The introduction of the GDPR (in Polish: RODO) brought significant changes to the way businesses process personal data. A particularly important question is whether the archived personnel files of former employees must also be protected in line with EU rules. This issue raises many doubts among employers, who are obliged to keep employee documentation for a specified period. Personnel files are part of the documentation we keep for clients using our HR and payroll services.
The GDPR also applies to archived personnel files, but the date on which the documents were archived matters, among other things, for their content and retention period. Employers must understand their obligations precisely in order to avoid high financial penalties for breaching data protection rules.
What the GDPR is and where it applies
The GDPR, i.e. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, is the basic legal act governing the protection of personal data in the European Union. The Regulation has applied since 25 May 2018 (Article 99(2) GDPR); on that date it repealed the earlier Directive 95/46/EC on data protection (Article 94).
The main aim of the GDPR is to ensure comprehensive protection of the personal data of every natural person and to harmonise the rules across the European Union. The Regulation introduces strict rules for processing personal data and provides for severe financial penalties for breaching them.
Fines for breaching the GDPR can reach EUR 20 million or 4% of the company's total worldwide annual turnover, whichever is higher. The size of the fines has made compliance a priority for all organisations that process personal data
The GDPR has a very broad scope and covers practically all aspects of processing personal data. It covers not only collecting and storing information, but also using, disclosing, modifying or erasing it. The Regulation applies to all entities that process personal data, regardless of their size or the nature of their activity.
It is particularly important that the GDPR introduces the principle of accountability, under which data controllers must be able to demonstrate that they comply with all the required rules. This means documenting all activities related to processing personal data and implementing appropriate procedures and safeguards. Similar record-keeping requirements apply to data from an internal reporting procedure for whistleblowers.
The GDPR also introduces new rights for data subjects, including the right to be forgotten, the right to data portability and the right to have inaccurate information rectified. These rights directly affect the way employee documentation is managed, although the right to erasure does not cover data that the employer must keep to comply with a legal obligation (Article 17(3)(b) GDPR)
Basic obligations under the GDPR
The data protection regulation sets out six fundamental principles for processing personal data, which all data controllers must observe. These principles are the basis for all activities related to processing information about natural persons.
The first principle is lawfulness, fairness and transparency. This means that personal data must be processed in line with the law, fairly towards the data subjects, and transparently as regards the purposes and methods of processing.
The second principle is purpose limitation, under which personal data may only be collected for specified, explicit and legitimate purposes. It must not then be processed in a way that is incompatible with the original purposes, unless the purpose is archiving in the public interest, research or statistics.
The purpose limitation principle is particularly important for employers, because data collected for employment purposes may not be used for other purposes without an appropriate legal basis. This also applies to data in archived personnel files
The third principle, data minimisation, requires personal data to be adequate, relevant and limited to what is necessary for the purposes of processing. This means you must not collect more data than you actually need.
The fourth principle concerns accuracy and requires all information processed to be accurate and up to date. If errors are found, they must be corrected without delay or the inaccurate data erased.
The fifth principle is storage limitation, under which personal data may only be kept for as long as necessary for the purposes of processing. The exception is data processed solely for archiving purposes in the public interest, research or statistical purposes.
The storage limitation principle is particularly important for employees' personnel files: the retention period for employee documentation is set by the Labour Code (Kodeks pracy) (Article 94 point 9b), and once it expires the documentation is, as a rule, handed over to the former employee or destroyed. Employers must set specific retention periods for different categories of documents
The sixth principle, integrity and confidentiality, requires appropriate security of personal data, including protection against unauthorised access, accidental loss, destruction or damage. This must be achieved by implementing appropriate technical and organisational measures.
Employee personnel files - legal basis
The obligation to keep employee documentation stems directly from the Labour Code. Under Article 94 points 9a and 9b of the Labour Code, every employer must keep and store documentation relating to the employment relationship and employees' personnel files. Personnel files are divided into parts A–E (regulation on employee documentation, consolidated text Dz.U. (Journal of Laws) 2026 item 474).
Employee documentation can be kept in paper or electronic form, which gives employers flexibility in choosing how to keep the files. Whichever form is chosen, the key is to ensure suitable storage conditions that preserve the confidentiality, integrity, completeness and availability of the documents.
The retention period for employee documentation is 10 years from the end of the calendar year in which the employment relationship was terminated or expired. This is a significant reduction compared with the earlier rules, which provided for a 50-year retention period. The 10-year period applies to employment relationships established from 1 January 2019; for earlier ones 50 years still applies, and for those established in 1999–2018 the period is shortened to 10 years from the end of the year in which the ZUS RIA information report was filed with ZUS (the Social Insurance Institution) (Article 7 of the Act of 10 January 2018, Dz.U. 2018 item 357)
Employees' personnel files contain a variety of documents with personal data, often including special categories of data. This may be information about health, trade union membership or other sensitive data requiring special protection.
