Retention of Employee Records After Resignation

This article discusses the legal obligations of employers regarding the retention of personal data of former employees based on the Data Privacy Act, Labor Code of the Philippines and other related issuances.

In the context of employment termination—whether by resignation or transfer—the question of how long an employer may retain personal records of a former employee is both practical and legal. With the increasing emphasis on data privacy and digital recordkeeping, employers must be aware of the pertinent laws and regulations regarding retention of employee data.

Under the Data Privacy Act

The Data Privacy Act (DPA), under Section 11, mandates that the processing of personal data—including retention—must adhere to the principles of transparency, legitimate purpose and proportionality. Further, data must be retained only for as long as necessary for the fulfillment of the purposes for which the data was obtained or for the establishment, exercise or defense of legal claims, or for legitimate business purposes, or as provided by law.

Thus, Sec. 19 (d) (e) of the Implementing Rules and Regulations (IRR) of the DPA, provides:

“d. Personal Data shall not be retained longer than necessary.

1. 1. Retention of personal data shall only for as long as necessary:

(a) for the fulfillment of the declared, specified, and legitimate purpose, or when the processing relevant to the purpose has been terminated;

(b) for the establishment, exercise or defense of legal claims; or

(c) for legitimate business purposes, which must be consistent with standards followed by the applicable industry or approved by appropriate government agency.

1. 2. Retention of personal data shall be allowed in cases provided by law.

1. 3. Personal data shall be disposed or discarded in a secure manner that would prevent further processing, unauthorized access, or disclosure to any other party or the public, or prejudice the interests of the data subjects.

e. Any authorized further processing shall have adequate safeguards.

1. 1. Personal data originally collected for a declared, specified, or legitimate purpose may be processed further for historical, statistical, or scientific purposes, and, in cases laid down in law, may be stored for longer periods, subject to implementation of the appropriate organizational, physical, and technical security measures required by the Act in order to safeguard the rights and freedoms of the data subject.

1. 2. Personal data which is aggregated or kept in a form which does not permit identification of data subjects may be kept longer than necessary for the declared, specified, and legitimate purpose.

1. 3. Personal data shall not be retained in perpetuity in contemplation of a possible future use yet to be determined.”

Under Philippine Labor Laws

In the labor context, Rule X, Section 11 of the Omnibus Rules Implementing the Labor Code enunciates that all employment records of the employees shall be kept and maintained by the employer in or about the premises of the workplace. The premises of a workplace shall be understood to mean the main or branch office of the establishment, if any, depending upon where the employees are regularly assigned. The keeping of the employees’ records in another place is prohibited.

More importantly, Section 12 of the same rules requires employers to retain employee records for at least three (3) years from the date of the last entry. This aligns with Article 306 of the Labor Code, which sets a three-year prescriptive period for money claims arising from employer-employee relations.

Advisory Opinion by the National Privacy Commission

It must be noted that existing laws do NOT provide for a specific retention period for employee records. Thus, the National Privacy Commission (NPC), in Advisory Opinion 2017-24, outlined the factors that employers should consider when determining the retention period for employment records, to wit:

1. Legal requirements to which the company may be subject to;
2. Applicable prescription periods in existing law (i.e. money claims);
3. Department of Labor and Employment Rules;
4. Bureau of internal revenue regulations for bookkeeping requirements; and
5. Industry standards, and other laws and regulations that apply to the sector.

As long as the company can establish a valid business reason for retaining the specified personal data—aligned with industry standards—or if there are ongoing legal claims, or if retention is authorized by law, then keeping the data is allowed. However, this retention must not be indefinite, especially if based solely on potential future uses that have yet to be identified.

As data governance becomes increasingly critical, both employers and employees must remain informed and vigilant in upholding privacy standards in the workplace.

About Nicolas and De Vega Law Offices

Nicolas and de Vega Law Offices is a full-service law firm in the Philippines.  You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines.  You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.