Recordkeeping In Brief 24 - Managing personnel records
Introduction | Types of personnel records | Achieving efficient management of personnel records | Establishing policies and procedures | Designing or implementing personnel recordkeeping systems to support retention and privacy requirements | Summary records
Personnel records documenting the management of employees are important records in all organisations. Some of these need to be maintained for long periods of time, often after an employee has left the organisation, in order to protect ongoing rights and interests of the employee and the organisation. Personnel records that contain information about individuals are also likely to be highly sensitive and personal and must be adequately protected from unauthorised access.
Commonly, personnel records include:
- personnel files for each employee - often known as personal or employee files (organised by name or position number)
- non-employee-specific personnel files (organised by activity or topic) eg. procedural or policy files
- data in personnel database systems, either generic packages or custom built for the organisation
- personnel-related data in integrated database systems that have some personnel components.
Increasingly, leave and attendance records are being managed in human resources management systems such as SAP which are hosted outside of a particular organisation in a shared service environment.
Effective and efficient management of personnel records can be achieved by:
- establishing policies and procedures for managing personnel records in accordance with the organisation's regulatory framework
- designing or implementing personnel recordkeeping systems so that records with short retention periods can be destroyed while records with long retention periods are retained for as long as required
- designing or implementing personnel recordkeeping systems so that sensitive records can be kept secure and protected to meet privacy management obligations
- creating and maintaining adequate summary records of employees.
It is good management practice for an organisation to understand the regulatory framework it is subject to for personnel records, and to establish policies and procedures to communicate requirements to relevant action officers, supervisors and managers.
An organisation's regulatory framework includes legislation and whole-of-government or industry policies and procedures, and will vary according to the organisation.
Elements of the framework may include:
- the Privacy and Personal Information Protection Act 1998 (NSW) and guidance issued by the Office of the Privacy Commissioner, which establishes principles for the management of private and personal information within personnel records
- the General retention and disposal authority: administrative records (GA28) which authorises the disposal of the personnel records of NSW public offices
- the General retention and disposal authority: local government records (GA39) which authorises the disposal of the personnel records of councils and county councils
- the NSW Government Personnel Handbook which includes advice on managing personnel records
- the Public Sector Employment and Management Act 2002 (NSW) and associated guidelines which indicate personnel practice in NSW State government
- enterprise agreements of universities which may lay out rules, conditions and entitlements of employees.
Policies and procedures to reference management of personnel records
It may be appropriate to include information on the management of personnel records in:
- records management policy and procedures
- performance management system policy and procedures
- privacy management plan
- induction manual
- grievance handling policy and procedures.
Designing or implementing personnel recordkeeping systems to support retention and privacy requirements
Retention periods and privacy considerations are two factors which should influence the design of paper and digital recordkeeping systems.
Recordkeeping requirement: retention periods
Basing recordkeeping systems and filing practices (paper and digital) on authorised retention periods can help to ensure that records are only kept for as long as needed and are then promptly destroyed.
Authorised retention periods for all records relating to personnel or human resource management in local government are specified in the General retention and disposal authority: local government records.
Authorised retention periods for all records relating to personnel or human resource management in other NSW public offices are specified in the General retention and disposal authority: administrative records.
Managing different retention periods in individual employee files
Traditionally one employee file is kept for each employee. These files often contain records relating to positions held, promotions, transfers or secondments, leave arrangements and separation, and generally have quite long retention periods. Therefore a design solution may be to manage records documenting specific matters where the retention period is shorter separately from the main employee file (e.g. in other files or in specific business systems). These separate records can still be linked to the main employee file in records management system.
Categories of records that are sometimes placed on an individual's employee file that could be managed separately due to shorter retention periods are listed below:
|Category of record||Retention|
|Records relating to the provision of advice and counselling to employees, which may include trauma, financial or career counselling.||Can be destroyed 7 years after action completed|
|Records relating to criminal records checks||Can be destroyed once the check is complete|
|Timesheets||Can be destroyed 7 years after end of financial year in which record was created|
|Records relating to leave applications||Depending on the type of leave can either be destroyed 7 years after employment ceases or 7 years after action completed|
|Records documenting arrangements for staff development||A variety of short retention periods. See entries under STAFF DEVELOPMENT in the General retention and disposal authority: administrative records for more information.|
|Records relating to workers compensation claims not involving serious personal injury or incapacity||Retention period is 25 years after the action is completed.|
|Records relating to vehicle lease arrangements||Retention period is 7 years after arrangement expires|
Separating records relating to these matters from an individual's employee file can also ensure that records requiring more sensitive handling can be treated securely in line with privacy principles.
Managing different retention periods in personnel database systems
When personnel or human resources databases are being designed, a design solution may be to ensure that fields containing information of short-term value can be deleted earlier than fields containing information of long-term value.
A design such as this is particularly useful where personnel-related data form part of an integrated system with payroll and other elements.
Recordkeeping requirement: privacy considerations
Records created to support the management of employees often contain information of a sensitive or personal nature. Public offices should ensure that such records are managed securely and that access to the records is restricted to authorised users.
All employee files should have restricted access, accessible only by those with 'a need to know' to carry out relevant business functions.
Note: Under the Privacy and Personal Information Protection Act 1998 (NSW), an individual has a right to access their own file and to request information be changed if it is inaccurate.
Access levels and security arrangements should be documented. Controlled access should apply for as long as the records are required to be retained, and records should be destroyed promptly when minimum retention periods have expired.
Additional requirements for protecting sensitive or personal information may be achieved through system design solutions and filing practices (paper and digital).
Records relating to the following areas could contain identifying and sensitive information about individuals:
- performance management
- criminal record checks
- working with children checks
- workers compensation
- medical conditions or treatment.
A system design solution would be to keep records documenting these matters separate from:
- general personnel information
- information on an individual's main employee file.
This would facilitate implementing higher security measures to control access to records containing sensitive information, with even more limited access than applies to most other personnel or employee records. Separating records documenting these matters also helps to ensure that records due for destruction can be promptly, easily and securely destroyed in line with privacy principles.
Creating adequate summary records of employment and service can make the management of personnel records more efficient and effective. Summary records are records that summarise the content of other records. Many organisations have kept summary records in the past, such as staff service cards. Increasingly, organisations are using human resource management databases or other automated systems that can provide a similar summary record of employment and service history.
It is the public office's responsibility to determine whether the summary record is 'adequate' to meet the requirements for evidence. This may need to be a risk based decision and subject to a risk management process.
Summary records for employment and service should at least contain details of:
- identification number
- name and name changes
- date of birth
- date appointed
- date of leaving the service
- position and dates held
- promotions and higher duties and dates held
- appointment letter or contract
- locations of work
- description of duties
- salary rates, and
Any additional requirements for a particular public office can be identified by performing an analysis of its regulatory framework in relation to personnel records.The main thing to ensure is that the interests of both the employee and the organisation can be safeguarded by the summary record.
© State of New South Wales through the State Records Authority, 2003.
This work may be freely reproduced and distributed for most purposes, however some restrictions apply.
First published 2003/Revised 2012.