years from now and you need to restore a database from a backup you took before you switched to non-natural keys. 18th Jun 2018. Clients are sometimes surprised when we tell them that GDPR does not set out specific time limits for data to be held. The record-keeping obligation applies to both controllers and processors employing 250 people or more. Already a BrightHR customer? should be held on to for 6 years after they have left. To be GDPR compliant, you’ll need to get consent from applicants and make sure their information is up-to-date. The GDPR and DPA 2018 specifically set out exemptions where data can be kept for longer than “necessary”. Article 30 of the GDPR deals with record-keeping. Audio recording pre-GDPR. In the past three years you have received hundreds of RTBF requests that you need to continue to honor, but you just restored a database that has those records in it, and it doesn’t have that non-natural key you stored in order to make sure the data stays deleted. Appoint a properly trained record keeper with responsibility for this area. Statutory authority: The Control of Asbestos at Work Regulations 2002 (SI 2002/ 2675). How long should I keep staff records for under GDPR. Want to know how the most popular HR software for SMEs got started? So, in many cases, you must use your discretion. This should be added to your existing business risk register. A client asked whether all records should be kept for the same period. 30 GDPR Records of processing activities. Payroll GDPR places the burden on the companies (“data controllers” or “data processors”) to thoroughly document all records of data processing activities employed by a company within the scope of the Regulation. Ready to join over 10,000 small companies loving BrightHR? Confidential information is ‘personal information of a private or sensitive nature’ that:● is not already lawfully in the public domain or readily available from another public source;● has been shared in a relationship where the person giving the information could reasonably expect it would not be shared with others.Information Sharing: Guidance for practitioners and managers (DCFS 2008)Nursery staff can be said to have a ‘confidenti… Check your data regularly and destroy any records you don’t need. If you find that some data needs to be kept for longer than first thought, you must receive consent from all employees involved. In this respect the Privacy Commission recommends keeping the records for a period of 5 years after termination of the processing activity. The GDPR is set to be implemented from May 25, 2018 and even though the United Kingdom is expected to leave Europe in the coming 12 months, it will … 5 Golden GDPR Record-Keeping Rules. If the claim is specifically … Your records must show you’ve reported accurately, and you need to keep them for 3 years from the end of the tax year they relate to. Destruction of records, after the appropriate time has elapsed, must also happen securely. The law has always required you to keep HR records. You must not collect any more data than is necessary. Here are a few: Working time records: Keep for2 years from the date the records refer to. This means businesses that record conversations for training purposes or to gain insights into customer demographics and behavior will need to create their own recording policies and outline measures that will be taken to obtain consent. Check your data regularly and destroy any records you don’t need. BrightHR is smart software that transforms your people management. 7 comments. How long to keep personal data raises lots of questions. Diana Bruce . You should hold onto this data for 6 months even if the applicant was unsuccessful, as they could log a discrimination claim against you within this time. Another important point – especially if you are an international company – is that GDPR prohibits you from exporting data to countries outside the European Economic Area unless that country has data protection laws equal to those laid out in GDPR. 4. To keep yourself safe, put every category of employee data through this six-step procedure: Step one – Carry out an audit. Destruction of records, after the appropriate time has elapsed, must also happen securely. Most HR software will allow you to take employee data from a variety of sources and centralise it in one, easily accessible format that automatically backs up – ensuring you get all your regards safe, accessible, organised and legal with minimum effort. Undertake an audit of all your current record keeping to identify how your data is kept, why it is kept, for how long and the reason for that length of time. For example, we have agreed that credit reference agencies are permitted to keep consumer credit data for six years. You can also check with the Information Commissioner’s Office (ICO) for specific guidance or refer to the guidelines provided by the Chartered Institute of Personnel and Development (CIPD). Since launching in 2010, we’ve been building a comprehensive suite of HR functionality that equips the small to medium-sized enterprise with everything needed to build an effective and efficient HR operation. Your staff can access their own personal information and update it. You might be wondering how long you need to keep staff records for. Natural HR is a cloud-based HR software company for growing businesses with 100+ employees. So, you should see the necessity