How long to keep employee records: retention periods, GDPR, archiving

“How long do I have to keep the files of former employees?” is a question many employers answer by reflex: “we keep everything, just in case.” That is exactly the wrong answer — because GDPR prohibits unlimited retention, and archiving legislation sets different periods per type of document. Here is the map.

Two different logics that overlap

Retention periods come from two directions, with opposite purposes:

• Archiving and tax legislation say how long you must keep a document (as evidence, for inspections, for recalculating a pension).
• GDPR says you cannot keep personal data longer than is necessary for the purpose you collected it for.

The practical rule: keep documents exactly as long as the special law requires, then delete or destroy them. The legal archiving period is itself the basis that justifies retention under GDPR — but once it expires, keeping the data becomes hard to defend.

The reference legal framework

• Legea 16/1996 on the National Archives — its annexes set the retention periods by category of document.
• Ordinul MFP 2634/2015 — financial and accounting documents.
• The accounting law (Legea contabilității), as amended by Legea 36/2023 — this shortened the general period for accounting registers and supporting documents.
• HG 500/2011 — the personnel file (dosarul de personal) and the employer’s mandatory documents.

The personnel file and contracts: a long period

Documents that evidence the employment relationship and length of service — the personnel file, individual employment contracts, addenda — have very long retention periods, in the order of decades (the annexes to Legea 16/1996 provide a 75-year period for this category).

The reason is practical: 20 or 30 years from now, a former employee may ask you for a certificate of length of service for their pension file. If the documents no longer exist, reconstructing them is difficult and the person loses contribution history.

Important: the shortened 5-year period introduced for accounting documents does not apply to personnel files. Confusing the two categories is the riskiest mistake in this area.

Payroll registers: watch out for the change of rule

This is where the amendment that caused the most confusion appeared.

• Traditionally, payroll registers (statele de plată) were kept for 50 years, precisely because they are used to establish and recalculate pensions.
• Through Legea 36/2023, article 25 of the accounting law was amended: accounting registers and the supporting documents underlying the entries are kept for 5 years, counted from 1 July of the year following the financial year — including payroll registers.

Specialists warn, however, that the new period should be treated with caution:

• it does not mean that older registers, already in the archive, can be destroyed immediately;
• they retain their function as evidence of the contribution history and the income used for pensions;
• destroying them prematurely leaves you unable to issue accurate income certificates.

The reasonable recommendation: do not destroy payroll registers on the basis of the new period without first analysing the matter with your accountant and, ideally, with an archiving specialist. The risk of not being able to issue an income certificate is, in practice, greater than the cost of keeping the records.

Other common categories

• Financial and accounting documents (invoices, registers) — the general period in accounting legislation, with the exceptions it provides.
• Occupational health and safety documents — their own periods, sometimes long, depending on exposure to risk factors.
• Applications and CVs of people who were not hired — no legal archiving period; they are kept only for the duration of the recruitment process or for as long as there is consent for a future process. Here GDPR is the only applicable rule.

Electronic archiving

You may archive electronically, provided the documents remain intact, legible and accessible throughout the retention period. “A folder of PDFs on a server” is not enough: what counts is traceability, protection against alteration and the ability to find the documents and make them available on request.

For electronically signed documents, the type of signature matters — an advanced or qualified signature with a timestamp stands up to a challenge far better than a simple scan.

What GDPR requires in addition

• A retention policy — an internal document stating, by category, how long you keep data and why.
• Effective deletion or destruction when the period expires, through a documented procedure.
• Role-based access — not everyone in the company needs to see personnel files.
• Encryption of sensitive data (CNP — the personal numeric code, health data, disability certificates).

Frequently asked questions

How long are payroll registers kept? Traditionally 50 years, as evidence for pensions. Legea 36/2023 introduced a 5-year period for accounting documents, including payroll registers — but applying it should be treated with caution, because those registers remain the source of income certificates. Check your specific situation with your accountant.

How many years must a personnel file be archived? A very long period, in the order of decades (the annexes to Legea 16/1996 provide 75 years for documents evidencing the employment relationship). The 5-year accounting rule does not apply here.

Which HR documents fall under GDPR? Practically all those containing personal data: the personnel file, contracts, time records, leave requests, medical certificates, health and safety forms. Health data and the CNP are categories that require additional protection.

Can personnel documents be archived electronically? Yes, if integrity, legibility and accessibility are ensured throughout the period, together with the ability to produce the documents on request.

What fines do you risk if you fail to keep the mandatory documents? Missing mandatory documents during an ITM (Labour Inspectorate) check is sanctioned as an administrative offence. Separately, non-compliant processing of personal data (including excessive retention) can attract GDPR sanctions applied by ANSPDCP (the national data protection authority).

For the full list of documents that make up the file, see the employee’s personnel file.

How Workly helps

The real problem is not “where do we keep the documents”, but who tracks the deadlines. Workly holds the digital personnel file, with documents encrypted and organised per employee — contracts, addenda, requests, certificates — and with role-based access, so that sensitive data is not visible to those who do not need it.

Retention is configurable by category, with automatic purging when the period expires — exactly what GDPR requires — without anyone having to remember it manually. Documents with an expiry date (contracts, fitness-for-work certificates, authorisations) are tracked with alerts ahead of the deadline, so you do not find out something has expired after the fact. And when a former employee asks for a certificate of length of service or of income, it is generated from consolidated data, not by manually reconstructing a paper archive.

---

Informational article, accurate at the date of publication. Not legal or tax advice. Archiving periods were recently amended and are interpreted differently — always check your specific situation at source (Legea 16/1996, the accounting law, the National Archives) or consult a specialist before destroying documents.