What Employee Records Must Employers Keep in Ireland?

What Employee Records Must Employers Keep in Ireland?

"How long do we have to keep this?" is one of the most common HR questions in Ireland, and one of the least well answered. There is no single rule. Different records have different periods, some have no fixed period at all, and holding on to data "just in case" creates its own risk under GDPR.

This guide pulls the main answers together, explains what the Workplace Relations Commission (WRC) expects to see, and shows how to build a retention schedule you can defend.

In this guide

1. The main record-keeping rules at a glance
2. Working time records in detail
3. What the WRC expects to see
4. Contracts and statements of terms
5. Permits, tax and other records
6. Records with no fixed period
7. What GDPR adds
8. Build a retention schedule in six steps
9. A sample retention schedule
10. Where record-keeping goes wrong
11. Checklist and FAQ

1. The main record-keeping rules at a glance

RecordPeriodWhere it comes fromWorking time records (hours worked, breaks, leave taken, rosters, copy of the contract terms)3 yearsOrganisation of Working Time Act, as published by the WRC and Citizens InformationWritten statement of terms of employmentSigned, dated copy kept on file for 1 yearWRC guidance on the Terms of Employment (Information) ActEmployment permit records for non-EEA staff5 years (or longer if employment continues past five years from the grant)Employment Permits Act 2024, section 63 (see the Department of Enterprise)Expense and travel records, original tax documents6 yearsRevenuePersonnel files, performance reviews, disciplinary filesNo fixed legal periodKeep only as long as needed for the purpose; document your own policyRecruitment records (unsuccessful applicants)No fixed legal periodSame: keep only as long as needed, and say so in your privacy notice

Always check the current official source for your sector before deleting or keeping a record. Some sector-specific rules (for example, in education or healthcare) may set different periods.

2. Working time records in detail

The core statutory obligation is to keep records showing compliance with the Organisation of Working Time Act. That means, in practice:

• Hours worked each day and week, including start and finish times
• Breaks and rest periods, so you can show the daily and weekly rest rules were met
• Annual leave and public holidays taken
• The rota or roster
• The terms of the contract relating to hours

Keep them for at least three years. Citizens Information notes that GDPR doesn't affect this obligation. In practice, inspections often concentrate on the most recent 12 months, extending further if inconsistencies appear.

3. What the WRC expects to see

A WRC inspector reviewing compliance will typically ask for:

• Contracts and statements of terms for each employee
• Hours worked, including start and finish times and breaks
• Annual leave and public holiday records
• Rates of pay, overtime and deductions
• Sick leave records
• Employment permits, where relevant

If any of these are missing or inconsistent, that's where findings tend to come from. In 2025 the WRC finalised 5,145 inspection cases, and 1,775 (about one in three) found at least one breach. Records weren't the only issue, but poor records make every other issue harder to defend.

4. Contracts and statements of terms

Employers must give a written statement of core terms within five days of starting, and the remaining terms within two months. Each statement should be signed and dated by the employer, and a copy kept on file for one year. Many employers keep the signed contract for the life of the employment plus a defined period, which is sensible, but you should set and document the period yourself.

5. Permits, tax and other records

• Employment permits: employers of permit holders must keep records of the employment, its duration and the permit for five years, or longer if employment continues beyond five years from the grant. They must be available to an authorised officer.
• Tax documents: original documents used to calculate tax, and expense and travel records, are generally kept for six years according to Revenue.
• Sick leave records: the WRC has published guidance on sick leave records; check the current page for the period that applies to your situation.

For anything touching tax, check with Revenue or your accountant.

6. Records with no fixed period

Several important categories have no single statutory retention period:

• Personnel files: performance reviews, appraisals, development plans.
• Disciplinary and grievance records: keep as long as needed for the purpose, including any live or foreseeable legal claim. Data used to prepare a legal claim can be kept longer, depending on how proceedings develop.
• Recruitment records: CVs, interview notes and scorecards for unsuccessful candidates.
• Training records: except where a specific regulation requires a longer period for particular roles.

For these, the safest approach is to decide a period, write it down with the reason, and apply it consistently.

7. What GDPR adds

GDPR doesn't set retention periods for employment records. What it does require is that you:

• Keep personal data only as long as needed for the purpose it was collected
• Record why you're keeping it and for how long
• Delete or securely dispose of it when that purpose ends
• Limit access to people who need it

The Data Protection Commission (DPC) says organisations should set time limits for erasure or periodic review. Statutory retention rules (like the three-year working time rule) are a valid reason to keep something. "We might need it someday" isn't.

8. Build a retention schedule in six steps

1. List your record types. Contracts, time records, leave, sickness, performance, discipline, recruitment, permits, training, medical certificates.
2. Record the legal basis or reason for keeping each.
3. Set a period and note the source.
4. Decide who has access to each record type.
5. Assign an owner who reviews and deletes on schedule.
6. Set a review date, and make deletion part of your leaver process.

A short table in your HR policy is enough. The point is that if someone asks why you've kept a record, you can answer in a sentence.

