What Employee Info Can You Collect in Personnel Files?

What is an employee personnel file?

An employee personnel file is a centralized record of documents related to a specific worker. It includes information that employers are legally required to maintain, as well as other records that support day-to-day management and compliance.

Damien Weinstein, co-founder and managing partner at Weinstein & Klein, noted that personnel files should tell a clear, cohesive story about an employee’s role and performance within the organization. “You should be able to read a personnel file and have a pretty accurate view into who the employee is, what they do at the company and how they are performing,” Weinstein explained.

Storing and accessing personnel files

For years, many employers kept personnel files in locked filing cabinets. Physical storage can still work when it’s done carefully, but it leaves records vulnerable to things like fire, water damage or unauthorized access. Today, many businesses rely on the best HR software to store employee records securely in the cloud, where files benefit from cloud encryption and can be backed up with access limited to authorized users.

How long you keep personnel records matters just as much as how you store them. Federal and state laws set minimum retention requirements for certain documents. For example, the Fair Labor Standards Act (FLSA) requires employers to keep payroll records for at least three years. Other records, such as tax and hiring documents, are governed by different timelines depending on the law that applies. Because these requirements can overlap, employers should establish a record-retention policy that accounts for the federal, state and local laws that apply to their business and each type of employee record.

Even when formal audits aren’t legally required, it’s smart to review personnel files on a regular basis. An annual check can help ensure records are accurate, complete and stored appropriately and can surface issues before they turn into compliance problems or employee disputes.

What should be included in a personnel file?

Personnel files can contain a wide range of employee information, but not all documents should be stored together. Some records are routine and job-related, while others are highly sensitive and subject to stricter access rules.

To keep information organized and reduce risk, Nicole Anderson, founder and CEO of the HR solutions firm MEND, recommends separating employee records into three distinct files: an employee file, a confidential file and a separate I-9 file.

Employee file

The employee file should contain documents related to an employee’s role, performance and day-to-day employment history. According to Anderson, this general file typically includes:

• New-hire checklist
• Job application
• Resume
• Job description (and acceptance)
• Offer letter
• Employment contract
• Job references and reference check forms
• Receipt of company property
• Confidentiality agreement (such as a nondisclosure agreement)
• Remote work plans or telecommuting agreements
• Signed acknowledgments, such as the employee handbook and company policies and procedures
• Training documents and acknowledgments
• Past performance evaluations
• Employee performance improvement plans or enhancement forms
• Records of corrective or disciplinary actions

Confidential file

The confidential file should be reserved for highly sensitive employee information and stored separately from general personnel records. Access to this file should be tightly restricted and limited to designated individuals who need the information for compliance or administrative purposes.

As Anderson explained, a confidential file typically includes documents such as:

• Self-identification forms
• Emergency contact form
• Medical or disability-related documentation, including return-to-work or doctor’s notes
• Workers’ compensation records
• Insurance enrollment forms
• 401(k) retirement plan documents (or other plans)
• Beneficiary forms
• Release authorizations
• Credit report disclosures and authorizations
• Criminal background check records
• Drug test consents and affidavits
• W-4 tax forms
• State tax forms, if applicable
• Direct deposit forms or voided checks
• Any document containing sensitive personally identifiable information, such as a date of birth, bank account number or Social Security number

I-9 file

Form I-9 is used to verify an employee’s identity and authorization to work in the United States. Employers must use a currently valid edition of Form I-9 issued by U.S. Citizenship and Immigration Services. Keeping I-9s separate from general personnel records can make the forms easier to manage and produce during an inspection.

Employers enrolled in E-Verify may have another option for reviewing I-9 documents. If they’re in good standing and meet the requirements, they can use an approved alternative procedure that allows documents to be examined during a live video call. Otherwise, the documents need to be examined in person.

Because Form I-9 is subject to inspection by U.S. Immigration and Customs Enforcement, keeping I-9s organized and readily accessible is important. Maintaining a dedicated I-9 file can help reduce disruption during a Form I-9 audit and limit the risk of fines tied to missing or improperly completed forms.

I-9 mistakes can also be costly. In March 2026, ICE updated its Form I-9 Inspection fact sheet and changed how it treats some paperwork errors. Mistakes that employers once had a chance to fix may now be considered substantive violations, which don’t come with a correction period. As of 2026, penalties for I-9 paperwork violations range from $288 to $2,861 per violation. It’s worth checking your I-9s periodically for missing or incomplete information rather than finding a problem during an ICE inspection.

What should not be included in a personnel file?

Including the wrong documents in a personnel file can create legal and privacy risks. As a general rule, highly sensitive information and records subject to special confidentiality requirements should not be stored in an employee’s general personnel file.

