The fullest file anyone holds on you belongs to your employer: identity documents, pay, health notes, complaints, and years of your own written words. Most of it outlives the job. Some of that is law. The rest is the company protecting itself in case you ever bring a claim.
An HR file leaked is a whole person: identity documents, pay, health notes, disciplinaries, and years of your own messages. Enough to impersonate you, and enough to read your worst week at work. None of it can be reissued.
The file is bigger than you think
An HR file holds the application that got you the job, right-to-work identity copies, performance reviews, disciplinary and grievance records, absence and health notes, and the references that arrived when you joined. Around it sits what the workplace logged: email and chat archives, door entries, CCTV.
Leaving does not close it
Some holds are law: payroll records three years, minimum-wage records six, pension records six, right-to-work copies for two years after you leave. The rest is convention: many employers keep the whole file about six years after you go, tracking the window in which you could still bring a claim. That part is a choice they make, not a duty.
The reference you can never read
A confidential reference is exempt from your right of access at both ends: the company that wrote it and the company that received it can each refuse to show you. It is the one part of your own file the law lets them keep from you.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a period the company grants itself.
PAYE regulations: three years after the end of the tax year.
National Minimum Wage Regulations, raised from three years in 2021.
Auto-enrolment record duties; opt-out notices four years.
Home Office guidance: the employment plus two years, then destroy.
Accident book entries and reportable-injury records.
Kept after the tax year the pay period ends.
No statute sets this; it tracks the window in which a claim could still be brought.
Email, chat, door and camera records have no statutory period; the regulator asks for the shortest period the purpose needs.
This file is rarely sold. It is shown: a reference summarising you goes to the next employer, screening firms check pieces of it, group companies share HR systems, and in any dispute it becomes the evidence on both sides.
A subject access request reaches more of this file than people expect: interview notes, monitoring data, the file itself. It does not reach a confidential reference. While you are employed, the request is read by the people you work with, so weigh the moment; the right does not expire, and a leaving date is a natural one. What their reply claims, and when it arrives, goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →