The Ex-Employee’s File: No Retention Term in the GDPR, Several Elsewhere

A typical scenario, not a real case. Five years after a production technician resigns, a manufacturing company’s legal office asks whether his file can finally be deleted. The answer comes back in pieces. Payroll says the tax term may not have expired, but nobody can calculate it with confidence. The occupational physician says the original health file must be kept for a period the law fixes, without saying when the clock starts. The HR document system has no written rule, only an unchecked practice. And the GDPR, the law everyone cites first, sets no term at all — we checked, article by article.

Article 5(1)(e): a principle, not a number

Regulation (EU) 2016/679 lists the principles of processing in Article 5(1). Point (e) requires that personal data be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed” — a principle the text itself labels, in brackets, “storage limitation”. There is no number to find in this article, no five years or ten years: the term depends on the purpose, and the purpose is not the same for every piece of the same file. A payslip serves one purpose, a health file another, a disciplinary review a third: Article 5 asks for the calculation to be redone for each, it does not hand over a table. It is a principle of method. Where a number exists, Italian statute law writes it elsewhere — piece by piece, as a rule in its own right, not as commentary.

Where the term is written, with a number: the health file

Article 25(1)(e) of Legislative Decree 81/2008 requires the occupational physician to «consegna al lavoratore, alla cessazione del rapporto di lavoro, copia della cartella sanitaria e di rischio» — hand the worker, on termination, a copy of the health and risk file (our translation throughout, for the Italian-only sources below) — and that «l’originale della cartella sanitaria e di rischio va conservata, […] da parte del datore di lavoro, per almeno dieci anni, salvo il diverso termine previsto da altre disposizioni del presente decreto» — the original of the health and risk file is kept […] by the employer for at least ten years, unless a different term is set elsewhere in this decree. A number written down, not inferred. But the same sentence is silent on a point that matters as much: when the ten years start running. The text ties the worker’s copy to termination, but never repeats “from termination” for the employer’s duty to keep the original. We do not fill that gap with our own reading: we flag it as silence, checked against the text in force, not a summary.

Where the term depends on an event, not a fixed date

Presidential Decree 600/1973, Article 22, on accounting records — which include payslips booked as a cost — says something else again: they must be «conservate fino a quando non siano definiti gli accertamenti relativi al corrispondente periodo d’imposta anche oltre il termine stabilito dall’articolo 2220 del codice civile» — kept until the tax assessments for the corresponding period are closed, even beyond the term set by Article 2220 of the Civil Code. Not a date: an event, the closing of that year’s tax assessment. When does it close? Article 43 says notices «devono essere notificati, a pena di decadenza, entro il 31 dicembre del quinto anno successivo a quello in cui è stata presentata la dichiarazione» — must be served, on pain of forfeiture, by 31 December of the fifth year after the return was filed — the seventh year if never filed. An example, to fix the arithmetic, not a real case: 2020 payslips fall within the business return filed in 2021; the ordinary term closes 31 December of the fifth year after filing — 31 December 2026, the very months we are writing in. A 2020 document can still be mandatory to hold today, for reasons that have nothing to do with the GDPR and everything to do with tax law. And Article 2220 of the Civil Code, cited there as the comparison term, adds a third: «Le scritture devono essere conservate per dieci anni dalla data dell’ultima registrazione» — records must be kept for ten years from the date of the last entry. Ten years once more, but counted from a moment that matches none of the others: not the end of employment, not the tax return — the last accounting entry.

Where the term disappears into a further referral

Decree-Law 112/2008, Article 39, establishes the libro unico del lavoro — the single employment ledger recording each worker’s name, tax code, pay, and attendance, month by month. Paragraph 4 sets no retention term: it delegates one. «Il Ministro del lavoro […] stabilisce, con decreto […], le modalità e tempi di tenuta e conservazione del libro unico del lavoro» — the Minister of Labour […] shall set, by decree […], the arrangements and timing for keeping and retaining the ledger. The number, if it exists, sits in an implementing decree we have not verified at source: the parent statute refers onward, and our check stops where that referral took us. Same pattern as everywhere else in this file — one document, one statute, one term to look up somewhere else — pushed one level deeper than we managed to follow this time.

The one piece of data no corporate system holds in full

Four sources, four different logics: no fixed term in the GDPR, a tax event that moves year by year under Presidential Decree 600/1973, a flat number with no stated starting point under Legislative Decree 81/2008, a referral to a text we do not have in hand under Decree-Law 112/2008. Payroll, when it knows how, calculates the tax term — but knows nothing about the health file, which sits with the occupational physician or the safety officer. The HR system applies, at best, a practice never checked against Article 25. And whoever administers company IT systems answers to a shorter, different retention duty — six months for access logs, not ten years for a health record. None of these systems holds the full map: which document, which statute, which term, which event starts the clock. That is the missing piece — not data the company has and cannot find, but data nobody has ever assembled in one place.

See the service · Talk to an engineer

What we could not verify

We do not offer legal advice. We have not verified the implementing decree under Article 39(4) of Decree-Law 112/2008 on the ledger’s retention: the parent law defers, and we did not read the decree. The same point (e) of Article 25 leaves room for a term other than ten years, «salvo il diverso termine previsto da altre disposizioni del presente decreto» — unless a different term is set elsewhere in the decree — and we have not checked whether, or where, it does. A worker’s right to access their own file — who may see it, not how long it is kept — is a separate question, already covered elsewhere.

The two axes, applied to retention

Compliance. The question “can we delete it?” becomes, in our system, a document-by-document map: for each piece of the file — pay, health record, disciplinary file, access logs — which statute sets the term, which event starts it, which system holds it today. Not one deadline for the whole file: as many as there are sources governing it, each checked against the text in force.

Decision-making. The same system holds payroll, safety and document management together in a single operating model, on which AI agents execute decisions with a human operator in command. Always on-premises, on autonomous machines without deep integration into the client’s network, or on our dedicated cloud, with a dedicated VPN and a data centre in Italy. It is the method behind how we build the platform.

Could you say today, for a worker who left five years ago, which piece of their file should already be deleted and which still has to be kept — and which statute each of those two answers rests on? Half an hour with one of our experts is enough for the first map.