Keep the following records out of your general personnel files:

• Sensitive employee information: Tax forms such as W-4s, equal employment opportunity (EEO) self-identification data and documents containing sensitive personal information, such as Social Security numbers, should be stored separately with access limited to those who need the information. As noted above, keeping Form I-9 in a separate I-9 file can make the records easier to manage and produce during an inspection.
• Medical and disability records: The Americans with Disabilities Act (ADA) requires covered employers to keep employee medical information confidential and separate from general personnel files. Genetic information protected by the Genetic Information Nondiscrimination Act (GINA) and medical records subject to the FMLA have similar confidentiality requirements. As Weinstein explained, “Personal health information (exposures, test results, documentation of symptoms, etc.) should not be kept in the general personnel file since this may be accessed by too many people.”
• Investigations and informal records: Unsubstantiated allegations and informal notes or opinions about an employee don’t belong in the general personnel file. Investigation records, whistleblower complaints and related materials should generally be maintained separately.

Employers should also avoid keeping documents containing sensitive personal information when there’s no longer a legitimate business or legal reason to retain them. Before destroying identification documents or other employment records, make sure they aren’t subject to federal, state or local retention requirements.

Who should have access to employee personnel records?

Access to employee personnel files should be limited to a small group of designated individuals. In most organizations, that includes key HR staff and select C-suite executives, such as a business owner or chief operating officer, who need the information to manage compliance, employment decisions or legal obligations. Access should also vary based on the type of record, since some confidential information is subject to stricter legal requirements.

Weinstein emphasized that access decisions should be guided by confidentiality obligations rather than job titles alone. “Key personnel who are contractually and legally obligated to maintain confidentiality [should have access],” Weinstein explained. “This could be a business owner and COO, head of HR, etc. The point is that this contains personal, private and sensitive information and isn’t meant to be readily available to anyone in the company.”

Managing employee personnel files involves more than storing paperwork. When records aren’t handled carefully, small oversights can turn into compliance issues, privacy concerns or employee disputes. The following data management best practices can help you keep personnel files accurate, secure and well managed.

• Establish a written retention policy. Create clear guidelines that spell out which documents you collect, where they’re stored, how long they’re retained and when they can be securely destroyed. This policy should also outline who is allowed to access different types of records. Make sure HR department members understand and follow these standards consistently.
• Maintain transparency with employees. State laws vary when it comes to an employee’s right to view their personnel file, but business transparency often helps build trust regardless of the legal minimum. Let employees know which documents you retain, and consider having them acknowledge key records with a signature so there are no surprises later.
• Use role-based access controls. Employee records need to be handled carefully, especially when multiple people have access to them. In practice, that usually means giving managers visibility into job-related information only, while keeping sensitive medical or financial records limited to HR or a small group of designated leaders.
• Review personnel files regularly. A periodic review — often done annually — helps ensure records are current, accurate and stored correctly. This is also a good opportunity to identify outdated documents that have satisfied applicable retention requirements and can be securely destroyed.
• Leverage automation thoughtfully. HR software can streamline document storage and reduce manual errors by automating parts of the file management process. Even with automation in place, regular reviews are still important to confirm that records remain compliant and complete.
• Back up your records. Finally, make sure personnel files are securely backed up. This can help protect important employee records in the event of a system failure, cyber incident or natural disaster.

What are the laws regarding personnel files?

Laws governing personnel files vary by state and at the federal level, but most requirements fall into a few key categories. Understanding how these rules work together can help you stay compliant and avoid common missteps. Consider the following:

• Employee access rights vary by state. Many employees assume they can inspect their personnel file at any time, but that isn’t always true. State laws differ on when and how employees can access their records, and some states have specific requirements for making or responding to a request. For example, California requires employers to allow current and former employees to inspect certain personnel records and generally make them available within 30 calendar days of a written request. The Illinois Personnel Record Review Act, by contrast, generally gives employers seven working days to comply with a request, with an additional seven calendar days allowed when they can’t reasonably meet that deadline. Not every state grants the same rights, so check the requirements where your employees work.
• Certain records must be stored separately. Some employee information is subject to stricter confidentiality requirements. For example, the ADA requires covered employers to keep employee medical information confidential and separate from general personnel files. Other federal and state laws may impose additional requirements depending on the type of record and the employer.
• Retention rules set minimum timelines. Federal laws establish how long certain employment records must be kept. For example, covered private employers generally must retain personnel and employment records subject to Equal Employment Opportunity Commission requirements for at least one year from the date the record was created or the personnel action occurred, whichever is later. The Age Discrimination in Employment Act also requires covered employers to keep employee benefit plans and written merit or seniority systems while they’re in effect and for at least one year after they end.
• Well-maintained files matter in legal disputes. Personnel records can become critical if a current or former employee files — or threatens to file — a business lawsuit. As Weinstein noted, “[A personnel file] is usually the first thing your lawyer will ask for if the employee is suing (or threatening to sue) you.” Keeping files organized and easy to retrieve, ideally in a secure digital system, can save time, reduce legal fees and support your legal defense.

Source interviews were conducted for a previous version of this article.