Skip to content
RTWComply

Right to Work Records: GDPR and Retention

By Brian CrockerLast reviewed: 5 October 2026

Right to work GDPR compliance sits in an awkward spot. Keep too little and you have no statutory excuse; keep too much, or for too long, and you have a data protection problem instead. The employer's guide resolves most of it for you: copy the specified parts of the document, store it in a format that cannot be manually altered, keep it for the duration of employment plus two years, then destroy it securely.

The part employers most often skip is the last one. Deletion is not optional tidying — it is the point at which holding the data stops being justified.

This guide is for informational purposes only and does not constitute legal advice. For advice on your specific situation, consult a qualified immigration solicitor or data protection specialist.

The retention period, and why it is not yours to choose

The employer's guide to right to work checks sets the period directly. Employers must:

"ensure all copies of documents are kept securely for the duration of the worker's employment and for two years afterwards. The file or document must then be securely destroyed."

Two years after they leave, not two years after the check. The clock starts when employment ends — the Code of practice puts it as "two years after the employment has come to an end".

The reason for the outer limit is the storage limitation principle in Article 5(1)(e) of the UK GDPR, which requires personal data to be:

"kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed"

The purpose here is establishing and evidencing a statutory excuse. Two years past the end of employment is where the Home Office puts the outer edge of that need. Once you are past it, the justification for holding a copy of someone's passport has gone, and the file becomes a liability with no compliance value.

What you are actually meant to copy

Over-copying is the most common data-protection failure on right to work files, and it is avoidable because the guide is specific.

Passports: "any page with the document expiry date, the holder's nationality, date of birth, signature, immigration permission and expiry date, biometric details, photograph and any page containing information indicating the holder has an entitlement to enter or remain in the UK (visa or entry stamp) and undertake the work in question (the front cover does not have to be copied)."

Everything else: the guide asks for "a clear copy of each document checked", and the Code of practice says to copy each document clearly "(front and back where applicable and the biographic data pages in passports)".

So a full front-to-back scan of a passport is more than you need — but "the pages that evidence identity and entitlement" is more pages than it sounds. Alongside any page showing the visa or entry stamp, copy every page carrying the expiry date, nationality, date of birth, signature, immigration permission and biometric details, plus the photograph page. Missing one of those pages is under-copying, not a shortcut — and under-copying is the failure that costs you the statutory excuse. The front cover is the only page you can skip.

For online checks the equivalent is the profile page from the check result — the page showing the individual's photo and the date the check was conducted. Not a screenshot of the whole session, not the employee's own account view.

If you are unsure which document you have been handed and therefore what to copy, our documents list sets out the list each acceptable document falls under and the follow-up obligation attached to it — which is also what determines how long the file stays live.

Format: unalterable and quickly retrievable

Two format requirements sit in the guide, and both have practical consequences.

"make a clear copy of each document checked. Where facial recognition technology has been used, this must include a copy of the document checked and any comparison provided by the RtW DVSP, in a format which cannot be manually altered. This can be electronically, in HTML or as a PDF, or in hardcopy."

An editable spreadsheet with dates typed in is a register, not a record of the document. It can supplement the copies; it cannot replace them.

"Employers should produce these document copies quickly in the event they are requested to demonstrate that they have performed a right to work check and retain their statutory excuse."

Retrievability is a compliance requirement, not just good practice. Records that exist but take a week to find fail the test the Home Office actually applies during an inspection — our record keeping guide covers what that looks like in practice, and the right to work audit guide walks through checking your own files against it.

Treat everyone the same — including on the data side

The discrimination risk in right to work checks is usually discussed at the checking stage: check everyone, not just the people who look foreign. It carries through to the records.

If you copy and retain documents for some employees and not others, your file set itself shows a selective process. Consistency in what you copy, how you store it, and how long you keep it is part of demonstrating that the process was applied uniformly. It also makes the deletion schedule workable, because every file has the same shape and the same expiry.

The deletion step nobody diarises

Follow-up checks get diarised because missing one costs a statutory excuse. Deletion does not get diarised because missing it costs nothing visible — until a subject access request, a data breach, or an audit turns up passport scans of people who left in 2019.

A workable approach:

  1. Record a leaving date against every right to work file at the point the person leaves, not at year end.
  2. Set the destruction date to leaving date plus two years at the same moment. One entry, made once.
  3. Run a quarterly sweep of files whose destruction date has passed. Quarterly is enough; the obligation is not to delete on the exact day, it is not to keep indefinitely.
  4. Destroy securely — for digital records that means deletion from backups and shared drives too, not just from the live folder. A copy that survives in an email attachment or a shared inbox is still a copy you hold.
  5. Log that you did it. A short destruction log is the only evidence that the data is gone rather than mislaid.

One exception worth thinking through before you automate: if there is a live dispute, an outstanding Home Office matter, or an ongoing tribunal claim touching that person's employment, deleting on schedule may not be appropriate. Handle those as named exceptions with a reason recorded, rather than by extending everyone's retention.

Right to work GDPR requests: handling a subject access request

Employees can ask for a copy of the personal data you hold about them, and right to work files are squarely within that. Two practical points.

The copy of their own document is their personal data, and there is no compliance reason to withhold it. But a right to work file often contains more than the document — notes about a pending application, correspondence with the Employer Checking Service, internal discussion about whether an excuse still holds. Review before you disclose rather than exporting the folder.

Keeping the file tidy is what makes this survivable. A folder containing exactly the copies the guide requires, dated, is a five-minute response. A folder containing three years of email is not.

Since 1 October 2026, there are more of these files

The record set grew on 1 October 2026, when the Right to Work Scheme extended beyond contracts of employment to worker's contracts, individual sub-contractors and online matching services. Casual and platform workers engaged on or after that date now have to be checked, which means their documents are now copied and held — including for people who work a handful of shifts and never return.

Short engagements are where retention discipline breaks first, because there is no leaver process to hang the deletion date on. Decide how a two-shift casual worker's file gets a destruction date before the volume builds up. See what changed on 1 October 2026 for the wider picture.

The bottom line

For passports, copy the biodata page, any page with a visa or entry stamp, and every page carrying the expiry date, nationality, date of birth, signature, immigration permission or biometric details — skip only the front cover. For everything else, copy the document clearly, front and back where applicable. Store them in a format that cannot be edited, and where you can produce them quickly. Keep them for the duration of employment plus two years, then destroy them securely and log it. The retention period is set for you; the only part that needs designing is the deletion trigger — and that is the part most employers have never built.

Sources

Stop tracking visa expiry dates in spreadsheets

RTWcomply will automate follow-up check reminders, visa expiry tracking, and build your Home Office audit trail. Join the waitlist for early access.

No spam. Unsubscribe any time. Privacy policy

Related guides

Right to Work Training: What It Actually Buys

Right to work training does not lower the standard you are judged against. What it does buy is worth more, and some of the material costs nothing.

HMRC Right to Work Checks: What HMRC Doesn't Do

HMRC does not run right to work checks — the Home Office does. What HMRC's role really is, and why a National Insurance number proves less than employers think.

Failed Right to Work Check: What to Do Next

A failed right to work check is usually two different situations. How to tell them apart, when to use the Employer Checking Service, and what the notices mean.