GDPR and the Data Protection Act 2018 suggest retaining payroll records for 6 years (HMRC rules), and personal data—like contracts or disciplinaries—only as long as needed, typically 6 years for potential claims.
A retention policy ensures secure storage and lawful disposal. Staying organized keeps you audit-ready and compliant. Shred outdated files securely to avoid data breaches and fines. Label records by year to make retrieval easy if HMRC or a tribunal calls.
Helpful government guidance is available at: Data protection on GOV.UK.