Employers must ensure that employee documentation is stored in conditions that rule out damage or destruction. This applies both to physical threats and, for electronic documentation, to cyber threats.
- Physical protection of paper documents against access by unauthorised persons
- Protection against weather and other environmental threats
- Implementing IT security systems for electronic documentation
- Regularly backing up electronic data
- Restricting access to documentation to authorised staff only
New rules have allowed employers to archive personnel files in electronic form since 2019. This means paper documents can be digitised – the scan must bear a qualified electronic signature or qualified electronic seal, and employees must be informed of the change in the form of the documentation (Article 94⁸ § 2 and Article 94⁹ of the Labour Code) – which can make the archive much easier to manage and provide better protection against data loss
GDPR and personnel files archived before 2018
A common question is whether the archiving date matters for applying the GDPR to archived personnel files, i.e. whether the documents were archived before or after 25 May 2018, the date from which the GDPR applies.
The GDPR applies to all processing of data from 25 May 2018, and storing data is itself processing (Article 4(2) GDPR). Personnel files archived before that date are therefore also subject to the Regulation – processing already under way when the GDPR began to apply had to be brought into line with it (recital 171 GDPR). However, employers do not have to change the content of documents collected in line with the rules in force at the time.
Not having to change the content of documents archived before 25 May 2018 does not mean being exempt from data protection obligations. Employers must ensure that these documents are properly secured in line with the GDPR (Article 32) and the rules on employee documentation
This is because the employer keeps personnel files to comply with a legal obligation (Article 6(1)(c) GDPR in conjunction with Article 94 point 9b of the Labour Code), and the documentation must be kept in a way that preserves its completeness.
Nevertheless, employers should review older archives in terms of security and access, especially where documents contain particularly sensitive personal data. This can help avoid legal problems in the future.
| Archiving period | GDPR application | Required actions | Additional notes |
|---|---|---|---|
| Before 25.05.2018 | Full (storage is processing) | Security in line with the GDPR | Content collected under the rules of the time unchanged |
| After 25.05.2018 | Full | Compliance with all principles | Mandatory procedures |
| Mixed documents | Full | Uniform security measures | Different retention periods (50 or 10 years) |
Employers must remember, however, that even documents archived before 2018 are covered by the data protection rules of the GDPR and Polish law. This means ensuring an appropriate level of security and restricting access to the documents.
Documents archived before the GDPR began to apply may contain data whose collection would now be incompatible with the Regulation's principles, for example overly extensive information about the employee's family. Such data may still be kept until the end of the statutory archiving period
Archiving personnel files after the GDPR came into force
Personnel files archived after 25 May 2018 must be processed in full compliance with the GDPR from the outset, which requires employers to implement appropriate procedures and safeguards.
GDPR-compliant archiving requires, above all, establishing which documents the employer is obliged to keep and for how long. The obligation to keep employee documentation does not depend on costs – it stems from the law, while the choice of safeguards is up to the employer.
The choice of safeguards should take into account the costs of storing and securing documents, the risk to data subjects, the possibility of updating them when the law changes and the time needed to carry out the whole archiving process. The GDPR requires measures appropriate to the risk, taking into account the state of the art and the costs of implementation (Article 32(1))
The key principle is to limit data to the necessary minimum. It applies above all to collecting data – the employer may only request the data listed in Article 22¹ of the Labour Code or required by other regulations. However, collected employee documentation is not "cherry-picked" – during the retention period it must remain complete (Article 94 point 9b of the Labour Code).
Special categories of data, such as information about an employee's health or trade union membership, can be particularly problematic. The employer may process them where the law requires it, and on the basis of consent – only if the employee provided them on their own initiative (Article 22¹b § 1 of the Labour Code); only persons with written authorisation have access to them (§ 3).
Once the retention period – 10 years from the end of the calendar year in which the employment relationship ended – has expired, the former employee may collect the documentation by the end of the following calendar month, and the employer destroys any uncollected documentation within 12 months in a way that makes it impossible to reconstruct its content (Articles 94⁶ and 94⁷ of the Labour Code). It is worth recording the destruction in a register kept by the employer – this helps demonstrate compliance with the GDPR (accountability principle, Article 5(2)). Other day-to-day HR records, such as the employee attendance list, are kept in the same orderly way.
