It seems my bank account details. Passport information. Address etc have been leaked. I left the company 3 years and 4 months ago.

It’s a private law firm. They have offered me a 12 month credit reference account and told me to keep an eye on my bank account for 12 months.

My question is, can they keep my details such as my bank account details when I left the business over 3 years ago. I understand businesses can keep records for 6 years. But I thought only PLC did this and private owned companies was 3 years?

  • In what country is your former employer located? In what country are you located? what is "PLC"? May 5, 2022 at 22:49

1 Answer 1


The should delete your data as soon as it is no longer needed

Different data will be needed for different periods of time. For example:

  • Your name and your period of service may need to be kept indefinitely in case you need to claim compensation (e.g. for asbestos related diseases) many years later.
  • Your pay and tax records need to be kept as long as the relevant tax authority mandates - usually this is as far back as the tax office can audit.
  • Your bank and passport details are probably not required for long after your final payment was made.

The practical problem is that all of this information is likely scattered across paper files and several databases that were set up before GDPR was a “thing” and therefore don’t make it easy to selectively delete such information. However, just because complying with the law is hard doesn’t mean you don’t have to do it.

To protect yourself, change your bank accounts. Credit reporting is great for finding out you’ve been robbed - making information useless for robbing you in advance is better.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .