HR-Glossar
Digitale Personalakte (digital personnel file)
What a digital personnel file achieves, which data protection duties attach to it and what matters in structure, access rights and deletion.
1. What is Digitale Personalakte (digital personnel file)?
The digital personnel file is the electronically kept collection of all documents an employer holds on an employment relationship: the contract and its amendments, certificates, payslips, references, evidence of qualifications, correspondence.
It is not simply a folder of scanned pages. Three properties distinguish it from a paper file: documents sit structured in defined categories rather than stacked chronologically; access is governed by role rather than tied to a cupboard key; and filing, deadlines and deletion can be controlled by rule rather than tracked by hand.
Legally, digitalisation changes nothing about the character of the file. The same principles apply as before: it may contain only what is necessary for the employment relationship (Section 26 BDSG), employees have a right of access (Section 83 BetrVG, Article 15 GDPR), and whatever is no longer needed and subject to no retention duty must go.
For a group rolling out an HR platform, one consequence belongs settled first: a system able to evaluate behaviour or performance is subject to co-determination in Germany.
2. Origin and development
The personnel file itself is not an invention of data protection law – it is as old as ordered personnel administration. What is new is the demand data protection and employment law place on it: necessity, purpose limitation, access, deletion.
Digitalisation has sharpened that demand, not eased it. A paper file in a locked cupboard was practically hard to analyse; a digital file is not. What becomes technically easy – searching, analysing, linking – becomes legally in need of justification. Access rights and logging are therefore not an extra but the condition under which the digital form makes sense at all.
3. Core principles and how it works
Necessity as the criterion for inclusion
What belongs in the file is what is needed to establish, perform or end the employment relationship. Everything else does not belong in it – even where there would be room.
Structure rather than a stack
Fixed categories make the file findable and make granting rights possible at all. Without structure, neither an access request can be answered cleanly nor can anything be deleted selectively.
A roles and rights concept
Who may see which category is governed through roles – manager, HR, payroll, the person concerned. Particularly protected information, on health for instance, needs narrower rights than the employment contract.
Traceability of access
Who opened or changed what, and when, is logged. That protects employees and helps the employer in a dispute.
Deadlines and deletion built in
Every type of document needs a rule on how long it stays. Without that rule the file grows without limit – and the risk with it.
Involving the works council
A system able to evaluate behaviour or performance is subject to co-determination. Its introduction therefore belongs agreed with the works council early, not after the rollout.
4. Who is Digitale Personalakte (digital personnel file) relevant for?
- HR departments – the file is their working tool; its structure decides the daily effort. - Growing companies – where folders and a network drive reach their limit and responsibilities spread across several people. - Management – it is answerable for the lawfulness of the processing. - Works council – entitled to co-determine introduction and design. - Employees – they have a right to inspect and to information about the data held on them. - Data protection officers – the personnel file is one of the most sensitive areas of processing in the company.
5. How it differs from related terms
- Digital personnel file and a document management system – a DMS is a general filing tool; the personnel file is a defined file with legal requirements of its own. A DMS can carry it but is not automatically one. - Personnel file and applicant data – application documents are a separate processing operation with their own deadlines. They move into the file only on hiring and only so far as necessary. - Personnel file and the payroll system – the payroll system calculates and reports, the file documents. Payroll documents can reach the file automatically; the systems nevertheless stay separate. - Personnel file and an employee portal – the portal is the employees' view of part of the file, not the file itself.
6. Variants and adaptations
- Pure filing – digitised documents in structured categories, without further automation. The simplest entry point. - A file with workflow – deadlines, reminders and approvals run in the system, for the end of a probationary period or fixed-term contracts for instance. - An integrated file – the file is part of an HR platform and draws documents automatically from payroll and time management. - A file with self-service access – employees see their own documents online and can submit evidence themselves.
7. Advantages and challenges
Advantages
- Documents are findable without anyone opening a cupboard
- Access rights can be controlled finely and evidenced – practically impossible on paper
- Payroll documents can be filed in a structured way with no manual step
- Access requests can be answered in a reasonable time
- Deletion periods can be controlled by rule rather than tracked manually
- Location-independent access for distributed teams and mobile work
Challenges
- A poor rights concept makes sensitive data more broadly accessible than the filing cabinet did
- The ease of analysis creates appetites that are not legally covered
- Migrating from paper and legacy stores is demanding and rarely complete
- Without a maintained deletion concept, a data holding grows that becomes a risk
- Co-determination and a data protection impact assessment cost lead time
- Dependence on the provider's availability and security
8. Best practices for implementation
Settle the file structure before the first document
Categories, responsibilities and rights belong defined before anything is migrated. Restructuring ten thousand documents afterwards is not something anyone wants to do twice.
Build the deletion concept at the same time
Every category needs a rule on how long it stays and what happens afterwards. A concept created only after the introduction is seldom caught up with.
Separate particularly protected data
Health information, severe disability and comparable categories belong in their own areas with narrower rights – not in the general store with good intentions.
Involve the works council and data protection early
Both have to be involved in any case. Brought in early they shape it; brought in late they rightly slow it down.
Review the rights regularly
Roles change, access stays. A recurring review of rights prevents authorisations accumulating over years.
9. Tips for employers and employees
For employers
- **Do not digitise everything that exists** – the migration is the best occasion to remove what does not belong in the file anyway
- **Rehearse an access request** – a test run quickly shows whether the structure holds
- **Name the responsibilities** – who files, who grants rights, who deletes
- **Settle the processor agreement** – with an external solution or outsourced HR administration it belongs in place before the first record
For employees
- **Know your right of inspection** – you may inspect your personnel file; where it is kept digitally, usually directly in the portal
- **You may request information** – about the data held on you
- **Have anything inaccurate corrected** – wrong entries must be rectified; an informal note is enough to start
- **Keep your own documents** – contracts, payslips and references belong in your own records too, not only the employer's
10. Conclusion
The digital personnel file saves HR time spent searching and makes responsibilities visible – but only where structure, rights and deletion rules are in place before the migration. What it makes technically easy, data protection law makes in need of justification: a file anyone can open and that never forgets anything is not progress over the filing cabinet but a larger risk in a more convenient guise. The effort therefore lies not in the scanning but in the decisions beforehand.
For an international group the co-determination point comes first in the sequence. A platform able to evaluate behaviour or performance is introduced in Germany with the works council, and bringing it in after the rollout means renegotiating a system that is already live. The second point is a design one: a group template built for a jurisdiction with no necessity requirement will hold documents this file may not.
A note on sources: the Works Constitution Act has an official English version, cited below, and the GDPR is available officially in English. The Federal Data Protection Act also has an English version, but it reflects amendments only up to 23 June 2021 and is therefore older than the German text; the German wording governs.
Sources
- Section 26 BDSG – Processing for employment purposes (English version, translation as at 23 June 2021; the German text governs) (opens in a new tab)
- Section 83 BetrVG – Inspection of personnel files (official English version) (opens in a new tab)
- Regulation (EU) 2016/679 (GDPR), official English version (opens in a new tab)
- IT baseline protection (IT-Grundschutz) (opens in a new tab)
Related terms
Our promise
Software supports. People take responsibility.
Let us talk about your payroll – no strings attached, specific, and with a dedicated contact from day one.