A digital personnel file is standard for mid-sized companies in 2026, but GDPR-oriented structuring is often underestimated. Digitise too much and you risk GDPR breaches. Capture too little and you breach retention obligations under employment law.
Core records subject to retention requirements
- Employment contract with all addenda
- Social security registration and social security number
- Wage tax card or ELStAM data
- Payslips for the last 6 years
- Sickness and holiday statistics (no diagnosis details, days only)
- Written warnings and disciplinary measures (until expungement)
- References and appraisals
- Proof of training for training relevant under professional regulations
Optional content with consent
- Photo of the employee for the internal phone list
- Emergency contact with phone number
- Birthday for birthday greetings within the team
- Bank details for travel expenses (beyond the mandatory data)
Mandatory note: every optional item requires documented consent. It can be withdrawn at any time.
What does not belong in the personnel file
The GDPR classifies certain categories of data as "particularly sensitive" (Art. 9 GDPR), among them:
- Health data without a reason grounded in employment law
- Religion without a wage tax reason (church tax)
- The political opinion of the employee
- Sexual orientation
- Trade union membership (except where there is a specifically justified reason)
- Criminal record extracts with no bearing on the requirements of the role
When in doubt: do not capture it.
Retention periods by document class
| Document class | Retention period | Legal basis |
|---|---|---|
| Employment contract (after it ends) | 3 years | BGB §§ 195, 199 |
| Payslips (payroll account) | 6 years | EStG § 41 |
| Payroll records as accounting documents | 8 years | AO § 147 |
| Social security remuneration records | until the end of the year following the last social security audit | SGB IV § 28f |
| Holiday requests | 1 year after approval | Rule of thumb |
| Travel expense documents | 8 years (accounting document) | AO § 147 |
| Records on occupational pension schemes | up to 30 years | Rule of thumb (limitation period BetrAVG § 18a) |
| Written warnings | until expungement (2–3 years) | Rule of thumb, case law on the individual case |
Access permissions: who may see what?
Role 1: HR administrator. Sees all current mandatory documents. No disciplinary measures, no BEM records (occupational integration management).
Role 2: Head of HR. Full view including disciplinary measures, BEM records and severe disability status.
Role 3: Employee (self-service). Sees their own payslips, the status of holiday requests and a training overview.
Role 4: Supervisor (line manager). Sees employee master data and holiday requests. No payslips, no BEM data.
Plus: every action in the audit trail. Who opened or downloaded which document, and when.
FAQ
How long do I have to keep employment contracts after someone leaves? The standard limitation period is 3 years after termination (rule of thumb). For records relevant for tax purposes, the longer tax retention periods apply.
May we keep application documents? After a rejection they may be kept for a few more months because of possible claims under the AGG (rule of thumb: roughly 4 to 6, derived from § 15 (4) AGG and § 61b ArbGG). After that they must be deleted unless consent has been given.
Can I let an employee view their own personnel file? Yes, employees have a right of inspection (§ 83 BetrVG) and, in addition, the right of access under Art. 15 GDPR. Self-service access through the DMS is a pragmatic way to meet it.
Conclusion
The digital personnel file takes discipline. Keep what is subject to retention clearly on file, collect voluntary items with consent, never capture prohibited data at all. Maintain the roles and the retention periods per class, and keep the audit trail active. As of: September 2026
This article provides general information on legal requirements and is no substitute for legal or tax advice in an individual case.
Further reading
Digital files with OXS.eco
All documents for an employee, customer or case in one place, with role-based access.