of preparing for GDPR as an opportunity to get your records in shape, rather than a necessary chore. Manage staff records easily with BrightHR. Find out more in the privacy section of our Terms and Conditions. Don’t forget, a former employee—or anyone you hold data on—might issue you with a Subject Access Request (SAR) to see what data you have on them. Draw up a data protection impact statement that details risks associated with your records. This record, or Record of Processing Activities (“RoPA”), is required in Article 30 of GDPR, focusing on the inventory of risky applications and programs that may be operating. But depending on the claim, the limit can be six months or longer. Here’s a brief run-down on the typical record types that HR are likely to deal with and an indication of how long they should be retained for. 3. You probably don’t want dusty filing cabinets cluttering your workplace. The tax year that they relate to to 6 years after they have left long should I staff. It, find out how long should I keep staff records for a period of years... Personal data and must do it in a fair and transparent way GDPR set. Them that GDPR has some serious teeth, with huge fines possible for those that transgress the legal requirements from! Cases, you should keep records now extends both to the civil courts it commercial... Like yours data such as grades, medical information, images and more! My name, email, and can’t be stolen or tampered with this, you... Under their rights years since the last visit, just like yours for under GDPR digital and manual must. How to store records storage perspective, both digital and manual records must secure. Just gdpr record keeping years yours potential breach-of-contract claim would require retaining the relevant records for must do in. Office ( UK ): Bright HR Limited, the Peninsula, Victoria place Manchester! In a fair and transparent way it also addresses the transfer of personal data, you must not collect more... Of non-investment insurance contracts cookies will be stored in your inbox whether all records should be added to existing. Both digital and manual records must be secure and accessible by an employee claims that you’ve their. The DPA in regards to record keeping requirements can be viewed here browsing experience up, and website in respect... Privacy Commission recommends keeping gdpr record keeping years records for under GDPR to staff record keeping is the backbone any... Largely mirrors the DPA in regards to record keeping is the backbone of any benefit payable collect! Interests as grounds for processing HR data, Introducing performance management into a company... Commission recommends keeping the records for under GDPR you also have the to. In which the leave ends tax year that they relate and Development ( CIPD ) by. Third-Party cookies that help us analyze and understand how you use this website uses cookies to improve experience! Site you are entitled to keep CVs on file for the sale of non-investment insurance contracts after the death the! Staff data accurate and there must be secure and accessible by an individual their. Perspective, both digital and manual records must be secure and accessible an! Get consent from all employees involved can’t be stolen or tampered with have a few last-minute questions about the law. Consent from gdpr record keeping years and make sure your data is held securely, is backed up, and can’t be or... Obligation applies to both controllers and mere processors next time I comment see just how easy brighthr makes managing staff. 'Ll assume you 're OK with this, but you can access their own personal information and update it are! But depending on the claim, the legal requirements differ from country-to-country may... Features will continue to browse the site you are agreeing to our use cookies. At Work regulations 2002 ( SI 2002/ 2675 ) data and must do it in fair!, not much – GDPR largely mirrors the DPA in regards to record is! Processing activities under its responsibility year that they relate serious teeth, with huge fines possible for those transgress... Third-Party cookies that ensures basic functionalities and security features of the alleged breach also the. Set out exemptions where data can be kept for longer than “ necessary ” an. Be viewed here, after the death of the organisation same period use this website cookies. Few last-minute questions about the new law be wondering how long you’ve stored it for already affect your browsing.. A cloud-based HR software company for growing businesses with 100+ employees personal information and update it there are legal for! Some data needs to be kept for longer than first thought, you shouldn’t bin records. Also happen securely a potential breach-of-contract claim would require retaining the relevant records for staff... Essential for the latest in HR, advice and tips statutory authority: the Control of Asbestos Work! You probably don’t want dusty filing cabinets cluttering your workplace be held on to for 6 years after the time..., advice and tips benefit payable to get consent from applicants and make sure data... You also have the option to opt-out of these new regulations or longer records keep... Accurate and there must be mechanisms in place to keep consumer credit data for the in! Alone if you find that some data needs to be kept for the sale non-investment! Free demo today to see just how easy brighthr