9. A sample retention schedule (adapt to your sector)

Record typeRetentionReason / sourceOwnerTime, break and rota records3 years from the record dateOrganisation of Working Time ActHRAnnual leave and public holiday records3 yearsPart of working time recordsHRStatement of terms (signed copy)At least 1 year; we keep for duration of employment plus 3 yearsWRC guidance; internal policyHREmployment permit records5 years (or longer if employment continues)Employment Permits Act 2024HRTax-related documents and expenses6 yearsRevenueFinancePerformance reviewsDuration of employment plus 1 year (example only)Internal policyHRUnsuccessful applicants12 months (example only)Internal policy, in privacy noticeHRDisciplinary recordsPer warning validity period, then reviewInternal policyHR

Treat the "internal policy" lines as examples to adapt, not as legal periods.

10. Where record-keeping goes wrong

• Files in six places: email, shared drives, desktops, a filing cabinet, a payroll provider and HR's spreadsheet.
• No audit trail for who changed a record and when.
• Over-keeping: records of leavers, rejected candidates and old sick notes that nobody ever reviews.
• Under-keeping: missing records for the period an inspector asks about.
• Shared logins that make it impossible to show who accessed a record.
• Paper that never gets scanned, then can't be found when a request arrives.
• Records tied to individual people who leave, taking the knowledge of where things are with them.

Digitising paper records without creating new risk

Moving from filing cabinets to a digital system is sensible, but do it deliberately:

1. Audit what you have. Count the files and note which are live, which are leavers and which are past their retention date. Don't scan what you should delete.
2. Decide the structure first. One employee record, with documents organised by type (contract, right-to-work, leave, performance), beats a shared drive of folders named by whoever created them.
3. Scan to a standard. Legible, named consistently, linked to the employee record, with the original destroyed securely once you're satisfied the copy is complete.
4. Control access. Medical certificates and disciplinary files shouldn't be visible to everyone who can see a contract.
5. Keep the audit trail. Who uploaded, viewed or changed a document matters when someone asks.

What an "inspection-ready" file looks like

If the WRC called tomorrow, you should be able to produce, per employee and without a scramble: the signed contract and statement of terms; time and break records for the period; annual leave and public holiday records; evidence of correct pay and deductions; sick leave records; and any permit records. The test is simple: could someone other than you find all of that in under an hour? If not, the filing system is the problem, not the people.

Handling an access request

If an employee asks for the personal data you hold about them, you generally have one month to respond. It's far easier when the records are in one place. Know in advance where HR files, emails, CCTV, rotas and performance notes live, and who is responsible for pulling them together.

11. Checklist

• Retention schedule written, with source and owner for each record type
• Working time records kept for at least 3 years
• Signed statements of terms on file for every employee
• Permit records kept for 5 years for non-EEA staff
• Tax documents handled per Revenue guidance
• Privacy notice explains how long you keep data
• Annual review: delete what's expired
• Leaver process includes record review

How CloudHR helps

CloudHR keeps employee profiles, contracts and documents in one place, with e-signature and an audit trail, so the record an inspector asks for is a search away, not a hunt across inboxes. Each company has a dedicated database hosted in the EU. Contract expiry alerts and rest-period alerts in the WRC Compliance module flag gaps early. Flat €599 a month for up to 250 employees, 30-day free trial.

Start your free 30-day trial

FAQ

How long must employers keep working time records in Ireland? At least three years.

Do I have to keep employment contracts after someone leaves? Working time records, including contract terms, must be kept for three years. For other documents, set a retention period you can justify and document it.

How long should unsuccessful job applications be kept? There's no fixed legal period. Keep them only as long as needed, tell applicants how long in your privacy notice, and delete them when the purpose ends.

Does GDPR override the three-year rule? No. Statutory record-keeping duties are a lawful reason to hold data.

How long should employment permit records be kept? Five years, or longer if employment continues beyond five years from the grant, under the Employment Permits Act 2024.

How long do I keep tax-related records? Revenue's general guidance is six years for original documents used to calculate tax; check with Revenue or your accountant for your situation.

What's the safest way to store employee records? In one access-controlled system with an audit trail, rather than scattered across email and shared folders.

Can I keep records for longer than the minimum? Only if you have a documented reason, such as a live legal claim. Otherwise GDPR's storage limitation principle says to delete.

Who should own record retention? Name one owner (usually HR) and make deletion part of the leaver process and an annual review.

This article is general guidance, not legal advice. Retention periods change and vary by sector; confirm with the WRC, Revenue, the Data Protection Commission or a professional adviser.

Sources

• Workplace Relations Commission, record keeping: https://www.workplacerelations.ie
• WRC employee FAQ on statements of terms: https://www.workplacerelations.ie/en/news-media/workplace_relations_notices/employee-faq.pdf
• Department of Enterprise, Tourism and Employment, employment permits: https://enterprise.gov.ie
• Data Protection Commission: https://www.dataprotection.ie
• Revenue, record keeping: https://www.revenue.ie
• Citizens Information, working time records: https://www.citizensinformation.ie