A woman using her phone at a desk, surrounded by art supplies and a laptop, in a creative workspace.

Data Retention for Ex-Employees: A Hidden Risk

Are you keeping leavers’ data too long? Learn what the law says and how to reduce legal exposure. Many organisations store former employee data indefinitely — just in case. But UK GDPR doesn’t allow for “just in case” retention. Key retention timelines to know: After this period, data should be deleted or anonymised. Keeping more…

30 May 202525 July 2026 Last Updated25 July 2026

Are you keeping leavers’ data too long? Learn what the law says and how to reduce legal exposure.

Many organisations store former employee data indefinitely — just in case. But UK GDPR doesn’t allow for “just in case” retention.

Key retention timelines to know:

Personnel files: typically 6 years for legal claims
References and disciplinary records: 6 years max unless legally challenged

After this period, data should be deleted or anonymised. Keeping more than you need increases liability and invites enforcement action.

Tip: Create a leavers’ checklist that triggers data review and deletion automatically.

Dr Floyd Millen

Floyd Millen is the founder of PrivacyIQ, bringing over a decade's experience in data protection and privacy risk from senior roles at organisations including the BBC, HMRC, BNP Paribas, and Post Office Ltd. He helps businesses of every size turn compliance into a genuine strategic asset.

Data Retention | Subject Access Request (DSAR) | Subject Access Request (SAR)

Retention and Subject Access Requests: What You Don’t Keep Can’t Hurt You
6 June 202525 July 2026

Subject access requests are easier (and cheaper) if you delete what you no longer need. Here’s why that’s strategic. Subject access requests (SARs) are rising — and they are expensive. But here’s the secret: the less data you hold, the less you have to search, redact, and disclose. Retention policies don’t just reduce legal risk….
Data Retention | Response Planning

Data Minimisation and Retention Go Hand in Hand
31 May 202525 July 2026

Minimising data doesn’t stop at collection — it includes timely deletion. Here’s how to tie the two together. Most teams know the data minimisation principle — collect only what you need. But it doesn’t stop there. Minimisation + Retention = Risk Reduction Retaining unnecessary data negates the benefit of collecting less in the first place….
Data Retention | Data Subject Rights | Right to be Forgotten | Right to Erasure

The Right to Erasure (Right to Be Forgotten)
30 June 202525 July 2026

The GDPR gives individuals the right to be forgotten in certain cases. Understand what this means for your company.
Data Retention | Prevention & Detection

Annual Retention Reviews: A Quick Win for Compliance
3 June 202525 July 2026

A yearly review of your retention practices helps avoid silent failures. Here’s how to do one well. Retention rules are only as good as their enforcement. An annual review ensures your policies are followed — and still relevant. What to include in your yearly audit: Make it light-touch but regular. Small course corrections now prevent…
Breach | Data Retention | Prevention & Detection

Breach Risk Increases With Ageing Data
1 June 202525 July 2026

The older the data, the more dangerous it becomes. Here’s why ageing data is a hidden security risk. Most cyber breaches don’t happen with fresh data — they happen with old, forgotten, poorly protected files. Why? Retention = risk control. Regularly deleting old personal data significantly reduces the impact of a breach — both legally…
Breach | Prevention & Detection

Top 5 Causes of Data Breaches in Professional Services
5 June 202525 July 2026

Knowing where breaches start is half the battle. These five causes account for most incidents in professional firms. Most data breaches stem from everyday errors — not hackers. In professional services, the top five causes include: All of these can be reduced with training, tech, and clear policy enforcement.

Are you keeping leavers’ data too long? Learn what the law says and how to reduce legal exposure.

Related