Differences in China’s legislative approach to HR document retention carry complexities for employers

To better understand their compliance responsibilities relating to the retention of employees’ personal data, employers must consider both the Personal Data Protection Law, and the Document Archiving Law, along with other special legislation relating to document retention. Each law varies in its approach to document retention periods.

Personal Data Protection Law

Under China’s Personal Data Protection Law, the retention period for personal data should be the minimum duration necessary to fulfil the purpose of data processing, unless “other laws or administrative regulations” specify otherwise.

The entity processing the data – which includes employers collecting and processing employees’ personal data in relation to their employment - is required to proactively delete the personal data in situations where the purpose of data processing has been fulfilled, where the purpose of data processing cannot be fulfilled, or where the data is no longer required for the purpose of data processing.

In general, the retention period of personal data should be the shortest time necessary to achieve the purpose of processing.

If the retention period specified by laws or administrative regulations has not yet expired, or if it is technically challenging to delete the personal data, the data processor should stop processing the data, except for storing and safeguarding it to prevent a data breach.

Government Archiving Rules

The Archives Law of the People’s Republic of China imposes a general requirement for enterprises to retain their documents. To enforce this requirement, the government has established guidelines specifying the respective retention period for various types of enterprise documents, also known as the Government Archiving Rules.

These rules specify the minimum periods that an enterprise is required to retain different types of HR documents. The Government Archiving Rules categorise HR documents and prescribe different retention periods for each category. Depending on the category, the documents may need to be retained for 10 years, 30 years, or indefinitely.

It should be noted that the statutory archiving requirements for documents and information extend far beyond the Government Archiving Rules. There are specific requirements for the minimum retention periods for certain types of documents and information in specific sectors, such as accounting and financial documents.

Differences in retention period requirements

A conflict appears to exist between the principle of minimum retention duration, as set out in the Personal Data Protection Law, and the requirement for a longer or indefinite retention period set out in the Government Archiving Rules - and there is no legislation currently in place to address this conflict.

Academics have differing views regarding how to interpret this conflict. There is no consistent viewpoint on whether the Government Archiving Rules fall within the scope of ‘other laws and administrative regulations’ as mentioned in the Personal Data Protection Law, and whether these rules could be considered an exceptional case to the minimum period requirements under the Personal Data Protection Law.

Some say that employers need to comply with the Government Archiving Rules to fulfil their legal obligations. This compliance could provide a legal basis for processing personal data under the Personal Data Protection Law. However, this viewpoint needs confirmation from via further legislative developments and updates in practice.

The current ambiguity poses challenges for employers when determining the retention period for specific HR documents or data.

Making decisions on the retention or deletion of HR documents

When making decisions on the retention or deletion of HR documents, employers are recommended to differentiate between personal data that is subject to statutory archiving requirements and personal data that falls outside the scope of statutory archiving requirements.

Personal data subject to statutory archiving and retention requirements

For documents that fall under a longer or indefinite retention period as set out in the Government Archiving Rules and other specific laws and regulations relating to document retention, it is generally recommended that employers follow the requirements set out by the Government Archiving Rules and other specialised legislations.

This is seen as a prudent approach, however, some uncertainty will remain as local government departments or courts may adopt a different perspective when a dispute arises in a specific case regarding this matter.

Personal data falling outside the scope of statutory archiving and retention requirements

If the personal data collected from an employee does not fall within the archiving requirements set out by the Government Archiving Rules and other specific laws and regulations addressing document retention, it is generally recommended that such data be deleted once its purpose is fulfilled, as outlined in the Personal Data Protection Law.

This situation raises the question of how to define ‘purpose’ and when the ‘fulfilment of purpose’ is considered to have been achieved. However, in the context of managing employee data, the current Personal Data Protection Law does not provide unequivocal answers to these questions. It is anticipated that additional guidelines could be issued to help determine the exact moment and conditions under which the ‘fulfilment of purpose’ is deemed to have been achieved, to provide greater clarity for employers when determining the retention period for specific HR documents or data.

At present, a common viewpoint is that when an employer collects and processes the personal data from an employee to fulfil an employment contract, the completion of the contract could be considered a fulfilment of purpose. This is often associated with a specific period following the termination of the employment contract. Given the potential high burden of proof on the employer in a dispute with its employees, either for employment or data rights infringement, employers are generally advised to consider the statute of limitations for a dispute or the time needed for a dispute resolution when deciding on the retention or deletion of specific information or documents.

This advice stands despite the current lack of clear interpretation under China’s data protection law.

Measures to lessen employers’ potential risks

To lessen the risk of uncertainty around employers’ obligations in this area, it is advised that employers implement practices that confine the purpose, scope, and method of processing employees’ personal data during the extended retention period. Employers should also obtain the employees’ consent in this context.

The exact retention period and deletion time for specific information should be assessed and determined based on factors that include, but are not limited to, the specific type of information involved, the circumstances under which the information is collected, the purpose for collecting such information, and whether the employee’s consent has been obtained. 

As the evolution of personal data protection legislation in China continues to progress rapidly, it is recommended that all employers keep a close watch on these developments. Future changes in legislation and practice may resolve the current inconsistencies and ambiguities, which could significantly impact an employer’s decision on whether to retain or delete a document.