I have contacted Data Protection and they are unable to tell me what the time line is for retaining employee applications for jobs and employee files i.e. leavers. What is appropriate? She said we should have a data protection retention policy and state how long we keep files before they are shredded.

This response was correct. As there are no specific document retention periods provided in the Data Protection Act 1998 (DPA), it is down to each employer to set their own time limits for the holding and deletion of employee records within the constraints of any other specific legislative and best practice requirements.

The applicable data protection principle is the fifth data protection principle, which states that personal data which is processed for a purpose should not be kept for longer than is necessary for that purpose. Basically, the retention period should be based on the business needs of the employer.

Employers should not, however, be too hasty to implement a blanket policy on