Personnel File: What Every Small Business Must Include
What goes in a personnel file? Complete list of documents, what to keep separate, state access laws, and retention rules for small business.
Personnel File
What to include, what to separate, and how to manage it
When a former employee filed a wrongful termination complaint, the first thing the attorney asked for was the personnel file. I pulled open a filing cabinet, found a folder with the employee's name on it, and discovered that it contained an offer letter from two years ago, a single performance review, and a doctor's note that should not have been there. No signed handbook acknowledgment. No documented warnings. No termination letter explaining the reason for separation. The "personnel file" was a folder with three random documents, one of which violated Americans with Disabilities Act (ADA) record-keeping requirements.
That experience cost me $8,500 in legal fees to settle a complaint that proper documentation would have prevented entirely. The employee's claim was weak on the merits, but without a disciplinary record, signed policies, or a termination letter in the file, my attorney told me the case was not worth fighting. "You cannot prove what you did not document."
A personnel file is not a filing obligation you get around to eventually. It is the legal record of every employment relationship at your company, and the quality of that record determines whether you can defend a termination, respond to a government audit, or answer an employee's request to see their file (which many states require you to fulfill on a short statutory deadline). This guide covers what a personnel file is, what goes in it, what must be kept separate, the federal and state laws that govern it, how long to keep records, and how to build personnel files automatically through onboarding so you never face an audit or complaint with an empty folder.
At FirstHR, personnel files are created as a byproduct of onboarding: every document signed and every policy acknowledged during onboarding lands in the employee's file under its category, and every finished course stays on their profile with a dated signature.
What Is a Personnel File?
A personnel file is the collection of documents an employer maintains for each employee that records the history of the employment relationship. It begins with the job application and ends with the termination or resignation letter. Between those two points, it captures every significant event: the offer, the tax forms, the signed policies, the performance reviews, the promotions, the disciplinary actions, and the compensation changes.
The personnel file serves three purposes. First, it is a compliance record: federal and state agencies such as the Equal Employment Opportunity Commission (EEOC), the Department of Labor (DOL), Immigration and Customs Enforcement (ICE), and the Occupational Safety and Health Administration (OSHA) may request specific documents during audits and investigations. Second, it is a legal defense: in wrongful termination, discrimination, or wage claims, the personnel file is the primary evidence of what happened and when. Third, it is an operational tool: managers reference it for performance history, compensation data, and training records.
What to Include in a Personnel File
| Document | When Created | Why It Matters |
|---|---|---|
| Job application and resume | Pre-hire | Documents the basis for the hiring decision. Required for EEOC record-keeping (1 year). |
| Offer letter (signed) | Pre-hire / Day 1 | Establishes the terms of employment: title, compensation, start date, at-will status. |
| W-4 (federal tax withholding) | Day 1 | Required by IRS. Ask for it when work starts; without one, withhold as Single with no adjustments. |
| State tax withholding form | Day 1 | Required by state tax authority. Varies by state. |
| Direct deposit authorization | Day 1 or Week 1 | Authorizes payroll deposits. Not legally required but operationally essential. |
| Emergency contact information | Day 1 | Needed for workplace emergencies. No federal requirement but universal best practice. |
| Signed employee handbook acknowledgment | Day 1 or Week 1 | Proves the employee received and read workplace policies. Critical for enforcing policies in disputes. |
| Signed individual policy acknowledgments | As policies are issued | Anti-harassment, confidentiality, technology use, social media. Required in some states. |
| Non-disclosure / non-compete agreements | Day 1 or as signed | Protects trade secrets and competitive interests. Enforceability varies by state. |
| Performance reviews | Per review cycle | Documents performance expectations and outcomes. Essential for defending termination decisions. |
| Disciplinary records and written warnings | As issued | Creates a progressive discipline trail. Without it, termination appears arbitrary. |
| Promotion, transfer, and title changes | As they occur | Shows career progression and the basis for employment decisions. |
| Compensation change documentation | As changes occur | Required by FLSA (3-year retention). Proves pay decisions were non-discriminatory. |
| Training completion certificates | As training is completed | Proves compliance training was delivered. Required for anti-harassment training in some states. |
| Termination letter or voluntary resignation | At separation | Documents the reason for separation. The single most important document in wrongful termination claims. |
Most of these documents are created during the first week of employment. When onboarding includes a structured checklist (complete W-4, sign offer letter, acknowledge the employee handbook, set up direct deposit), the personnel file builds itself. When onboarding is informal, documents trickle in over weeks or never arrive.
What Must NOT Be in the Personnel File
Certain documents must be stored outside the main personnel file, and the reason differs by category. For medical information, separation is a legal requirement under the ADA and the Genetic Information Nondiscrimination Act (GINA) rather than a best practice. Background check reports carry their own Fair Credit Reporting Act (FCRA) restrictions on use and disclosure.
