GDPR Digital Personnel File: 5 Obligations and Retention

Main article: Creating a record of processing activities — how to set up and maintain the record under Art. 30 GDPR, with the mandatory entries and SME examples.

A digital personnel file is documented in a traceable manner once five points are settled and demonstrable: who may access it, how long each document stays, when and by what trigger it is erased, how a data subject access request is answered and how data is exported. The five obligations below state, for each point, the specific measure, the reason and the legal source. Where German and Austrian law diverge, this is set out separately.

1. Access concept (need-to-know)

Define before migration which role may see which part of the file, and log the accesses. Line managers: only their own staff. HR: everything. Management: where needed. Record accesses in an audit log (practical recommendation, content see below). Technically, this role model rests on two measures of the central concept of technical and organisational measures under Art. 32 GDPR: encryption of the file storage at rest and a documented role concept for HR access. Practical recommendation: for each access, the access log should record the time, the user account, the person concerned, the document class and the action (view, change, export), and it should be reviewed on a sample basis at a fixed interval — in the event of a breach it is the only evidence of who has seen the file.

The reason for the graduation lies in the content of the file. Health data — sickness notifications, occupational health records, return-to-work management cases (betriebliches Eingliederungsmanagement, BEM) — belong to the special categories of personal data. Their processing is generally prohibited under Art. 9(1) GDPR and becomes permissible only through one of the narrow exceptions in paragraph 2, such as explicit consent. A role model that subjects such documents to the same visibility as a payslip does not reflect this distinction.

Where the file runs in HR software, the provider is regularly a Data Processor. Art. 28(1) GDPR permits cooperation only with processors providing sufficient guarantees to implement appropriate technical and organisational measures; the contract under Art. 28(3) GDPR must set out the subject matter and duration of the processing, the nature and purpose, the type of personal data, the categories of data subjects and the obligations and rights of the Controller. In Austria, the duty of data secrecy under § 6 DSG applies in addition: controllers, processors and their staff are bound to secrecy. Practical recommendation: define roles centrally once and assign them per document class, instead of maintaining rights document by document.

2. Retention periods

Periods do not apply to 'the personnel file' but per document type — and belong in the record of processing activities as envisaged time limits for erasure. Payroll records 6 years (§ 41 EStG). Tax documents 10 years (§ 147 AO). Applicants 6 months (Federal Labour Court (BAG) 2 AZR 1180/16). Employee files after the end of employment: 10 years as a practice value without a specific norm.

Assign each document to one of these rows before migration; what matters is the document type, not the file. For Austrian sites, the Austrian retention rules apply — check them separately per site.

Why applicant records are kept for a run-off period at all: a rejection can give rise to claims that are subject to time limits. In Germany, a claim under § 15(1) or (2) German General Equal Treatment Act (AGG) must be asserted in writing within two months unless the collective bargaining parties have agreed otherwise; in the case of an application, the period starts when the rejection is received (§ 15(4) AGG). In Austria, claims arising from the refusal to establish an employment relationship must be brought before a court within six months of the rejection (§ 15 Austrian Equal Treatment Act (GlBG) for Part I, § 29 GlBG for the remaining grounds of discrimination). Beyond HGB and AO, the main article on the record of processing activities names the Social Code (SGB, 5 years) and employment-law retention as further sources of periods; which of these supports an individual document type must be determined file by file.

3. Mandatory erasure once the period expires

Every period needs an erasure run with a trigger, a responsible owner and a log — otherwise the retention schedule remains on paper. Implement automated erasure processes. Where this conflicts with an ongoing employment relationship: retention until it ends.

The envisaged time limits for erasure are at the same time one of the mandatory entries in the record of processing activities. Missing erasure periods — entries stating 'no specific information' — are, in practical experience, among the frequent errors there, alongside outdated recipient lists. Where a retention obligation stands in the way of erasure under Art. 17 GDPR, that conflict must be documented.

Practical recommendation: the target state is a system-side erasure rule per document class. Where the HR software does not support this, a recurring appointment with a fixed owner takes its place; in both cases, record which document classes the run covered — for a manual run, this log is the only evidence. The reason for deferred erasures belongs with the relevant record entry. For the record itself, the main article recommends an annual review plus an update on every change, quarterly for constantly growing companies — that is a practice rhythm, not a statutory period.

4. Access request procedure (Art. 15)

You must respond to a data subject access request without undue delay and in any event within one month of receipt. Employee request: information within 1 month. Presentation as a PDF with all data categories.

The one-month period is set out in Art. 12(3) GDPR and applies to all requests under Art. 15 to 22 GDPR — that is, also to rectification, erasure and data portability. It may be extended by two further months where necessary, taking into account the complexity and number of the requests; the data subject must be informed of the extension within one month, together with the reasons. The extension is therefore not a silent deferral but itself a time-bound communication.

Infringements of the rights of the data subject (Art. 12 to 22 GDPR) fall within the upper fine bracket: up to EUR 20 million or up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(5) GDPR). This must be distinguished from the national administrative offence: § 43(2) and (3) BDSG makes infringements in connection with § 30 BDSG (incorrect handling of an access request or of consumer information) an administrative offence punishable by a fine of up to EUR 50,000; no fines are imposed on authorities and other public bodies. Practical recommendation: determine in advance who dates the receipt, who compiles the file and who sends it.

5. Data export (Art. 20)

A request for data portability runs under the same regime of periods as an access request. Machine-readable format. In practice: rarely requested when changing employer, but mandatory.

