If you are an employer in the UK, keeping payroll records is a legal requirement, not just good housekeeping. HMRC requires you to keep them for a minimum of three years from the end of the tax year they relate to.
Most accountants and payroll specialists, including us here at DH Business Support, would recommend retaining them for six years to give your business full protection.
This guide explains exactly which records you need to keep, for how long, how GDPR fits into the picture, and what can happen if records go missing.
What are Payroll Records?
Payroll records are any documents related to paying your employees and reporting to HMRC, and they sit at the heart of your compliance with Pay As You Earn (PAYE), tax reporting, and employment law.
Common payroll records include:
- Employee names, addresses, and National Insurance numbers
- Salary and wage records, including overtime and bonuses
- PAYE and National Insurance contribution records
- P45, P60, and P11D forms
- RTI (Real Time Information) submissions to HMRC
- Statutory payment records, including Statutory Sick Pay (SSP) and Statutory Maternity Pay (SMP)
- Pension contribution data
- Tax code notifications
- Timesheets and attendance logs
If you are ever audited by HMRC or face an employee dispute, these records are your first line of defence.
How Long Do You Have to Keep Payroll Records in the UK?
The legal minimum is three years from the end of the tax year the records relate to, as set by HMRC under PAYE record-keeping rules. This applies to all employers operating PAYE.
Most businesses should aim to keep payroll records for at least six years. The Limitation Act 1980 allows legal claims, such as unpaid wages or breach of contract, to be brought within six years of the event. If a former employee raises a claim and your records only go back three years, you could find yourself without the evidence you need to defend your business.
Keeping records for six years also brings you in line with HMRC’s own recommendations for most business records, giving you a much stronger position if your records are ever called into question.
Payroll Record Retention Periods at a Glance
| Record Type | Minimum Period | Recommended Period |
| PAYE and NIC records | 3 years from the end of the tax year | 6 years |
| P45, P60, and P11D forms | 3 years from the end of the tax year | 6 years |
| RTI submissions | 3 years from the end of the tax year | 6 years |
| Statutory payment records (SSP, SMP, SPP) | 3 years from the end of the tax year | 6 years |
| Former employee records | 6 years after leaving | 6 years |
| Pension contribution records | 6 years | 6 years |
| Working time records | 2 years from the date made | 2 years |
| Contractor and freelancer payment records | 6 years from the end of the last tax year | 6 years |
Please note: Always verify retention periods against current HMRC guidance, as requirements can change. If you are unsure what applies to your business, get in touch with our team, and we will be happy to help.
What Payroll Records Does HMRC Require You to Keep?
HMRC requires all employers running PAYE to maintain accurate, complete, and accessible records. These can be kept digitally or on paper, provided they are legible and well-organised.
Making Tax Digital (MTD) is now in place for VAT-registered businesses, and digital record-keeping is increasingly the standard. Digital records are easier to retrieve, harder to lose, and quicker to share if HMRC ever asks to see them.
The key records HMRC expects you to keep include:
- Full RTI submission history
- Details of all payments made to employees, including gross pay, deductions, and net pay
- Tax code and National Insurance records for every employee
- Records of statutory payments made and recovered
- P45s issued to leavers and P60s issued to current employees at year-end
- P11D records for expenses and benefits in kind
If you use a managed payroll service, your provider should be maintaining these records on your behalf as part of the service. It is always worth confirming this is the case.
Does GDPR Affect How Long You Keep Payroll Records?
The short answer is yes, but it does not override your HMRC obligations.
Payroll records contain personal data, which means UK GDPR and the Data Protection Act 2018 apply. Under GDPR, personal data should not be kept longer than necessary for the purpose it was collected. This can feel like it pulls in the opposite direction to HMRC’s retention requirements, but the two can sit alongside each other with the right approach.
The key is having a documented data retention policy that sets out clearly how long each type of record is kept and when it will be securely deleted. Where GDPR and HMRC requirements overlap, keep records for the longer of the two periods and make a note of why.
To stay on the right side of both, bear the following in mind:
- Payroll records must be stored securely, with access restricted to authorised personnel only
- Once a record has reached the end of its retention period, it should be securely deleted or destroyed
- Your retention policy should be reviewed at least once a year
- Employees have the right to access their own personal data, so your records need to be retrievable
What Happens If You Do Not Keep Payroll Records?
Failing to maintain adequate payroll records is a breach of HMRC regulations, and the consequences can be significant.
HMRC can impose penalties of up to £3,000 for inadequate or incomplete payroll documentation. On top of that, poor records can trigger a full PAYE compliance check, which is time-consuming and disruptive to your business.
The risks do not stop there. Inadequate records can also lead to:
- Difficulty resolving employee pay disputes without documentary evidence
- Exposure to backdated tax and National Insurance claims
- Being left without supporting evidence in an employment tribunal
- Reputational damage with employees and HMRC
Keeping accurate payroll records does not have to be complicated. With the right systems in place, it comes down to being organised and consistent.
Best Practices for Storing Payroll Records
Whether your records are stored digitally or on paper, the principles are the same: keep them secure, organised, and easy to access when needed.
Here is what we recommend:
- Use payroll software that automatically retains records and produces an audit trail
- Back up digital records regularly, with at least one copy stored securely off-site or in the cloud
- Restrict access to payroll records to authorised staff only
- Keep a written data retention policy that sets out how long each record type is retained
- Set reminders for when records reach the end of their retention period so they can be securely deleted
- If you still use paper records, store them in locked, fireproof storage
Need Help With Your Payroll Records?
Staying on top of payroll compliance can feel like a lot to manage alongside running your business. That is where we come in.
At DH Business Support, we offer a fully managed payroll service that takes the complexity off your plate, from RTI submissions and P60s to record-keeping and HMRC compliance. If you would like to find out how we can help, get in touch with our team today.
Frequently Asked Questions
How long do I need to keep payroll records in the UK?
HMRC requires a minimum of three years from the end of the tax year the records relate to. Six years is the widely recommended period, as it aligns with the Limitation Act 1980 and protects your business against late legal claims.
Do I need to keep payroll records after an employee leaves?
Yes. Former employee records, including payroll and tax records, should be retained for at least six years after their last day. This covers the standard limitation period for employment-related legal claims.
What payroll records do I need to keep?
You need to keep PAYE and National Insurance contribution records, RTI submissions, P45s, P60s, P11Ds, payslips, statutory payment records, tax code notices, pension contribution data, and timesheets or attendance logs.
What are the penalties for not keeping payroll records?
HMRC can impose penalties of up to £3,000 for inadequate or incomplete payroll records. Poor record-keeping can also trigger a PAYE compliance check and leave you without supporting evidence in an employment dispute.
Does GDPR apply to payroll records?
Yes. Payroll records contain personal data and are subject to UK GDPR and the Data Protection Act 2018. You must not retain personal data longer than necessary, store it securely, and have a documented retention policy in place.
Should payroll records be kept digitally or on paper?
Both are legally acceptable, provided records are legible and well-organised. For most businesses, though, digital storage is the better option. It is easier to back up, harder to lose, and increasingly expected by HMRC under Making Tax Digital.
If you are digitising existing paper records, make sure scanned copies are clear and saved with a consistent naming convention so they are easy to find later.
How long should I keep P60s and P45s?
The legal minimum is three years from the end of the tax year they relate to, but six years is strongly recommended to protect your business against late claims.