For the I-9, separation is not written into a statute. It is a USCIS recommendation instead, and it is worth following anyway, because an immigration audit that reaches only the I-9 file never touches the rest of the record.
The ADA is the strictest of these rules. 42 U.S.C. 12112(d)(3)(B), which (d)(4)(C) extends to current employees, requires that medical information from an examination or inquiry be collected and maintained on separate forms, in separate medical files, and treated as a confidential medical record. A doctor's note filed next to a performance review is a breach of that rule, not an untidy cabinet.
| Document Category | Where to Store | Why Separate | Legal Basis |
|---|---|---|---|
| Medical records (all types) | Separate medical/confidential file | ADA requires medical information be kept confidential with restricted access | ADA Section 102(d)(3)(B) |
| FMLA leave documentation | Medical/confidential file | Reveals medical conditions | ADA + FMLA regulations |
| ADA accommodation requests | Medical/confidential file | Reveals disability status | ADA Section 102(d)(3)(B) |
| Drug and alcohol test results | Medical/confidential file | Medical information | ADA + state laws |
| Workers' compensation claims | Medical/confidential file | Contains injury/illness details | ADA + state workers' comp laws |
| Form I-9 and work authorization | Separate I-9 file | Producible for an ICE audit without exposing other records | USCIS recommendation; 8 CFR 274a.2 sets the retention rule |
| Background check reports | Separate investigation file | FCRA restricts use and disclosure of consumer reports | FCRA Section 604 |
| EEO/demographic data | Separate EEO file | Prevents bias claims if visible to decision-makers | Title VII / EEO-1 reporting |
| Workplace investigation files | Separate investigation file | Protects legal privilege and confidentiality of witnesses | Best practice / attorney-client privilege |
| Genetic information | Medical/confidential file | GINA prohibits acquisition and disclosure of genetic information | GINA Title II |
The violation to watch for: keeping a doctor's note in the main personnel file because it seems related to an absence. Any document that reveals a health condition, disability, pregnancy, or medical treatment goes in the medical file.
The 4-File Structure
I recommend a 4-file structure over the traditional 3-file approach. The fourth file separates payroll and tax records, which reduces the risk of exposing compensation data whenever one of the other files is opened.
The 4-file structure creates clear boundaries: the main personnel file is for employment history, the medical file is for health-related information, the I-9 file is for immigration documents, and the payroll file is for compensation and tax records. Each file has different access rules: the personnel file is accessible to the employee's manager (limited view) and the business owner, the medical file is restricted to the owner only, the I-9 file is accessible only to the owner or designated compliance person, and the payroll file is accessible to the owner and the payroll administrator.
Writing down who is allowed to open which file is unglamorous HR document management work, but it is exactly what keeps a doctor's note from landing on a manager's desk.
Federal Personnel File Requirements
No single federal law mandates a unified "personnel file." Instead, multiple federal laws require employers to create and retain specific categories of employment documents. Together, these requirements create the obligation to maintain what is effectively a personnel file for every employee.
The EEOC rule is the closest thing to a general one. Under 29 CFR 1602.14, any personnel or employment record is preserved for one year from the date the record was made or the personnel action involved, whichever is later, and for one year from the termination date when the employee was let go involuntarily.
| Federal Law | What It Requires | Retention Period | Applies To |
|---|---|---|---|
| FLSA | Payroll records: hours worked, wages paid, overtime, deductions | 3 years | Virtually all employers |
| Title VII / ADA / ADEA (EEOC) | Personnel records: applications, hiring decisions, promotions, terminations, pay data | 1 year after the personnel action; ADEA adds 3 years for payroll records | 15+ employees (Title VII/ADA), 20+ (ADEA) |
| IRCA | Form I-9 for every employee | 3 years after hire or 1 year after termination (whichever is later) | All employers |
| OSHA | Injury/illness records (Form 300), exposure records | 5 years (30 years for toxic exposure) | All employers (recordkeeping at 11+) |
| ERISA | Benefits plan documents, enrollment records | 6 years | Employers offering ERISA-covered benefits |
| IRS | W-4, W-2 copies, payroll tax returns | 4 years after the tax is due or paid, whichever is later | All employers |
| FMLA | Leave records, medical certifications | 3 years | 50+ employees |
The practical implication: even a 5-employee company must maintain I-9s (IRCA), payroll records (FLSA), and tax documents (IRS) for every employee. These records, properly organized, constitute a personnel file whether the employer calls it that or not.
OSHA injury and illness logs follow a different threshold. Under 29 CFR 1904.1, a company with 10 or fewer employees at all times during the last calendar year does not need to keep them unless OSHA or the Bureau of Labor Statistics asks in writing.
