Payroll record keeping
What payroll records HMRC expects employers to keep, for how long, and the format they need to be in.
Articles
What payroll records an employer must keep
For every employee: gross pay, deductions (tax, NI, student loan, pension), the tax code applied and the notices behind it, starter and leaver information, and payments to HMRC. Alongside: statutory payment records — sickness, parental leave — expenses and benefits, and pension auto-enrolment records.
The test mirrors every other tax record: could you evidence what each employee was paid, what was deducted, and where it went, for any period HMRC asks about?
How long, and in what form
PAYE records: at least three years after the end of the tax year they relate to — though six years is the safer working rule, since employment disputes, NI queries, and pension questions all outlive three. Auto-enrolment records carry their own six-year requirement.
Digital is fine and normal: payroll software output, stored and backed up, satisfies the requirement. What fails is having only the payslips and none of the underlying submissions and notices.
Records employees will come back for
P60s and payslips get lost, and the requests arrive years later — mortgages, visas, State Pension queries. The employer's file is the recoverable source: keep year-end summaries and be able to reissue figures cheaply.
NI records deserve respect: an employee's State Pension entitlement is built from what employers reported. Errors that stand uncorrected for years are miserable to fix retroactively — file accurately now, keep the evidence.
GDPR sits alongside HMRC
Payroll data is personal data: keep it secure, restrict access to those who need it, and retain it no longer than the purposes require — which the statutory retention periods define. A payroll file that anyone in the office can open fails data protection even while satisfying HMRC.
For RR payroll clients, the records layer is part of the service: submissions, notices, and year-end documents retained and retrievable, with reissues handled on request.
Frequently asked questions
How long must I keep payroll records?
At least three years after the end of the relevant tax year for PAYE purposes, six years for auto-enrolment — and six years across the board is the sensible working rule, because employment and pension questions outlast the PAYE minimum.
An ex-employee wants a P60 from four years ago. Must I provide it?
You are not obliged to reissue a P60 as such, but you can — marked as a duplicate — or provide a statement of the figures, and doing so is good practice. Their HMRC personal tax account also holds the reported figures.
Do I need to keep paper timesheets and expense claims?
Keep the records that support what was paid — digitised versions are fine. Timesheets evidence hours-based pay and minimum wage compliance; expense claims evidence non-taxable reimbursements. Scan, store, back up, and let the paper go.
Who should have access to payroll records?
As few people as the job requires — payroll data is sensitive personal data under UK GDPR. Restrict software access by role, store exports encrypted, and include payroll in your retention and breach procedures. HMRC compliance and data protection are separate tests; records need to pass both.