Personnel File

What belongs in a personnel file

• Application or resume, and the signed offer letter or employment contract
• Job description and history of titles, departments, locations and managers
• Pay history: starting rate, raises, promotions, bonus letters
• Form W-4 and state withholding forms (sometimes kept with payroll records instead)
• Handbook and policy acknowledgments
• Performance reviews, goals and improvement plans
• Training and certification records
• Commendations and recognition
• Disciplinary records and the employee's written responses
• Leave approvals (not the medical details)
• Separation records: resignation letter or termination notice, final pay, exit documents

Keep what supports employment decisions; avoid manager notes that wander into personal opinion or life outside work.

What to keep separately

Several record types should be stored outside the main personnel file, with tighter access:

• Medical information: The ADA requires employers to keep medical information about employees and applicants, including doctor's notes, accommodation documentation and medical exam results, confidential and in separate files. FMLA medical certifications and GINA-covered genetic information are treated the same way.
• Form I-9s: kept together in a separate file or system so a government inspection doesn't expose unrelated records, and so they're not used in other decisions.
• Workplace investigation files: complaint, interview notes, evidence.
• Background check reports.
• Voluntary self-identification data (race, ethnicity, sex, veteran and disability status) used for EEO reporting, which must not be available to decision-makers.
• Benefits enrollment and beneficiary records.

Most employers now keep all of these in an HRIS or document system with role-based permissions rather than paper folders.

Employee access rights

There's no general federal right for private-sector employees to see their personnel file, but many states provide one. California gives current and former employees the right to inspect their personnel records within 30 days of a written request. Illinois's Personnel Record Review Act gives employees access and the right to submit a rebuttal of disputed information. Massachusetts requires employers to provide access and to notify employees within 10 days of placing negative information in the file. Other states, including Connecticut, Michigan, Oregon and Washington, have their own rules. Union contracts often add access rights. Rules vary by state, so set an access procedure that meets the strictest state where you employ people.

In the EU and UK, employees can request their personal data, including much of their personnel file, through a data subject access request under the GDPR.

HR record retention periods

Common US federal minimums (state law may require longer):

• Hiring and personnel records (applications, promotion, discipline, termination): at least 1 year from the record or action under EEOC regulations, and longer if a charge is filed.
• Payroll records under the FLSA: 3 years; supporting time cards and wage rate tables: 2 years.
• Form I-9: the later of 3 years after hire or 1 year after termination (see the formula above).
• FMLA records: 3 years.
• OSHA injury and illness logs: 5 years.
• Records of exposure to toxic substances: duration of employment plus 30 years.

Federal contractors have additional OFCCP rules. Many employers simply keep core personnel files for several years after separation to cover state statutes of limitations. Applicant data follows its own schedule; see candidate data retention.

Good practice for HR teams

• Define what goes in each file type, and train managers on it.
• Limit access by role: managers see performance records for their team, not medical or benefits data.
• Log who accessed or changed records.
• Set retention schedules and actually delete records when they expire, unless a legal hold applies.
• Audit a sample of files every year. A regular HR audit usually finds missing acknowledgments, I-9 errors and medical documents in the wrong place.

In high-volume, high-turnover operations, the number of files grows quickly. A 1,000-employee contact center with 60% annual turnover creates around 600 separated-employee files a year, all with different retention end dates. Automating retention and deletion by record type is the only practical approach at that scale.