Performance review record keeping: what to store, who can see it, how long to keep it

Three questions turn up together, usually when someone asks for a copy of their file. What are we supposed to write down? Who is allowed to read it? When are we meant to delete it? Most organisations have never answered any of them out loud, so the answers in practice are everything, anyone with a login, and forever.

This article covers what belongs in a performance record, what to leave out, who should have access, how long to keep reviews and how to set a retention schedule you can defend. It describes the position in the UK and Great Britain and is general information, not legal advice.

A record that is complete, findable and limited to the right people is partly a process question and partly a system one. See how New Dynamics performance reviews keep one record per person rather than a trail of documents and inboxes.

What counts as a performance record

More than the form. The ICO lists "appraisal or performance review records" among the kinds of employment records an employer may hold, alongside personnel files, sickness and injury records, disciplinary and grievance records, training records, interview notes and emails.

In a review cycle that typically means the completed form and rating, the self-assessment, objectives and their history, one-to-one notes, feedback gathered from colleagues, calibration notes, and the emails that confirmed what was agreed. A manager's private notebook is usually personal data too, which surprises people: the test is whether the information identifies someone, not whether it lives in an approved system.

What to write down, and what to leave out

Write down the things that make the record useful and defensible: the period covered, the objectives as agreed, the evidence, the rating with the reason for it, what was agreed next with owners and dates, and the date of the conversation. Acas puts the record at the centre of the process, saying "it's important to keep a written record of what is discussed" and that it should be shared with the employee afterwards.

Leave out what you cannot justify holding. The ICO's data minimisation principle says the personal information you hold must be "adequate, relevant, and limited to what you need for your purposes", and that holding more than you need "is likely to be unlawful". In practice that rules out:

• Health details. These are special category information with their own conditions, and they belong in the absence or occupational health record, not in a performance form. Where an adjustment is in place, record the adjustment, not the diagnosis.
• Speculation about someone's private life, including the reasons you imagine are behind a change in performance.
• Unattributed third-party comment. "Several people have said" is not evidence and cannot be answered.
• Anything you would not say to the person. Which is also the practical test, because they can ask to read it.

The accuracy principle applies too: the ICO says you "must take all reasonable steps to keep any personal information you hold about your workers accurate and up-to-date", and should "carefully consider any challenges to the accuracy of information". A disputed rating is one of those challenges, which is why recording the employee's own comments alongside yours is better practice than arguing about whose version goes on file.

Who can see it

The ICO's security guidance is the clearest statement of the rule. Employment records must "only be accessed, altered, disclosed or deleted by those who are authorised to do so", and its example is "ensuring that access to employment records systems is limited to HR staff only, and that managers only have access to the information they need to meet their obligations".

Applied to reviews, that gives five working rules:

1. The current manager needs the performance record for the people they manage. That is the obligation the access exists to serve.
2. The previous manager usually does not, once the handover is done. The records move with the responsibility, which is the point made in reviewing an employee who changed manager.
3. Other managers see what calibration requires and no more: ratings and the reasoning behind them, not the personal circumstances behind a difficult year.
4. HR has access by role rather than by curiosity, and the system should be able to show who looked at what.
5. The employee can always see their own. The ICO describes the right of access, usually called a subject access request, and says an employer must respond "without delay and within one month".

Two habits cause most of the leakage. The first is ratings travelling socially: a manager mentioning where someone sits relative to the team, in a meeting the person is not in, is not a confidentiality breach in the formal sense but behaves like one. The second is review documents sitting in shared drives and email threads, where access controls do not reach and deletion never happens.

How long to keep performance reviews

This is where published advice is least reliable, because retention tables circulate without sources. There is no statutory retention period for appraisal records that we can point to, and anyone presenting one should be asked where it comes from.

What does exist is a duty to decide. The ICO says you "should set up a retention policy or schedule that lists: the types of record or information you hold; what you use it for; and how long you intend to keep it", and warns against a "one-size-fits-all" approach, noting that "while you may need to hold on to some types of information about previous workers, you may be able to delete other information as soon as the employment relationship ends". Its reasoning is practical as well as legal: "if you keep information longer than you need it, you are keeping more information than you need, and it is more likely to become inaccurate over time."

