Could you please advise how long an employer may hold a medical cert on an employee’s file?

A medical certificate is likely to contain sensitive personal data of an individual under the Data Protection Acts 1988 and 2003 (“DPA”). As such, it is important that it be held on the employee’s file for no longer than is strictly necessary for the legitimate purpose(s). Any retention must be justified in accordance with the DPA.

There is no exact length of time for which such data should be retained and the length of the retention will depend on the particular purpose(s) for which it is kept. For example, the employer’s reasonable need to monitor levels of absenteeism throughout a calendar year, or where it is necessary to prevent injury or other damage to the health of the employee, or