My previous employer had a data breach
<p>It seems my bank account details. Passport information. Address etc have been leaked. I left the company 3 years and 4 months ago.</p>
<p>It’s a private law firm. They have offered me a 12 month credit reference account and told me to keep an eye on my bank account for 12 months.</p>
<p>My question is, can they keep my details such as my bank account details when I left the business over 3 years ago. I understand businesses can keep records for 6 years. But I thought only PLC did this and private owned companies was 3 years?</p>

<h2>The should delete your data as soon as it is no longer needed</h2>
<p>Different data will be needed for different periods of time. For example:</p>
<ul>
<li>Your name and your period of service may need to be kept indefinitely in case you need to claim compensation (e.g. for asbestos related diseases) many years later.</li>
<li>Your pay and tax records need to be kept as long as the relevant tax authority mandates - usually this is as far back as the tax office can audit.</li>
<li>Your bank and passport details are probably not required for long after your final payment was made.</li>
</ul>
<p>The practical problem is that all of this information is likely scattered across paper files and several databases that were set up before GDPR was a “thing” and therefore don’t make it easy to selectively delete such information. However, just because complying with the law is hard doesn’t mean you don’t have to do it.</p>
<p>To protect yourself, change your bank accounts. Credit reporting is great for finding out you’ve been robbed - making information useless for robbing you in advance is better.</p>

gdpr data