What HR Records Should a Small Business Keep, and for How Long?

## The short answer

A small business should keep HR records covering recruitment, the employment relationship, pay and time, performance, and exit - stored securely, kept up to date, and retained for as long as there's a legitimate reason to hold them and no longer. The most important categories are employment contracts and right-to-work documentation, payroll and tax records, working-time and holiday records, and records of any formal HR processes. Getting record-keeping right protects you in disputes, audits and tribunals, and protects your employees' privacy at the same time.

Poor record-keeping is a quiet risk that only becomes visible at the worst possible moment - when you need a document to defend a decision and can't find it, or when you're holding sensitive data you should have deleted. A disciplined approach removes both problems.

## What to keep

Think in terms of the employee lifecycle:

**Recruitment and onboarding**

- Right-to-work documentation (this is non-negotiable).

- Signed employment contract and any variations.

- Job description and offer details.

- Pre-employment checks where relevant.

**During employment**

- Personal and emergency contact details.

- Pay, deductions and benefits records.

- Working hours, overtime and holiday entitlement and usage.

- Absence and sickness records.

- Training and qualifications.

- Performance reviews and objectives.

- Records of any disciplinary, grievance or other formal processes.

**On leaving**

- Resignation or termination documentation.

- Final pay and settlement details.

- Reason for leaving and any exit feedback.

## How long to keep records

Retention isn't "keep everything forever" - in fact, holding personal data longer than you need to is itself a problem. The guiding principles are:

- **Keep records only as long as you have a legitimate reason.** That reason might be a legal requirement, a limitation period during which a claim could be brought, or an ongoing business need.

- **Different records have different retention periods.** Payroll and tax records typically need to be kept for a number of years to satisfy tax authorities. Records relating to certain risks or entitlements may need longer. Other records should be deleted relatively soon after they're no longer needed.

- **Have a documented retention schedule** that says, for each type of record, how long you keep it and when you delete it - and actually follow it.

Because specific minimum and maximum periods vary by record type and jurisdiction and change over time, confirm the current requirements for your location rather than relying on rules of thumb.

## The data protection dimension

HR records are some of the most sensitive data a business holds - bank details, home addresses, health information, performance and disciplinary matters. That brings clear obligations:

- **Collect only what you need** for a clear purpose.

- **Store it securely**, with access limited to those who genuinely need it.

- **Be transparent** with employees about what you hold and why.

- **Honour data rights** - employees can ask what you hold about them.

- **Delete data** when its retention period ends.

A breach of employee data isn't just embarrassing; it's a serious failure of duty. Security and access control aren't optional extras.

## The problem with spreadsheets and folders

Many small businesses keep HR records in a patchwork of spreadsheets, email attachments and shared folders. This causes predictable problems:

- **No single source of truth**, so records contradict each other.

- **Weak access control**, so sensitive data is too widely visible.

- **No retention discipline**, so old data lingers indefinitely.

- **Hard to find anything** when you actually need it.

- **No audit trail** of who changed what and when.

As you grow past a handful of people, this becomes unsustainable and genuinely risky.

## Doing it properly without a big team

The answer is a single, secure system of record - one place where every employee's records live, with appropriate access controls, an audit trail, and the ability to enforce retention rules. This is how larger organisations manage HR data as standard, and it's exactly what neart.ai builds enterprise-grade HR products to provide for small and growing businesses: the security, structure and control of a big HR department, sized and priced for a smaller team.

## A simple action plan

1. **Audit what you currently hold** and where it lives.

2. **Consolidate** into a single secure system.

3. **Restrict access** to those who need it.

4. **Write a retention schedule** mapping each record type to a keep-and-delete period.

5. **Be transparent** with staff about what you hold and why.

6. **Review annually**, deleting what's past its retention and confirming requirements are current.

## Practical takeaway

Good HR record-keeping is a quiet form of risk management. Keep the records that cover the full employee lifecycle, store them securely with controlled access, and - just as importantly - delete them when you no longer have a legitimate reason to hold them. Replace the spreadsheet patchwork with a single secure system of record, write a retention schedule you actually follow, and confirm the specific periods for your location. Do this, and you'll be ready for the audit, the dispute or the data request that you hope never comes - and protect your people's privacy in the meantime.