Because Art. 20 GDPR is one of the data subject rights in Art. 15 to 22 GDPR, the one-month period of Art. 12(3) GDPR, including the possibility of an extension, applies here too. Practical recommendation: define a structured export format (e.g. CSV or JSON per person) and keep a list of which document classes the export covers. Check already when selecting the HR software whether an export per person is possible without provider support — otherwise, in an emergency, meeting the deadline depends on the service provider. Which data Art. 20 GDPR covers in detail must be clarified against the actual set of files.

Personal Data Breach in the personnel file: reporting route and deadlines

If data flows out of the personnel file, the breach must be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it — unless it is unlikely to result in a risk to the rights and freedoms of natural persons (Art. 33(1) GDPR). Where the notification is made later, reasons for the delay must accompany it.

Communication to the employees concerned is a second, narrower stage. It applies only where there is likely to be a high risk to their personal rights and freedoms (Art. 34(1) GDPR) and is not required where appropriate technical and organisational protection measures — in particular encryption — were applied, where subsequent measures mean the high risk no longer exists, or where the communication would involve disproportionate effort — in the latter case a public communication takes its place (Art. 34(3) GDPR). This is precisely where the practical leverage of encryption at rest from point 1 lies.

Every breach is documented, including one that is not notifiable — with the time, a description, the consequences and the measures taken, as well as the reasons where no notification was made (Art. 33(5) GDPR). In Germany, the competent authority for non-public bodies is the state data protection authority competent under state law (§ 40(1) BDSG), and in Austria the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) DSG).

The personnel file in the record of processing activities

The personnel file belongs in the record under Art. 30 GDPR as a processing activity in its own right — and the 250-employee exemption does not provide relief here. Art. 30(5) GDPR applies only cumulatively — all four criteria are in the FAQ. Payroll is a regular processing activity; that uses up the exemption. The wording also refers to 'a risk', not to a high risk — the 'high risk' threshold applies only to the data protection impact assessment under Art. 35(1) GDPR.

Four fields carry particular weight in the HR context: the categories of recipients (tax advisers as independent Controllers, external payroll), the envisaged time limits for erasure from point 2, the reference to the central concept of technical and organisational measures under Art. 32 GDPR instead of separate measures per entry — and the legal basis: Art. 6(1) GDPR, for employee data usually § 26 BDSG in Germany and Art. 6 and Art. 88 GDPR in Austria. This field is not listed in Art. 30(1), but follows from Accountability under Art. 5(2) GDPR. Where processing is based on consent, the Controller must be able to demonstrate it, and withdrawal must be as easy as giving consent (Art. 7(1) and (3) GDPR).

Record sickness cases and return-to-work management as a separate entry — special categories under Art. 9 GDPR, supplemented in Germany by § 167 SGB IX (BEM). Where special categories of data are processed on a large scale, a data protection impact assessment must be carried out beforehand (Art. 35(1) and (3) GDPR). Where processing is subject to that obligation, a data protection officer must be designated in Germany irrespective of the number of persons employed (§ 38(1) sentence 2 BDSG).

Germany and Austria: what is different?

The GDPR articles cited above (including Art. 5, 6, 7, 9, 12, 15, 20, 28, 30, 32, 33, 34, 35) apply as an EU regulation in Germany and Austria alike and with identical content. The fine framework of Art. 83 GDPR also applies in both countries; its application is supplemented nationally (see sanctions). Only the national anchors differ:

• Employee data protection: Germany has its own provision for data in the employment relationship in § 26 BDSG. Austria has no direct counterpart — there, the Austrian Data Protection Act (DSG) applies alongside the GDPR. Art. 6 and Art. 88 GDPR are decisive there, supplemented by § 12(4) no. 2 DSG (image recording for the purpose of monitoring employees is inadmissible) and § 96(1) no. 3 ArbVG (control measures affecting human dignity only with the consent of the works council or a works agreement).
• Supervisory authority: in Germany, the state data protection authorities competent under state law supervise non-public bodies (§ 40(1) BDSG), while the Federal Commissioner for Data Protection (BfDI) is responsible for federal bodies (§ 9(1) BDSG). In Austria, the Austrian Data Protection Authority (Datenschutzbehörde, DSB) is established as the national supervisory authority under Art. 51 GDPR (§ 18(1) DSG).
• Retention periods: the periods named under point 2 (HGB, AO, EStG) are German law. In Austria, the corresponding Austrian retention rules apply — so check the periods separately per site.
• Data protection officer: Germany supplements the GDPR obligation with a threshold of, as a rule, at least 20 persons constantly engaged in automated processing (§ 38(1) BDSG). Austria provides no additional numerical threshold; the designation obligation follows directly from Art. 37 GDPR.
• Data secrecy: § 6 DSG obliges controllers, processors and their staff in Austria to maintain secrecy. This duty applies in addition to Art. 28 GDPR, for which there is no special rule in Austria.
• Sanctions: the EU framework is identical in both countries. Infringements of obligations under Art. 25 to 39 GDPR — including processing on behalf, the record, security of processing, the notification obligation, the impact assessment and the data protection officer — are subject to fines of up to EUR 10 million or — in the case of an undertaking — up to 2 % of the total worldwide annual turnover, whichever is higher (Art. 83(4) GDPR); for infringements of the principles of processing and of data subject rights, the higher framework from point 4 applies (Art. 83(5) GDPR). Added to this nationally: § 43 BDSG in Germany (details in point 4) and, in Austria, § 62(1) DSG with a fine of up to EUR 50,000 for administrative offences such as intentional unlawful access to a data processing operation or intentional transmission in breach of data secrecy — and only to the extent that the act does not already constitute an offence under Art. 83 GDPR or is not subject to stricter penalties under other administrative penal provisions. § 11 DSG provides for a proportionate application of Art. 83 GDPR — in particular a reprimand instead of a fine for first-time infringements.