Destroying documents containing personal data cannot simply mean throwing them in the bin. Paper documents must be destroyed mechanically, and electronic media formatted in a way that prevents data recovery or physically destroyed
GDPR-compliant archiving procedure
It is worth basing GDPR-compliant archiving of personnel files on an eight-stage procedure that organises the Regulation's requirements. Each stage has its own specific requirements and should be properly documented.
The first stage is classifying the files and setting the maximum period for keeping them. The employer must analyse each type of document and determine how long it must be kept under the law.
The second stage is organising the collected files according to a key set by the employer. This can be chronological, alphabetical or by type of document. It is important that the system adopted is logical and makes it easy to find specific documents.
The third stage involves labelling the collected files by category, such as employment contracts, leave documents, sick notes or documents relating to termination of employment. Such labelling makes it easier to manage the archive and monitor retention periods.
Labelling should be durable and legible, but must not affect the integrity of the original documents. The best solution is to use special labels or binders with appropriate descriptions of document categories
The fourth stage is carrying out the actual archiving process, i.e. physically placing the personnel files in specially prepared rooms or containers, or on secure electronic media. The archiving location must meet appropriate security requirements.
- Choosing a suitable room with access control
- Ensuring suitable climatic conditions
- Protection against fire and flooding
- Installing monitoring and alarm systems
- Regular inspections of the archive's technical condition
The fifth stage, carried out after the statutory retention period expires, is destroying the files. This stage requires particular care, because improper destruction of documents may lead to a breach of data protection rules.
The sixth stage involves drawing up a record of the destruction of the files, including the method of destruction, the date of the operation and the person responsible for it. The law does not require such a record, but it is worth keeping it for a certain period as evidence that the obligations were properly fulfilled.
The documentation of the destruction process should contain detailed information on the type of documents destroyed, the method used, the date and time of the operation and the signatures of the persons responsible. This information may be needed if the supervisory authorities carry out an inspection
The seventh stage is implementing control procedures that allow regular checks of whether the archiving process complies with the law. Checks should cover both technical and procedural aspects.
The eighth and final stage is continuous improvement of procedures based on practical experience and changes in the law. Employers should regularly review their archiving procedures and adapt them to new requirements.
Technical and organisational measures
Implementing appropriate technical and organisational measures is the foundation of GDPR compliance when archiving personnel files. These measures must be proportionate to the risk of the processing and take account of the latest technical developments.
Technical measures include all IT and physical solutions that protect personal data against unauthorised access, modification or destruction. For electronic documentation, data encryption and access control systems are particularly important.
Data encryption should use the latest cryptographic standards and be regularly updated in line with technological progress. Encryption keys must be stored securely and be available only to authorised persons
Access control systems must ensure that only authorised persons can access archived documents. They should include authentication, authorisation and logging of all operations on the data.
Organisational measures concern the procedures, instructions and security policies that govern how personal data is handled. They also include staff training and regular security audits.
- Drawing up detailed instructions for handling personnel documentation
- Running regular data protection training for staff
- Appointing persons responsible for archive security
- Implementing security incident response procedures
- Carrying out regular GDPR compliance audits
All persons with access to archived personnel files must be properly trained in personal data protection and sign confidentiality undertakings. Training should be held regularly and adapted to changes in the law
Particular attention should be paid to securing backups of documents. These copies must be stored just as securely as the original documents and be subject to the same access control procedures.
Practical aspects of implementation
Implementing GDPR-compliant archiving procedures requires employers to take a number of practical steps, which often involve additional costs and work. The key is to plan the whole process properly and implement it gradually.
The first step should be an audit of the current state of the archive and identification of all documents containing personal data. This audit will make it possible to determine the scope of the necessary changes and the cost of implementing them.
An archive audit should cover not only identifying documents but also assessing current safeguards, analysing risk and setting priorities for implementing new procedures. The results of the audit are the basis for drawing up an action plan
The next step is to prepare detailed documentation of all archiving procedures. This documentation should be detailed enough for every employee to carry out their duties correctly.
The implementation of new procedures should be preceded by appropriate training for all staff involved. Training should cover both the legal and the practical aspects of the new procedures.
A medium-sized company with 50 employees must keep personnel documentation for 10 years from the end of the year in which each employment relationship established from 2019 ended. This means that at any given time the archive may contain documentation on as many as several hundred people, which requires an appropriate system for managing and securing documents in line with the GDPR.
Another important practical issue is the cost of implementation. Employers must take into account the cost of buying suitable software, modernising archive rooms, training staff and maintaining the system.
It is also worth considering using external companies specialising in document archiving. This solution may be particularly attractive for smaller employers who cannot implement all the required procedures themselves.
Choosing an external archiving company requires particular care, because the employer remains responsible for GDPR compliance even when archiving is entrusted to an external entity. A data processing agreement must be signed
