Keep each employee's contract, every payslip and payroll register, and the proof of every tax and pension payment for at least as long as someone could reasonably query it. Many advisers use six years as a working minimum for payroll and tax records. We cannot point you to a single section that sets that figure for every record, so treat it as practice and confirm the period with your state IRS or accountant. Pension and contract records should be kept longer, because an employee can raise a missing contribution years after leaving.
- The three sets of records every employer needs: employee, payroll and statutory
- A retention table with the reason for each period
- A folder structure that works for paper and digital files
- Who should see what, and how to dispose of old files
Why payroll records matter
A tax officer, a PenCom inspector, a labour officer or a former employee will eventually ask a question that only a record can answer. If you can produce the contract, the payslips and the payment receipts within an hour, a query stays small. If the evidence sits in a personal phone or a storeroom box, it grows. Under the Nigeria Tax Administration Act 2025 (s.34), the tax authority can raise an administrative assessment from the records it has when yours are missing, so what you cannot show is what you may be assessed on. Our guide to preparing for a payroll tax audit shows what an officer usually asks for first.
What to keep for each employee
Start with the personnel file. The signed contract and any variation matter most, so see employment contract essentials for what a good one contains. Keep these in the file:
- Offer letter, signed contract and written statement of terms (the Labour Act expects this within 3 months of starting)
- Identity, address, next of kin, tax ID, RSA PIN and the name of the PFA, and bank details
- Probation and confirmation letters, pay changes and promotions
- Leave records, including sick and maternity leave
- Warnings and disciplinary records
- Resignation or termination letter and the final settlement
Payroll and statutory records
The monthly register shows gross pay, each deduction and net pay for every person. Keep it with the payslips as issued, approvals for any overtime, bonus or allowance, and loan agreements with their running balance. If an employee claims rent relief, keep the tenancy agreement and rent receipts they gave you, since relief applies only to rent actually paid (20% of annual rent, up to ₦500,000). Our article on claiming rent relief explains the evidence.
Then the remittance proof, kept by authority:
- PAYE schedules and payment receipts, and the annual return. See Form H1 and the 31 January filing.
- Pension schedules, bank evidence and the PFA acknowledgement for each month
- NSITF and ITF payment evidence, and NHF evidence where an employee has opted in
- Group life policy documents and renewal receipts
- Every letter, query or assessment from an authority, with your reply
How long to keep each record
The table gives a practical minimum. These are working rules, not statutory periods, except where a law says otherwise.
| Record | Keep for | Reason |
|---|---|---|
| Payroll registers and payslips | At least 6 years | Tax audits and wage claims can reach back several years |
| Tax returns and payment receipts | At least 6 years after the period | Common advice for tax evidence; confirm with your state IRS |
| Pension schedules and receipts | Whole employment plus several years | Missing contributions can be claimed long after exit |
| Contracts and variations | Whole employment plus several years | Disputes about terms often start after exit |
| Disciplinary records | Several years after exit, longer for dismissals | May be needed if the National Industrial Court hears a claim |
| CVs of unsuccessful candidates | Short, set by your policy | Data protection favours minimal retention |
There is a tension here. The Nigeria Data Protection Act 2023 expects you to keep personal data no longer than you need it. Write the retention period for each record type into a short policy and follow it. Employee data protection under the NDPA explains how to justify the periods you choose.
A folder structure that works
Use the same structure on paper and on a shared drive.
- Employee folders. One per person, with sub-folders for contract, identity, pay changes, leave, performance and exit.
- Monthly payroll folders. One per month: register, payslips, approvals, bank file and the bank's confirmation.
- Statutory folders. One per authority (PAYE, pension, NSITF, ITF), then by year.
- Company folders. Insurance policies, handbook versions and signed policies.
Name files the same way every time: year, month, document, person, for example 2026-10_PAYE-receipt. A monthly check that the register total agrees with the bank file takes minutes, and our monthly payroll reconciliation checklist gives the steps.
Storage, backup and disposal
Digital is easier to search and back up. Paper originals still matter for signed documents, so scan them and lock the originals away. Keep backups in two places, for example a cloud drive and an external disk kept off site, and restore one file every quarter to prove the backup works. A backup you have never restored is a hope, not a backup.
Disposal. When the retention period ends, shred paper and delete digital copies, including backups where practical. Write each disposal in a log with the date and a description. Never destroy anything connected to a pending query, dispute or investigation, even if the normal period has passed.
Who should see what
Payroll files hold salaries, bank details and family information. Three levels work for most small businesses.
Payroll officers see pay, deductions and bank details for the people they process. Line managers see leave balances and contract dates for their own team, not salaries or bank details. Owners and directors see summary reports and can open any file. Review the list when someone changes role and remove access on the day a person leaves. Limiting access also limits leaks, and it is the best defence against payroll fraud and ghost workers, because no single person can both create a name and approve its pay. Do not share payroll files over personal messaging apps.
The yearly audit pack
At each year end, put together one pack: the 12 registers, the statutory returns and receipts, the reconciliation to your accounts, and a one-page note of how you run payroll. If an officer asks for 2025 PAYE evidence, you send the pack in an afternoon. The same pack feeds your annual payroll audit checklist.
Common questions
Are bank statements enough?
No. They show what was paid, not how it was calculated or what each employee was owed.
Can I keep phone photos of documents?
For convenience, yes, but clear scans with consistent names are better, and keep the originals of signed documents.
Who is responsible if a provider keeps the records?
You are. If you outsource, make sure the agreement lets you retrieve everything if the relationship ends. See when payroll outsourcing makes sense.
