Portuguese law does not set one retention period for “employment records”. It sets several, by record type: five years for recruitment files and working-time records, a much longer period for tax and accounting documents, and a data-protection duty to delete personal data once you no longer need it. This guide sorts the records into groups, gives the period and the legal anchor for each, and covers the related question of whether you need an employee handbook (you generally do not, but there are reasons to have one).
TL;DR
- Recruitment records (ads, applications, interview and selection-test results, broken down by sex) must be kept for five years.
- Working-time records (start, end and breaks) must be kept for five years under Article 202 of the Labor Code.
- Tax and accounting documents sit on a much longer clock, measured in civil years, so payroll documents that support them should be filed with the accounts.
- GDPR storage limitation still applies: keep personal data only as long as a legal duty or a real defense need justifies it.
- Portuguese law does not require an “employee handbook”. An internal regulation under Article 99 of the Labor Code is optional unless a collective agreement requires it.
Table of Contents
- Why there is no single retention period
- Retention periods at a glance
- Recruitment records: five years
- Working-time records: five years
- Payroll, tax and accounting documents
- Social security records and registration
- When the clock starts and what extends it
- GDPR limits: keep enough, not everything
- A retention schedule you can adopt
- Do you need an employee handbook in Portugal?
- Our perspective
- Let us run the paperwork
- FAQ
- Sources
Why there is no single retention period
An employer in Portugal answers to four overlapping regimes at once: the Labor Code and its related legislation, tax law, social security rules and the GDPR (with Portuguese Law 58/2019). Each one cares about a different slice of the personnel file. Labor rules want proof that you respected working time, equality and hiring rules. Tax law wants proof behind every payroll figure in the accounts. Data-protection law pushes the other way: it wants you to delete what you no longer need.
The practical consequence is that a personnel file should not be treated as one object with one expiry date. Split it into record groups, give each group an owner and a retention rule, and review them on a schedule. The sections below follow that approach.
If you employ people in Portugal through us as your Employer of Record, we keep this record structure on our side as the legal employer. If you employ directly, the table below is a good starting point for your own retention schedule.
Retention periods at a glance
| Record group | Typical contents | Retention period | Legal anchor |
|---|---|---|---|
| Recruitment | Job ads and invitations, applications, interview numbers, candidates awaiting admission, selection-test results by sex | 5 years | CITE guidance for employers |
| Working time | Start and end times, breaks | 5 years | Labor Code, Article 202 |
| Pay and benefits (defense of claims) | Payslips, pay history, benefit records | Between 1 year after termination and 5 years, depending on the claim | Abreu Advogados, Employment 2025 |
| Tax and accounting support | Books and the documents behind them | Civil years, see the section below | IRS Code, Article 118 |
| Monitoring data | Email and internet logs, call recordings | Set by purpose, and in CNPD cases as short as 90 days to 6 months | CNPD decisions, see below |
Treat the table as a map, not as a replacement for advice on your own situation. Collective agreements, sector rules and pending disputes can all extend a period.
Recruitment records: five years
The Commission for Equality in Labor and Employment (CITE) lists what employers must keep about a recruitment process, and the period is five years. The file covers the job invitations and advertisements, the applications, the interview numbers, the candidates awaiting admission and the results of selection tests, all broken down by sex.
The breakdown by sex is the detail teams miss. If you run hiring in a spreadsheet or an applicant tracking system that does not capture it, you cannot rebuild it later. Add the field now.
For a foreign company hiring a first employee, this means that even a single role needs a tidy recruitment folder. Keep the posting as published, the shortlist logic and the test results together, and set a deletion date five years out.
Working-time records: five years
Employers must record working time, including start and end times and breaks, and keep those records for five years under Article 202 of the Labor Code. These are the first documents a labor inspector asks for, because they show whether overtime, rest periods and exemption arrangements were respected.
Remote and hybrid teams do not escape this. If your staff in Portugal work flexible hours across time zones, you still need a reliable record per person. Our guide to working hours rules and ACT fines walks through what inspectors look for and how to build the checklist.
Payroll, tax and accounting documents
This is where periods get long, and where sources do not read identically. Article 118 of the IRS Code requires accounting books and related documents to be kept in good order for 10 civil years following the relevant period. A tax-authority guide for the restaurant sector refers instead to 12 civil years. The difference is a good reason to confirm the period that applies to your entity type and sector with your certified accountant (contabilista certificado) before you set a deletion rule.
