1. Home>
  2. Resources>
  3. Payroll Outsourcing>

The legal obligations of processing data under GDPR: Part 2

legal stuff

Retention of the personal data is ‘lawful basis’ where it is necessary, for compliance with a legal obligation, for the exercise or defence of legal claims. For Payroll and HR reasons, employers must hold and retain personal information about their employees and former employees to meet these legal requirements.

HMRC requirements

In the United Kingdom, HM Revenue & Customs (HMRC) have a requirement on employers to record and retain certain personal information from a current and historic aspect and these legal requirements supersede an individual’s request for deletion or change where that information is being processed and kept for those legal reasons.

HMRC law requires employers to both record and report aspects of personal information such as: name, address, date of birth, gender, national insurance number and to report to HMRC using Real Time Information (RTI) under PAYE Regulation 67B or 67D, which must contain the information specified in Schedule A1 of the PAYE Regulations.

An individual cannot prevent their employer informing HMRC who then inform the Department for Work & Pension of their employment related earnings and personal information.

Equally, immigration law often requires 'Right to Work' identification documents for all new employees to be retained for potential inspection, excuse and/or defense in relation to showing that an illegal worker has not been employed by them. Such retention would be a 'lawful basis' and in the UK must be kept for a minimum of 2 years after they have finished employment with you.

Examples of ‘lawful basis’ within the UK

Working Time directors and Minimum Wage law, would require employers to retain and keep records of time and payments to employees to enable appropriate audit to take place. This also would be a 'lawful basis'. The following is a list of a few of the 'lawful basis' examples within the UK:

  • Wages / salary record (also overtime, bonuses and expenses): 6 years: Taxes Management Act 1970 
  • Income tax and NI records: Not less than 3 years after the end of the financial year: The Income Tax (Employments) Regulations 1993 (SI 1993/744) as amended.
  • National Minimum/Living Wage: 3 years after the end of the pay reference period: National Minimum Wage Act 1998
  • Working time record: 2 years: The Working Time Regulations 1998 (SI 1998/1833)

In summary

Sometimes law may provide no definitive retention period indicated for some records and it is therefore up to the employer to appropriately decide and justify their basis of retention. These judgement time limits may be associated with claims limits allowed within GDPR. A common general position is indicated as a retention of personal information and records in the UK is for 6 years plus current based on the Limitation Act 1980 where legal proceedings would have to have commenced.

Similar requirements will exist throughout the European Union. Don't implement data deletion or change policies as a result of new GDPR processes which would breach the 'lawful basis' requirements. You could find yourselves in trouble with national tax collectors and immigration departments if you don't retain records required by law. 

    Related articles

    Payroll Outsourcing: Work smarter, not harder:
    Ebook

    Payroll outsourcing | Work smarter, not harder

    Outsourcing payroll is very much on the rise. It is now in the top 3 most desired outsourcing projects with 4 in every 10 HR leaders saying they want to introduce this in their own organisation. These key trends were taken from our latest Future of Work & People report when we researched the challenges and priorities of almost 3,000 senior HR leaders across Europe.

    2022-03-03
    man in pak op een bank
    Blog

    The complete guide to outsourcing your payroll in 2021 [Free 121 business case support]

    The concept of outsourcing your payroll is highly appealing. Businesses effectively gain more expertise, experience and resources, and it costs them less.

    2021-05-17
    vrouw die werkt
    Blog

    5 implementation steps to ensure your outsourced payroll transition goes smoothly

    The prospect of handing over responsibility for your payroll to an outsourced partner can be daunting enough, without having to worry about something going wrong during the transition. That’s why implementation has to go smoothly.

    2021-02-08