Holding employee data
Keeping personal and immigration records lawfully under UK GDPR.
Updated June 2026 · general information, not legal advice
Principles
- Employee records — including NI numbers, addresses and immigration evidence — are personal data. Hold only what you need, keep it accurate, secure it, and don't keep it longer than necessary.
- Right-to-work evidence has its own retention rule: employment plus two years. Other records should follow your documented retention schedule.
In Tenavo
- Records are isolated per organisation by row-level security, and documents are kept in private storage that only your organisation can read.
- Restrict who in your team can see sensitive records, and remove access when people leave.
Official sources
Stay on top of this with Tenavo
Keep employee records, contracts, holidays, sickness and conduct in one place, with renewal dates tracked so nothing slips through.