Digital personnel files: access, retention, evidence

Retention periods are the part of the personnel file that is easiest to evidence and most often treated in the round. The rule of thumb "ten years, then delete" fits none of the sections. For the payroll account the statute says: payroll accounts must be kept until the end of the sixth calendar year following the wage payment last recorded (Income Tax Act). Payroll records for social security must be kept for each employee, separated by calendar year, and stored in order until the end of the calendar year following the last audit (Social Code Book IV) - so this period has no fixed end at all but hangs on the audit cycle. Working-time records must be kept for at least two years from the relevant reference date for the record - but this duty does not apply to every company: it falls on employers who employ people on a marginal basis under section 8 subsection 1 of Social Code Book IV or in the economic sectors and branches named in section 2a of the Act to Combat Undeclared Work; it does not apply to employment relationships under section 8a of Social Code Book IV (Minimum Wage Act). Applying the two years across every personnel file therefore borrows a period from a scope narrower than the actual record; as a uniform house rule that can make sense, but as a legal duty it then needs a different basis.

One uncomfortable consequence follows from that table: the file as a whole has no deletion date. Applying the longest period to the entire record keeps data longer than the purpose carries - and that runs against storage limitation, under which personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed (General Data Protection Regulation). Applying the shortest period instead loses documents an audit would still like to see. The archive therefore needs sections, and each section carries its own period - technically the same approach as with any other record bound by retention rules (see Meeting retention periods digitally).

One section deserves particular attention because it usually arises outside the personnel file and still belongs to it: the working-time record. It accrues daily, it must be kept for at least two years wherever the recording duty under the Minimum Wage Act applies, and it is one of the few sets of personnel data generated continuously by machine. Where time tracking has a system of its own, the personnel file ends at that boundary - the retention period applies all the same, and the question of access arises there a second time (see Digital time tracking 2026: implementing the mandate).

A log answers two different questions, and they are easily blurred. The first is accountability: can the company show that it has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk (General Data Protection Regulation)? For that it is enough that accesses are recorded and can be evaluated. The second is investigation: who opened the written warning on 14 March? That needs individual records - and those are exactly what turns the log itself into a record about employees.

A usable log entry contains four items and no more: the account, the timestamp, the document or section concerned, and the type of access - read, change, export, delete. Reading time, scrolling behaviour and screen time are not logged; such data answers neither of the two questions and pushes the log towards behavioural monitoring. Export deserves a line of its own, because it is the point at which data leaves the application and lands in a place where the matrix no longer applies.

The log itself needs a purpose, a retention period and a narrow group of readers. A few months for fault analysis is common, and anything longer only where there is a concrete, recorded occasion. Keeping the log indefinitely misses storage limitation at precisely the point where it was meant to be enforced - the same logic as for any other processing activity (see Data protection when digitising processes).

Who may evaluate the log and on what occasion is not a technical question but an agreement. A four-eyes rule works well: HR management requests the evaluation, it is approved together with the employee representatives, and the result is recorded. That gives the case the same shape as any other approval in the company - with a requester, a deadline, a deputy and a record (see Digitising approval workflows).

Part of what accrues in an HR department is subject to a stricter standard. Processing of personal data revealing, among other things, religious or philosophical beliefs or trade union membership, as well as the processing of data concerning health, is prohibited (General Data Protection Regulation) unless an exception applies. For the employment relationship the Federal Data Protection Act names such an exception: processing special categories is permitted where it is necessary to exercise rights or comply with legal obligations derived from labour law, social security law and social protection law, and where there is no reason to believe that the data subject's legitimate interest in excluding the processing prevails (Federal Data Protection Act).

For the archive this results in no list of prohibitions but in a separation. Records from workplace reintegration management, information about a severe disability, occupational health certificates and comparable documents sit in a section of their own with a named group of individuals - typically HR management and one named deputy, not the whole administration team. Technically that is no special case but the same matrix as above, only with a row that holds a dash almost everywhere. Organisationally it is the point where it becomes clear whether the matrix is lived or merely written.

The application section is the special case with the shortest deadline. A claim under the General Equal Treatment Act must be asserted in writing within a period of two months, and in the case of an application that period starts with receipt of the rejection (General Equal Treatment Act). That produces no automatic deletion date, but it does give a reference point: once the deadline and a reasonable time for further steps have passed, the purpose for which the documents were held falls away. Where an application leads to a hire, the documents move into the contract section - and there the next chain begins, from the signed contract to the written statement of essential terms, which may be drawn up in text form and transmitted electronically provided the document is accessible to the employee, can be stored and printed, and the employer asks for confirmation of receipt on transmission (Act on Proof of Essential Conditions); on the question of form see Electronic signatures: which form is legally valid.

The changeover rarely fails at the scanning. It fails because a paper folder has no sections, so the structure has to be decided for the first time during digitisation - for every case already on file. Making that decision while scanning means making it under time pressure and afresh for every sheet. The following order separates the decisions from the bulk work:

The time required is distributed differently from what people expect. The bulk work - reviewing, scanning, classifying - is plannable and can be sped up with extra hands. The decisions from steps 1, 4 and 5 cannot be sped up, because several parties hang on them and every round of coordination has its own rhythm. Setting the changeover date by scanning capacity means moving it twice, in our experience; setting it by the conclusion of the works agreement means meeting it.