united-kingdom gdpr england-and-wales data-protection
How long can an employer keep financial details after employee has left under GDPR?
<p>I finished a job in 2019, but just received notification of a data breach at that job in 2021, and my bank account number, sort code, national insurance number, full name, address and date of birth were compromised.</p>
<p>As far as I know under GDPR data controllers can only hold data for as long as they have grounds to process it - does anyone know what this means in practice for HR and financial records? (e.g. why would they need my bank details for over a year after they had stopped paying me?)</p>
<p>I'm wondering whether I have grounds for compensation or to sue my ex-employer for keeping such sensitive data for so long and letting it be compromised.</p>
<p>Jurisdiction is England and Wales.</p>

<p>The retention periods depend on the exact legal basis for keeping such records. For example, accounting records might reasonably involve at least your bank account number, sort code, full name, and address. Under Section 388 of the Companies Act 2006, accounting records must be kept for three to six years, depending on the type of company (private or public). This would indicate that the company was within its right (and duty!) to hold records relating to at least the 2018 fiscal year.</p>

<p>For as long as they might be required:</p>
<ol>
<li>Company law requires 3 or 6 years for private and public companies respectively.</li>
<li>Tax law allows audits for up to 6 years.</li>
<li>Civil claims (e.g. for wage underpayment) can be brought for up to 6 years.</li>
<li>Workers compensation is practically indefinitely. There is a limit of 3 years, but that runs from the discovery of the illness or injury. Long term illnesses (e.g. asbestosis) may not appear for decades. Practically, the employer needs to know at least the identity and period of employment of everyone who has worked for them forever.</li>
</ol>