A separate rule, 29 CFR 1904.2, lifts the same duty for establishments in certain low-hazard industries at any size.
State Personnel File Laws
Many states have specific personnel file laws that go beyond federal requirements. These laws typically cover three areas: what must be included in the file, what cannot be included, and whether employees have the right to inspect their file.
| State | Employee Access Right | Response Deadline | Key Details |
|---|---|---|---|
| California | Yes | 30 calendar days | Employee or former employee can inspect and copy. Employer must provide at workplace or by mail. Penalty: $750 per violation (Labor Code Section 1198.5). |
| Illinois | Yes | 7 working days | Employers with 5 or more employees. At least two requests per calendar year. Written request required. A former employee keeps the right for 1 year. Personnel Record Review Act (820 ILCS 40). |
| Massachusetts | Yes | 5 business days | Review and copies both run on the 5-day clock. Employee notified within 10 days of negative information being filed. The 20-employee threshold governs which documents the record must contain, not the right of access. |
| Washington | Yes | 21 calendar days | Current employees, former employees who separated within 3 years, and their designees. Furnished at no cost. Statutory damages $250 to $1,000 (SHB 1308, effective July 27, 2025). |
| Michigan | Yes | Reasonable time | Bullard-Plawecki Act applies at 4 or more employees. Employee gets two reviews per calendar year. Can request corrections. |
| Connecticut | Yes | 7 business days (current), 10 business days (former) | Employee may add a written statement of disagreement, which stays in the file. The file itself must be kept 1 year past termination. |
| Oregon | Yes | 45 calendar days | Applies to all employers. Employer may charge the actual cost of providing copies. Personnel records kept at least 60 days after termination. |
| Minnesota | Yes | 7 working days (14 if the record is held out of state) | No employee-count threshold. Employee can submit a written explanation for disputed documents. One review per 6 months while employed. |
| New York | Yes, from November 8, 2026 | 5 business days | Signed September 9, 2026. Records kept from hire to 3 years past termination, two requests a year, notice within 10 days of negative information, fine of $500 to $2,500 (S3460). |
The deadline variation is what catches multi-state employers. If you employ people in California and Washington, the binding clock is Washington's 21 calendar days, not California's 30. Add New York from November 8, 2026 and the binding clock becomes 5 business days for everyone, because no system sorts requests by the state the requester happens to sit in.
In practice, that means one production standard. You need to be able to assemble a complete, properly separated file on demand, in days rather than weeks, without anyone walking to a filing cabinet.
Employee Access Rights
When an employee requests to see their personnel file, your response depends on your state. In states with access laws, you must comply within the statutory deadline. In states without explicit access laws, there is no legal obligation, but allowing reasonable access anyway keeps the request from escalating.
| If Your State Requires Access | Best Practice Response |
|---|---|
| Acknowledge the request in writing within 24 hours | Even if the deadline is 30 days, prompt acknowledgment shows good faith |
| Assemble the personnel file as your state law defines it | Definitions differ: Washington's can include payroll, leave, and accommodation records, and Oregon's reaches time and pay records |
| Provide access at the workplace during normal hours OR mail copies (varies by state) | Check your state law for the specific access method required |
| Allow the employee to copy or photograph documents (most states) | Some states allow employers to charge reasonable copying costs |
| Document the date, what was provided, and employee acknowledgment of receipt | Creates a record that you complied within the deadline |
An access request is also an early warning. When employees ask for their file, it often precedes a complaint, a lawyer consultation, or a resignation. A request from a current employee who has recently received a negative performance review or disciplinary action may mean they are building a case. This does not change your obligation to comply, but it is useful context for your response.
That is why the response needs its own paper trail. Log the request the day it arrives, record what you handed over and what you deliberately held back, and keep the sheet in the file. If the response is ever questioned, this is the document that answers it.
Personnel File Retention Schedule
| Document Category | Federal Minimum | Practical Recommendation |
|---|---|---|
| Application and hiring records | 1 year from the hiring decision, under both the EEOC rule and the ADEA | 7 years after termination |
| I-9 forms | 3 years after hire or 1 year after termination (whichever is later) | 3 years after termination |
| Payroll records | 3 years (FLSA) | 7 years (beyond the 6-year IRS window for underreported income) |
| Tax records (W-4, W-2 copies) | 4 years after the tax is due or paid, whichever is later (IRS) | 7 years |
| Performance reviews and disciplinary records | 1 year after action (EEOC) | 7 years after termination |
| Benefits records (ERISA) | 6 years | 7 years after plan termination |
| OSHA safety records | 5 years (30 years for exposure records) | 5 years (30 years for exposure) |
| Medical/ADA/FMLA records | 1 year from creation or the personnel action (EEOC); 3 years for FMLA records | 7 years after termination |
| Handbook and policy acknowledgments | No specific federal requirement | 7 years after termination |
| Training records | No general federal minimum; 3 years under specific OSHA standards | 7 years after termination |
The safest approach: keep all personnel files for 7 years after the employee's last day. This covers every common federal retention period, the IRS audit window, and the statute of limitations for most employment claims.