What matters for HR is the principle: payroll runs, the supporting calculations, and the contracts and amendments that explain them are part of the evidence behind your accounts. Do not delete them on the shorter labor-records clock. Store them where finance can find them, indexed by period.
Two guides on our site help here: payroll documents in Portugal lists the documents a payroll file should contain, and tax compliance for employers covers the filings those documents support.
Social security records and registration
Employers must communicate each new hire to the Social Security portal by the start of the work contract, with exceptions for short-term or shift work, where communication up to 24 hours later is allowed. Missing the deadline can lead to fines, and failing to communicate within 6 months after the deadline can bring a prison term of up to 3 years or a penalty of up to 360 days.
Keep the proof of each submission with the personnel file. If Social Security cannot obtain data automatically or has doubts, it can ask you to supply it, and the deadline is 10 business days. Having the submission receipt, the contract and the identification data in one folder turns that request into a ten-minute job. If you have not yet registered as an employer, see our walkthrough on employer registration through Empresa Online.
When the clock starts and what extends it
Most periods run from the end of the relevant event, not from the date the record was created. In practice:
- Recruitment files: count from the end of the selection process.
- Working-time records: count from the period the record covers.
- Pay and benefit records: count from the end of the employment relationship when you are keeping them to defend a claim.
- Tax documents: count in civil years after the period they relate to.
On legal claims, Portuguese practitioners note that keeping salary and benefit records to defend a court claim can be justified for between one year after termination and five years, the upper figure matching the limitation period for employment-related administrative offenses. The reasoning matters more than the number: you keep a record because a defined claim could still be brought, and you delete it once that window closes.
Three events should pause deletion for the affected files: a labor inspection, a pending dispute with the employee, and a tax audit. Build a legal-hold step into your process so that nobody runs a clean-up job over records that are in play.
GDPR limits: keep enough, not everything
The Labor Code and the GDPR work together, with Portuguese Law 58/2019 as the national layer. The GDPR principles that matter most for retention are purpose limitation, storage limitation, and integrity and confidentiality. Employees must also receive privacy information and can access and correct their data, as summarized by Abreu Advogados.
In plain terms, every category of data in the file needs a stated reason and an end date. Once the legal period ends and no claim or audit is pending, delete it or anonymize it, and do so securely: encrypted storage during the period, restricted access, and a logged disposal at the end.
Sensitive data
Criminal-record data should be processed only in limited cases or where the role justifies it, and medical data is subject to GDPR and Labor Code restrictions, according to the same Abreu summary. Keep health information, such as sick-leave certificates, apart from the general personnel file and give access only to the people who need it. For a broader view of how regulators enforce the GDPR and what steps businesses can take, read this overview of GDPR fines and EDPB guidance.
Monitoring data: short periods
The national data protection authority (CNPD) has approved retention of monitoring data for short periods, tied to a purpose. In one 2015 authorization, email and internet-use data could be kept for 6 months for productivity management, and workers had to be informed beforehand of the internal regulation, the tolerance for private use and the consequences of misuse. In another, call recordings could be kept for 90 days as proof of commercial transactions, with workers informed and a signed document evidencing their information and acceptance.
These are decisions on specific companies, so read them as examples of how the CNPD reasons, not as general allowances. The same decision makes a point worth remembering: recording methods approved for one purpose cannot be used to monitor worker performance.
A retention schedule you can adopt
Follow these steps to turn the rules above into a working process:
- Inventory. List every place employee data lives: HR system, payroll provider, email, shared drives, time-tracking tools.
- Classify. Put each record into a group: recruitment, working time, pay and benefits, tax support, social security, health, monitoring.
- Assign a period and an owner. Use the table above, confirm tax periods with your accountant, and name one person responsible per group.
- Record the reason. Write one line per group on why you keep it and under which rule. It supports your GDPR documentation.
- Schedule deletion. Run a review at least once a year. Check for legal holds before deleting.
- Document disposal. Log what was destroyed, when and by whom.
If the thought of running this across a Portuguese team from abroad is heavy, that is exactly the work an EOR or a payroll provider takes over. See how an Employer of Record works in Portugal for what moves to the provider and what stays with you.
Do you need an employee handbook in Portugal?
Not generally. Article 99(1) of the Portuguese Labor Code says an employer may adopt internal regulations on work organization and discipline. The wording is permissive, and adoption becomes mandatory only for particular matters where a negotiated collective instrument requires it under Article 99(4). The law also does not require a document called an “employee handbook”.