So the question becomes: what are these records for, and for how long are they for it? Ours, offered as a way to reason rather than as a rule:

• While employed: the full performance history is in use, because pay, progression and development decisions refer back to it.
• After leaving: reviews support references and answer disputes. Acas notes that "there are time limits for employment tribunal claims" and that someone "might only have 3 months minus 1 day from the date the problem at work happened" to notify Acas, but a claim notified at the edge of that window can take considerably longer to conclude. A retention period that expires inside that tail leaves you defending a decision with no record of it.
• Different categories, different periods. Rough working notes from one-to-ones do not need the life of a completed review, and a completed review does not need the life of a disciplinary record.
• Then delete, or anonymise. The ICO's position is that information should be erased or, where possible, anonymised once it is no longer needed. Aggregate rating data for reporting can usually be anonymised rather than kept with names attached.

Write the period down with the reason next to it. A schedule whose entries each have a stated purpose survives an audit. A number with no reason does not, however confident it looks.

Four steps to a schedule you can defend

1. List what you actually hold, including the places outside the system: shared drives, inboxes, exported spreadsheets, old review tools nobody has switched off.
2. State the purpose of each category, in one line. Anything with no purpose has just answered its own retention question.
3. Set the period from the purpose, not the other way round, and record the reasoning.
4. Make deletion happen, with a date, an owner and ideally an automated prompt. An unenforced schedule is a document about a policy you do not have.

What this looks like for the employee

The honest summary, and one worth putting in your own policy: your reviews are kept for as long as the organisation needs them for a stated purpose, you can ask to see what is held about you and get a response within a month, you can challenge anything factually wrong, and your comments can sit alongside a rating you disagree with. Our post on what happens after a performance review covers the moment most of these questions actually arise.

Frequently asked questions

How long should you keep performance reviews?

Long enough for a stated purpose and no longer. There is no statutory retention period for appraisal records to cite, so the duty is to set your own schedule, listing what you hold, what you use it for and how long you keep it, and to justify it. In practice the period usually runs through employment and for a defined time afterwards, long enough to answer reference requests and any dispute that arrives after someone leaves.

Are performance reviews confidential?

They are personal information with restricted access rather than secrets. The ICO expects access to employment records to be limited to those authorised, with managers seeing only what they need to meet their obligations. The employee can see their own record, HR has access by role, and other managers should see only what a calibration conversation requires.

Can a new manager read old performance reviews?

Usually yes for the people they now manage, because they need the record to do the job. The previous manager's access should end when the responsibility does. Where a record contains health or grievance material, that part normally stays with HR rather than travelling with the reporting line.

Can an employee ask for a copy of their performance reviews?

Yes. The ICO describes this as the right of access, commonly called a subject access request, which can be made verbally or in writing with no formal requirements, and must be answered without delay and within one month. Writing every review as something the person will read is the simplest way to be ready for it.

What should not be written in a performance review?

Health information, which belongs in a different record and has stricter conditions; speculation about someone's private life; unattributed comments from others; and anything you would not be willing to say to the person directly. The data minimisation principle requires what you hold to be adequate, relevant and limited to your purpose.

Who is responsible for performance review records?

The organisation is the data controller, so the duty sits with it rather than with individual managers, but managers create most of the records and control most of the risk. In practice HR owns the schedule, the access model and the deletion, and managers own writing records that are accurate, factual and shared with the employee.

Your next step: find the records nobody owns

1. List every place a performance record currently lives, and include the exports and the old system.
2. Check who can open each one. If the answer is everyone in HR plus two historic admins, fix that first.
3. Write a one-line purpose next to each category of record, then set the period from the purpose.
4. Pick a date to delete the first batch, give it an owner, and actually do it.

For the wider policy this sits inside, read and download our employee data protection guide. The guide is free to read, and the PDF uses our short download form.

Want performance records in one place, with access that follows the reporting line? Book a New Dynamics demo and bring your retention schedule, if you have one. You can also email contact@new-dynamics.com.