TemporRight to Work Checks: What You Must Keep, and For How Long
A subcontractor's right to work check happened eighteen months ago, before he moved to a different site under a different foreman. Now he's leaving, and nobody in the office can find the copy of his passport that got scanned back then, or even confirm it was ever saved anywhere other than someone's phone. That gap is exactly what a Home Office compliance visit is built to find. Keeping the document is the easy part of a right to work check. Knowing how long to keep it, in what format, and when you're actually required to delete it again, is the part small employers get wrong most often, usually by hanging on to everything forever "to be safe," which creates a data protection problem of its own. This is a practical guide to what the file needs to contain, how long it sits there, and the follow-up checks that keep a time-limited right to work from quietly expiring without anyone noticing.
What a right to work check actually is
There are three ways to establish it, and which one applies depends on the person in front of you. A manual check means physically examining an original document from List A or List B in the person's presence, a British or Irish passport, a biometric residence permit, or similar, and satisfying yourself it's genuine and belongs to them. A Home Office online check uses a share code the worker generates themselves, which you enter on the government's checking service to see their current immigration status directly. A digital identity check, run through a certified Identity Service Provider, covers British and Irish passport holders (including an Irish passport card) who want to prove their identity digitally instead of in person.
Different route, same outcome required: a record that shows the check happened correctly, on the right date, before the person started work.
What you must actually keep
For a manual check, you need a copy of the document, not a note that says you looked at one. Hardcopy or scan, but if it's a scan it has to be in a format nobody can quietly edit afterwards, a PDF or a JPEG rather than something like a Word file. For a passport, that means the photo page and any page showing nationality, date of birth, signature, and immigration permission, including a visa or entry stamp if there is one. For most other List A/B documents, copy the whole thing, both sides.
Write the date you did the check somewhere on the record. Not the date the person started, the date you actually looked at the document and satisfied yourself it was genuine. A line as simple as "right to work check made: 12/08/2026" on the copy does the job.
For an online or digital check, the copy of a passport doesn't apply the same way, but the principle does. Save the confirmation the checking service gives you, the screen result or the downloadable PDF showing you ran the check and what it returned, along with the date. That confirmation is your record. Losing it is functionally the same as never having done the check.
How long, and what happens after
For the duration of someone's employment, plus two years after they leave, and then it gets securely destroyed. Not kept "just in case." Destroyed. That's the part people skip, because holding onto old files feels safer than deleting them, but data protection rules don't work that way, and a right to work file with nothing legally requiring it to still exist is exactly the kind of thing a GDPR complaint gets built around.
The reason the two-year figure matters as much as it does comes down to what the record is actually for: your statutory excuse against a civil penalty if it later turns out someone didn't have the right to work. Since 13 February 2024 those penalties have been steep, up to £45,000 per illegal worker for a first breach and up to £60,000 for a repeat one. A properly dated, correctly stored copy is the difference between a statutory excuse and a five-figure fine, and it needs to still be sitting there, findable, on the day someone from the Home Office asks for it, not reconstructed from memory afterwards.
Follow-up checks for time-limited permission
Not everyone's right to work is permanent. If the original check showed a visa, a BRP, or an eVisa share code with an expiry date attached, you're required to run a follow-up check on or before that date, not sometime after it lapses. Someone who was fully entitled to work in March can be working illegally in October if their permission ran out in between and nobody checked again.
If the first check confirmed indefinite leave to remain or settled status under the EU Settlement Scheme, you're done. No follow-up is needed because there's no expiry to track. The distinction matters because it changes what you actually have to monitor, and treating every worker the same, whether their permission is permanent or ticking down to a date, is how expiry dates get missed on the ones that actually needed watching.
A sticky note on someone's desk isn't a system. A spreadsheet nobody opens for months isn't much better. The businesses that get caught out aren't usually the ones with no process, they're the ones whose process depends on a specific person remembering, and that person moved on eight months ago.
Where this goes wrong in practice
Losing the paperwork after someone leaves quickly is the most common failure we hear about, especially on sites with a lot of short-term or agency labour, where someone can be on and off a job within weeks. If the record only ever lived on a manager's phone, it leaves with the manager's phone.
No date on the copy is the second. A passport scan with nothing written on it proves the document existed at some point, not that anyone checked it before the person started work, which is the entire legal requirement.
Keeping everything indefinitely is the third, and it's the mistake that looks the most responsible while being the least defensible. Two years after someone leaves, that file should not exist any more. Holding onto it past that point doesn't add protection, it adds exposure.
The fourth is treating a rota or a site induction sheet as if it were proof a check happened. It isn't. A rota shows who was meant to be on site. It says nothing about whether their right to work was verified, or when. Temporra doesn't build that rota or decide who's working when, that side of the job is still yours, the same as it's always been. Where it fits in is document management: it holds the right to work copy, the CSCS card, the certificate, whatever the site needs on file, flags when something's approaching its expiry date, and can hold clock-in for someone whose document has already lapsed rather than letting them start a shift on an expired check nobody noticed. For the day-to-day side of what a compliant hours record needs to capture, our guide on running payroll for a UK small business covers the piece that sits next to this one. Subcontractors bring their own verification questions too, covered in our CIS payroll guide. And if the working-hours side of compliance is the gap, our guide to the 48-hour week and rest breaks covers the other half of it.
Frequently asked questions
How long do I have to keep right to work check records?
For the whole time the person works for you, and then for a further two years after they leave. Once that two-year window closes, the copy should be securely destroyed rather than kept on file indefinitely.
What exactly counts as a valid copy?
Something that can't be manually altered afterwards. A hardcopy, or a scan saved as a PDF or JPEG, works. For a passport, the photo page plus any page showing nationality, date of birth, signature and immigration permission. For other List A or B documents, the whole thing, both sides.
Do I need to keep records for an online or digital check the same way?
Yes, in principle, even though there's no physical passport to copy. Save the confirmation the checking service produces, whether that's a screen result or a downloadable PDF, along with the date you ran it. That confirmation is your evidence the check took place.
What happens if someone's permission to work has an expiry date?
You need to run a follow-up check on or before that date. Miss it and the statutory excuse you had for that worker no longer applies from the point their permission lapsed, even if the original check was done correctly.
Do I have to check again for someone with indefinite leave to remain?
No. Once the initial check confirms indefinite leave to remain or settled status, there's nothing further to monitor, because there's no expiry date attached to it.
What's the actual penalty if I get this wrong?
Since 13 February 2024, civil penalties for employing someone without the right to work run up to £45,000 per illegal worker for a first breach and up to £60,000 for a repeat one. A correctly dated, properly stored check is what gives you a statutory excuse against that penalty.
Does this apply to short-term, casual or agency workers?
Yes. The requirement to check and keep a record applies to anyone you directly employ, however short the engagement, though the practical failure point tends to be worse here because short placements are exactly where paperwork gets lost between sites or managers.
We think we're missing records for someone who left years ago. What now?
If the two years since they left have already passed, you're not required to have kept anything, and there's nothing to reconstruct. If they left more recently than that, it's worth establishing whether a check was actually done at the time, because a genuine gap in your records is a bigger exposure than most employers realise until an inspection happens.
Related reading
- CIS Payroll for Construction: A Subcontractor Deductions Guide
- Working Time Regulations: The 48-Hour Week, Opt-Outs and Rest Breaks
- How to Run Payroll for a UK Small Business
Start a free 14-day trial · Book a demo
No card required. Flat monthly pricing by team size, every feature on every tier — see pricing.