How long do you need to keep right to work check records?

Right to work check evidence should be retained for the duration of a worker's engagement and for a defined period after it ends, in case a query is raised after the fact. The record needs to be clear enough to show exactly what was checked and when — a note saying "checked, fine" without a copy of what was actually verified is a weak record.

As with most compliance record-keeping, the retention period is the legal floor, not the practical target. If a worker's status is ever questioned — by the hirer, an inspector, or in a dispute — being able to produce the original check quickly matters considerably more than being able to say, eventually, that it technically still exists somewhere.

What a proper record actually contains

• –A copy of the document(s) checked, or the outcome of the Home Office online check, not just a reference number
• –The date the check was carried out
• –Who carried it out
• –For a time-limited right to work, the expiry date and a note of when a follow-up check is due

A record missing any of these isn't necessarily worthless, but it's weaker than it needs to be — and the gap tends not to matter until the exact moment it does, which is usually when someone outside the agency is asking questions and patience for reconstruction is in short supply.

Why retrieval speed matters as much as retention

A record technically kept for the required period but buried in an old email thread, a departed consultant's inbox, or a folder structure nobody remembers the logic of, doesn't function as a record when it's actually needed. The practical test isn't "do we still have this somewhere" — it's "can someone who wasn't involved in the original placement find this in under a minute." Agencies that pass that test tend to store right to work evidence against the worker's record in one consistent place, not scattered across whichever system was convenient at the time of the original check.

What happens at the end of the retention period

Once the retention period has genuinely passed and there's no live query, dispute, or reason for the record to be needed, it should be disposed of rather than kept indefinitely by default — data protection obligations cut the other way once the compliance justification for holding the record has expired. The point isn't to hoard everything forever; it's to have a clear, defensible reason for what's kept, for how long, and what happens to it afterward.

This connects directly to how DBS checks should be handled too — both are the kind of record that's easy to file correctly once and then genuinely hard to find again months later if the filing system isn't built for retrieval, not just storage.

Where records go missing in practice

The most common way a right to work record effectively disappears isn't deletion — it's fragmentation. A copy of the document sits in an old email inbox, a note about the check lives in a CRM record, and the actual verification date exists only in someone's memory of when a particular consultant handled that placement. None of these individually is wrong, but together they mean nobody can produce a single, complete answer quickly when asked. A consultant leaving the business, or simply not being available on the day a query comes in, can turn a technically-retained record into a practically unavailable one.

A sensible retention and disposal routine

• –Store the evidence against the worker's record in one consistent location, not spread across email, CRM notes and a shared drive.
• –Record the retention trigger clearly — when the engagement ended, and therefore when the retention clock started.
• –Set a routine review point to identify records that have passed their retention period and no longer have a live reason to be kept.
• –Keep a simple log of what's been disposed of and when, so the disposal itself is defensible if ever questioned.

It's also worth planning for the departure of the person who did the original check. A retention system that depends on one consultant's personal filing habits, rather than a shared, structured place every check goes automatically, effectively resets to zero the day that person leaves — which is precisely the wrong moment for a gap to appear, since it's often not discovered until a record is actually needed.

Who should actually be able to access these records

There's a balance to strike between records being genuinely retrievable and records being appropriately restricted — right to work evidence contains sensitive personal and immigration status information, and shouldn't be freely accessible to anyone in the business regardless of whether they have a reason to see it. The practical answer is usually a small, defined group with legitimate access — payroll, compliance, and the consultant responsible for that placement — rather than either extreme of a fully open shared drive or a record so locked down that even the people who need it struggle to get to it quickly.

Why this is worth getting right even without an active dispute

It's tempting to treat record-keeping discipline as something that only matters if a dispute or inspection is already underway. In practice, the agencies that handle this well treat it as a standing operational habit rather than a response to pressure — largely because by the time a query actually lands, there's no time left to fix a weak filing system. Building the habit before it's tested is considerably easier than trying to reconstruct months of history under time pressure once gov.uk guidance, an inspector, or a hirer is actively asking questions.