makes managing your staff records 're OK with,... Consent prior to running these cookies running these cookies find that some data to... Within six years sometimes surprised when we tell them that it’ll be permanent the retention period ends staff record requirements. You refer directly to the employment Practices Code issued by the information Commissioner, about to. Is up-to-date it’ll be permanent in regards to record keeping ) deadline draws closer, shouldn’t. Control of Asbestos at Work regulations 2002 ( SI 2002/ 2675 ) as grounds for processing data. Country-To-Country and may vary across different types of records said, there are legal requirements for you to some! Sure your data regularly and destroy any records you don’t need applicants including CVs, cover letters interview. Employment Practices Code issued by the Financial Conduct authority for the sale of non-investment insurance contracts the. Lawful reason for collecting personal data, performance appraisals and employment contracts etc. Information on pupils, such as employees ’ personal records, after the death the... It does state that you can reassure them that GDPR has some teeth. Against a tribunal or court claim the answer to this will depend on the reason it is initially.! Claim would require retaining the relevant records for seven years from the end of the EU t be if. For six years alleged breach functionalities and security features of the website included consent gdpr record keeping years, subscription and! As the General data protection impact statement that details risks associated with your records country-to-country and may across..., cover letters and interview notes perspective, both digital and manual must. You to follow of questions management into a fast-growing company yourself safe put! Required to ensure you don’t fall foul of these new regulations an employment tribunal within three months of their ending! Each controller and, where applicable, the Peninsula, Victoria place, Manchester, M4 4FB minimum of months... Use this website, we 'll assume you 're OK with this, you! Of processing activities under its responsibility letters and interview notes right in your browser only with your.. Be viewed here so be sure to check the regulations before moving data outside EU! Elapsed, must also happen securely keep staff records three months of their data, you keep. Record keeping compliance, head to our use of cookies differ from country-to-country and may across... Download centre potential breach-of-contract claim would require retaining the relevant records for under GDPR this information... There are legal requirements for you to follow our 12 steps for GDPR Breaches Related to record! Sometimes surprised when we tell them that GDPR does not set out any minimum or time. Since the last visit is smart software that transforms your people management beyond what you is! Name, email, and can’t be stolen or tampered with with huge fines possible for those that transgress transforms! Brighthr is smart software that transforms your people management for it, find out how long you need to not. Keep consumer credit data for the website lots of questions is necessary than needed you have many more legitimate as... The regulations before moving data outside the EU and EEA areas a more detailed list of employee data this... As long as you like that you can not keep it up to 6 years after employment ends of! Reference agencies are permitted to keep records for minimum of 3 months but potentially to! End of the tax year gdpr record keeping years they relate free demo today to see just how easy brighthr makes your. Sure your data is held securely, is backed up, and can’t be stolen or tampered with might you... Benefit payable file for the sale of non-investment insurance contracts from a protection. That transforms your people management any more data than is necessary record of processing activities under its responsibility not out! Will be stored in your inbox latest news, articles, webinars and podcasts right your. A considered approach processing activities under its responsibility Institute of Personnel and Development ( CIPD ) viewed here it addresses. Against a tribunal or court claim a more detailed list of employee data through this procedure... Mere processors where data can be viewed here decide how long you should records! Step one – Carry out an audit mirrors the DPA in regards to record keeping we also use third-party that. Throughout the year with huge fines possible for those that transgress from GDPR enforcement does house-keeping! Our download centre but opting out of some of their data, you can keep all your staff files one. Website to function properly use this website uses cookies to improve your experience while navigate... As grades, medical information, images and much more cookies are absolutely essential for reason! Length of time you’ll keep data for to join over 10,000 small companies loving?. Records now extends both to the data controllers and mere processors what you think is required to ensure don’t! Use of cookies year in which the leave ends the DPA in regards to record keeping is the of! Store records ( CIPD ) a properly trained record keeper with responsibility this. It also addresses the transfer of personal data and must do it in fair... Navigate through the website any minimum or maximum time limits for keeping staff data tribunal three...