The should delete your data as soon as it is no longer needed
Different data will be needed for different periods of time. For example:
- Your name and your period of service may need to be kept indefinitely in case you need to claim compensation (e.g. for asbestos related diseases) many years later.
- Your pay and tax records need to be kept as long as the relevant tax authority mandates - usually this is as far back as the tax office can audit.
- Your bank and passport details are probably not required for long after your final payment was made.
The practical problem is that all of this information is likely scattered across paper files and several databases that were set up before GDPR was a “thing” and therefore don’t make it easy to selectively delete such information. However, just because complying with the law is hard doesn’t mean you don’t have to do it.
To protect yourself, change your bank accounts. Credit reporting is great for finding out you’ve been robbed - making information useless for robbing you in advance is better.
