How long should employee data be kept?
Short answer
There is no single retention period for all employee data — the period depends on the type of document. Employment contracts and personnel files are kept for a long time, time-recording and everyday correspondence for much less, and unsuccessful candidates' data is deleted immediately after recruitment ends.
On this page
1.Split the data into groups
The mistake we see most often is one retention period for an entire personnel file. A file holds documents with different purposes: the employment contract and its amendments, orders, leave schedules, time-recording, training certificates, health check results, correspondence about everyday matters. Different logic applies to each group, so the period differs too.
In practice five or six groups are enough. For each one, write down the period and the reason — a statutory requirement, a limitation period for claims, or an organisational decision. The reason is the most important part: it lets you defend the period.
2.What the law dictates
Some periods are set by law — in archiving rules, in provisions governing employment relations and social insurance, in accounting requirements. These periods must be copied exactly as they stand, with the source noted. For the specific periods and their sources, see Article 12(1)(2) and Article 13(1) of the Law on Documents and Archives; the specific periods are set out in the Internal Administrative Document Retention Schedule approved by Order No. V-100 of the Chief Archivist of Lithuania of 9 March 2011.
Where the law is silent, the organisation sets the period itself. In that case it is common to start from the period during which a dispute over the employment relationship could still arise, and add a reasonable margin. What matters is that the period is written down in advance, not explained only when someone asks about it.
3.Candidate data
The CVs of unsuccessful candidates are a separate process with its own period. Once recruitment ends they are deleted, unless the person clearly consented to their data being kept longer for future recruitment. Consent must be voluntary and separate, and the candidate must be informed how long the data will be kept.
Be careful with interview notes and internal assessments: these are also personal data, they are sometimes evaluative in nature, and they often get forgotten in shared drives. It is worth deleting them together with the CV itself.
4.How to enforce the period in practice
A period nobody enforces is worse than having none: the document says one thing while the data sits there for ten years. Agree who reviews each group and when — for example once a year, after the financial year closes — and how the deletion is recorded.
Do not forget backups and paper files. If data is deleted from the system but remains in backups indefinitely, the period has not been enforced. Write down how long it takes for backups to be overwritten, and treat that as part of the period.
Official legal text
We do not paraphrase the regulation's provisions here. The official Lithuanian text of the GDPR is available in one place and is more precise than any summary.
GDPR text in Lithuanian (EUR-Lex)