Digital Employee Records: Structure, Retention, Access
Short answer: Digital employee records replace the paper personnel file with a structured, access-controlled store inside your HR system. Keep only what the employment relationship needs, give every document type a retention period based on the law that requires it, and limit access by role. Periods run from one year for some US hiring records to eight years for German payroll vouchers.
The personnel file is an odd thing. Few laws say you must keep one, and none defines what goes in. Yet almost every company has a cabinet of folders where employment contracts sit next to a holiday form from 2014 and a copy of a driving licence nobody needs any more. That content is the real problem when you go digital. Scan the folder as it stands and you get the same mess, now searchable.
What belongs in an employee file
Data protection sets the yardstick. Keep what you need to run or end the employment relationship, and nothing else. A structure that works is six to eight sections with identical names in every file.
| Section | Typical content | Leave out |
|---|---|---|
| Contract | Contract, amendments, written statement of terms | Drafts, outdated versions |
| Personal | Contact details, tax and social security numbers, bank details | ID copies with no reason to keep them |
| Pay | Salary changes, bonuses, deductions | Full payslips (they live in payroll) |
| Absence | Holiday, sickness dates, parental leave | Diagnoses, medical reports |
| Qualifications | Certificates, training records, licences | School grades unrelated to the job |
| Reviews | Objectives, review notes | A manager’s private notes |
| Conduct | Warnings, employee responses | Rumours, unverified complaints |
| Right to work | UK right-to-work check copy, US Form I-9 (kept separately) | Documents beyond what the check requires |
Health data needs its own line. GDPR treats it as a special category, so medical reports and occupational health records belong in a separate file with tighter access.
In the US, Forms I-9 are commonly stored apart from the main personnel file. That makes it easier to hand them over in an inspection without exposing everything else.
How long to keep what
This is where most personnel files fail. Each document type has its own legal basis and its own clock. The figure shows selected periods across three countries.
Start dates differ: end of tax year, date of record, termination or last entry. Check each rule's trigger before setting deletion dates.
Source: 29 CFR 1602.14 and 516.5; IRS employment tax guidance; HMRC PAYE record-keeping; Limitation Act 1980; German § 147 AO, § 41 EStG, § 16 ArbZG
US Form I-9 has its own formula: keep it for three years after the date of hire or one year after employment ends, whichever is later. Under federal rules, records relating to a discrimination charge must be kept until the matter is resolved, even if the normal period has passed.
The contract itself has no statutory retention period in most places. Employers keep it for the limitation period for claims: six years for contract claims in England and Wales, three years under Germany’s general rule. After that, it can go, unless it is needed for pension queries or ongoing disputes.
Digital records shine here. Each document type gets a deletion rule when it is uploaded, and the system reminds you or deletes on schedule. For a structured approach to deletion schedules, the German standard DIN 66398 offers a useful method that works outside Germany too.
Scanning and what happens to paper
UK and US regulators generally accept scanned records if they are complete, legible and can be produced on request. Germany allows scanned tax records if the procedure is documented and meets its bookkeeping rules. The BSI technical guideline TR-03138, known as TR-RESISCAN, describes what such a procedure should look like.
Employment law adds a twist in Germany. Dismissals, fixed-term clauses and termination agreements require a handwritten signature on paper. In court, the paper original proves the form was met. A scan is just a visual copy the judge weighs freely. If you have German employees, keep those originals in a small paper archive and scan everything else.
Who gets access
Employees can request their personal data under GDPR and UK GDPR, and you usually have one month to respond. That covers more than the formal file: emails about them, notes in HR systems, review comments. Some US states add specific inspection rights. California, for example, requires employers to let current and former employees inspect their personnel records within 30 days of a request.
Internally, access follows need. HR and payroll see almost everything. Line managers see objectives and absence dates, not bank details or wage deductions. Senior leadership gets access case by case, not by default. A good system enforces this with roles and logs who opened which document.
Those logs matter to works councils in Germany. A system that records access and makes HR staff activity visible counts as a monitoring tool, so the works council must agree to it. See works councils and IT systems.
What the software needs to do
The shortlist is shorter than vendors suggest. Many HR suites include a records module that is enough for small and mid-sized firms. What matters:
- Permissions by section, not just by whole file
- Deletion rules per document type, triggered by events such as termination
- An access log that is only reviewed for justified reasons
- Full export of one person’s file for access requests
- Full-text search, including scanned PDFs
- Hosting that fits your data protection obligations, plus a processing agreement
Electronic signature is nice to have. So is a review workflow. Neither justifies choosing a weaker system.
After someone leaves
The file doesn’t end on the last working day. It changes state. The line manager loses access at once. HR and payroll keep it while retention periods run. Each document type then follows its own clock: review notes can go soon, the contract stays for the limitation period, payroll records for as long as tax law requires.
References are a special case. Former employees sometimes ask for a copy years later. Keeping the reference itself beyond the limitation period is defensible, as long as only the reference survives and not the whole file.
Rolling it out
- Define sectionsOne structure for every file, with a retention rule per document type.
- Pick the systemHR suite with a records module, or document management with role-based access.
- Data protection and works councilUpdate your records of processing; agree a works council deal where needed.
- Clean up firstRemove what should already have been deleted before you scan anything.
- Scan and checkFollow a documented procedure; archive wet-ink originals where the law needs them.
Stage four takes the longest and pays back the most. Teams that sort first often scan only half of what they started with. From a cut-off date, new documents go straight into the digital file. That is easiest when processes such as onboarding already run digitally, see HR process automation and the employee onboarding checklist.
If you need to bring HR data from several systems together with stricter access control and logging than standard products offer, a studio like OnlineBuilders can help with the architecture.
Your next step: pull three random files from the cabinet and sort them using the sections in the table above. Note what you should have deleted already. That number is the best argument for the project.
Questions people ask
Is it legal to keep employee records only in digital form?
In most cases, yes. UK and US rules generally accept electronic records if they are complete, legible and retrievable. Germany allows scanning tax records under a documented procedure, but wet-ink originals of dismissals and fixed-term clauses are best kept on paper because a scan carries less weight in court.
How long should I keep a former employee's file?
It depends on the document. Payroll and tax records follow tax law, typically three to eight years depending on the country. Contracts are often kept for the limitation period for claims, which is six years in England and Wales and three years in Germany.
Can employees see their own personnel file?
Under GDPR and UK GDPR, employees can request a copy of their personal data and you usually have one month to respond. Some US states, such as California, give employees a specific right to inspect their personnel file within set deadlines.
Should sick notes go into the employee file?
Absence dates, yes. Diagnoses and medical reports, no. Health data is a special category under GDPR and belongs in a separate, more restricted record.
_at_the_Herbert.jpg){kind=link}