That said, a handbook, or more precisely an internal regulation, is the cleanest way to put your rules in one place. Some things must reach employees anyway, and a handbook is a convenient vehicle.
What the law says you must communicate
- Equality and non-discrimination. Employers must display information on employees’ equality and non-discrimination rights, including parentality rights. You can post the legislation on parental rights or include it in an Article 99 internal regulation.
- Contract information. Article 106 requires you to inform each worker about your identity, the workplace, the role, contract dates and term where relevant, holidays, notice for termination, pay, working time, accident-insurance details, the applicable collective agreement, the compensation-fund identification, probation and continuous training, as summarized by AICCOPN.
What to put in it
The Directorate-General for Economic Activities recommends that a code of ethics and conduct cover scope, expected conduct, harassment, discrimination, conflicts of interest, confidentiality, fraud and corruption, health and safety, violence, document retention and use of organizational resources. It also advises clear language, formal approval, dissemination, an explanatory session, reporting channels and a review after significant changes. Add your retention policy and your monitoring rules, since employees must be informed of both.
How to adopt it correctly
If you do adopt an internal regulation, two steps are not optional. Article 99(2) requires consultation with the works council or, where there is none, the inter-union committee, union committees or union delegates. And the regulation takes effect only after its contents are publicized, for example by posting them at the company headquarters and workplaces, so that employees can know them at all times. Breaching the consultation or publicity duties is a serious administrative offense under Article 99(5).
For a remote team, posting at headquarters is awkward. Ask your Portuguese counsel or EOR how to publicize the text in a way that meets the rule for staff who never visit an office.
Our perspective
Most record problems we see are not about a missing document. They are about documents spread across a founder’s inbox, a foreign HQ drive and a payroll spreadsheet, with nobody able to say which version is the official one.
Our view is that retention should be designed at hiring, not discovered at an inspection. When we act as the Portuguese employer of record, the contract, the social security registration, the working-time records and the payroll files are created in Portuguese compliance format from day one and stored in one place. That is the practical advantage of working with a specialist in Portuguese employment law: the five-year and tax periods are built into the process, and the deletion step happens on schedule instead of never.
If you employ directly, start with the schedule above and ask your accountant to confirm the tax periods. If you would rather not carry the burden, that is what we are here for.
Paulo
Let us run the paperwork
If you are hiring in Portugal without a local entity, our Employer of Record service makes us the legal employer: we handle contracts, social security registration, payroll and the compliance records that go with them, with English-speaking support. If you already have staff and only need the payroll side, see our payroll services in Portugal.
Tell us how many people you plan to hire and in which roles, and we will show you which records we hold and which stay with you.
FAQ
How long must I keep an employee’s records after they leave?
There is no single answer. Working-time records and recruitment files are kept for five years. Pay and benefit records kept to defend a claim can be justified for between one and five years after termination. Tax-supporting payroll documents follow the longer civil-year periods, so confirm the exact figure with your accountant.
Can I keep everything for the longest period to be safe?
No. The GDPR’s storage limitation principle means each category of data needs a purpose and an end date. Keeping a candidate’s file or an ex-employee’s health data longer than any rule or claim requires is itself a compliance risk. Group your records, apply the right period to each, and delete on schedule.
Is an employee handbook mandatory in Portugal?
No, not generally. Article 99 of the Labor Code lets you adopt internal regulations but does not oblige you to, unless a collective agreement requires it for specific matters. If you adopt one, you must consult employee representatives and publicize it, or it does not take effect.
Do these rules apply if I hire through an Employer of Record?
The Portuguese legal employer carries the statutory duties, so the EOR keeps the employment records for its employees in Portugal. You will still hold your own records about the work itself, such as performance notes and access logs, and the GDPR applies to those too.
Sources
- CITE: Rights and duties of employers
- AICCOPN: Working time records
- Portal das Finanças: IRS Code, Article 118
- DGAE: Good tax practice guide for the restaurant sector
- Abreu Advogados: Employment in Portugal 2025
- CNPD: Authorization 275/2015
- CNPD: Call recording authorization
- Diário da República: Labor Code
- AICCOPN: Information employers must give workers
- DGAE: Codes of conduct and ethics
- Segurança Social: Employer communication of new hires
- Segurança Social: Registration data changes