Holding employee data
Keeping personal and immigration records lawfully under UK GDPR.
Updated June 2026 · general information, not legal advice
Principles
- Employee records — including NI numbers, addresses and immigration evidence — are personal data. Hold only what you need, keep it accurate, secure it, and don't keep it longer than necessary.
- Right-to-work evidence has its own retention rule: employment plus two years. Other records should follow your documented retention schedule.
In Tenavo
- Records are isolated per organisation by row-level security, and documents are kept in private storage that only your organisation can read.
- Restrict who in your team can see sensitive records, and remove access when people leave.