What to Do When an Employee Asks for Their Personnel File
The request is routine and the deadline is short. What must be included, what can be withheld, and how to send it without creating a second problem.
Employees ask for their file for many reasons — a dispute, a new job, curiosity, a lawyer's advice — and in most jurisdictions they have a right to most of it, on a deadline. The request is a legal event from the moment it arrives, and how it is handled shapes what comes next. Here is the process.
Day 0 — Log it and start the clock
Record the date, the requester, the exact wording and the channel. Work out the deadline under the law that applies (a month under GDPR-style regimes; shorter or longer elsewhere; some jurisdictions have specific personnel-file statutes with their own windows). Open a record for the request so every step is dated.
Confirm identity and scope
A current employee writing from their work address is usually verified by that fact. A former employee needs a proportionate check. Ask what they want if it is unclear — "my file" usually means the personnel record; it may also mean emails about them, which is a broader search under access-request rules.
Gather
The personnel record: contract and variations, job history, pay history, performance reviews, absence records, training, disciplinary and grievance documents, references received, correspondence about them. Then the wider search if they asked for it: email, chat, manager notes. Search where the records actually are, and note where you searched.
What can be withheld
This varies, but the recurring categories are: third-party personal data (redact the colleague's details in a complaint about them, unless they consent or it is reasonable to disclose), confidential references given to you (often exempt), legally privileged material (advice from your lawyers), management forecasting (succession plans, planned restructures, in some regimes), and material about a live investigation where disclosure would prejudice it. Record every redaction and the reason.
Send it securely
Not as an email attachment. Share it through a verified portal or a secure message the employee opens with a one-time code, so you can show who received it and when. The reasoning is in secure alternatives to email attachments. Include the information the law requires alongside the data: purposes, recipients, retention periods, their other rights.
Close the record
Date sent, what was included, what was withheld and why. If the request precedes a dispute, this record is the first exhibit.
The lesson for the file itself
Every hard request reveals the same things: the file was in three places, some of it was in a manager's inbox, and nobody was sure what had been kept. An employee file kept as one record — contract and letters generated from it, emails filed to it, reviews as dated entries, disciplinary matters as linked records with their own access — makes the request an export. Retention enforced on the file makes it a smaller export. See how long to keep HR records and, for the structure, HR case files.