Short tenure does not shorten the clock. Research reported by SHRM (2017) shows that up to 20% of employee turnover happens within the first 45 days of employment, and a short-tenure hire still generated an I-9, a W-4, a signed handbook, and a separation record. Each one runs on its own retention period.
Digital vs Paper Personnel Files
| Factor | Paper Files | Digital Files |
|---|---|---|
| Access control | Physical lock; anyone with the key sees everything | Role-based permissions per file type (personnel, medical, I-9) |
| State access requests | Photocopy documents, mail or present in person | Export and email within minutes |
| Audit response | Pull individual folders, organize documents manually | Search, filter, and produce requested documents in minutes |
| Disaster recovery | Fire, flood, or theft = permanent loss | Cloud backup with geographic redundancy |
| Completeness checks | Manual review of each folder for completeness | Signature tracking shows which documents are still waiting for a signature |
| Scalability | Manageable at 1-5 employees, impractical at 20+ | Same system works at 5 or 50 employees |
| Cost at 25 employees | One-time filing cabinet purchase + storage space | $198/month (flat-fee HR platform; the $98 plan covers up to 10 people) or $0-$20/month (cloud storage) |
I put the transition point from paper to digital at 5 to 10 employees. Below 5, a locked filing cabinet with separate folders per employee is manageable. Above 5, the volume of documents per employee (10 to 20 items), the number of files per employee (4 with the recommended structure), and the compliance tracking requirements exceed what manual systems handle reliably.
Onboarding is where the two questions meet. Digital personnel files produce a better file because every document is captured, signed, and filed into the right category during the process itself, which is the same window in which most of the file is created.
Building Personnel Files Through Onboarding
The best time to build a personnel file is during onboarding, because onboarding is when most personnel file documents are created. A structured onboarding workflow that collects every required document during the first week produces a complete, compliant personnel file as a byproduct, without retroactive effort.
| Onboarding Task | Personnel File Document Created | Deadline |
|---|---|---|
| Complete Form I-9 | I-9 (stored in separate I-9 file) | Section 1 on Day 1; Section 2 by end of third business day |
| Complete Form W-4 | W-4 (stored in payroll file) | Before first payroll |
| Sign offer letter | Signed offer letter (personnel file) | Day 1 |
| Set up direct deposit | Direct deposit authorization (payroll file) | Before first payroll |
| Provide emergency contacts | Emergency contact form (personnel file) | Day 1 |
| Sign employee handbook | Handbook acknowledgment (personnel file) | Week 1 |
| Sign anti-harassment policy | Policy acknowledgment (personnel file) | Week 1 |
| Sign confidentiality/NDA | Signed NDA (personnel file) | Day 1 or Week 1 |
| Complete required training | Training certificate (personnel file) | Per state requirements |
| Provide proof of insurance (if QSEHRA) | Insurance verification (benefits file) | Week 1 |
When every onboarding task is linked to a document that files into the correct category automatically, the personnel file is complete by the end of Week 1 without anyone manually sorting papers. According to Gallup (2021), as reported in SHRM's onboarding guide, just 29% of new hires felt fully prepared and supported to excel in their role after onboarding. A first week spent chasing paperwork that should already be filed is not what closes that gap.
Common Personnel File Mistakes
| Mistake | Why It Happens | The Fix |
|---|---|---|
| No personnel file exists at all | Founder thinks files are for 'big companies' | Create a file for every employee at hire. Federal law requires specific document retention from Day 1. |
| Medical records in the main file | Doctor's note seems related to an absence, not to 'medical' | Any document revealing health information goes in the separate medical file. Zero exceptions. |
| I-9 mixed into personnel files | Seems logical to keep everything together | Separate I-9 file enables fast audit response. ICE can request all I-9s at once. |
| Missing documents discovered during a complaint | Onboarding did not include a document checklist | Build document collection into onboarding. Each document is a task with a deadline. |
| No signed handbook acknowledgment | Handbook was given but never signed | E-signature during onboarding. The system does not let you skip the signature. |
| No disciplinary documentation | Verbal warnings feel sufficient | Every warning must be written, signed by both parties, and filed. A verbal warning is hard to prove later. |
| Cannot produce file for state access request | Documents scattered across email, folders, and filing cabinets | Centralize all documents in one system per employee. Digital recommended at 5+ employees. |
| Files destroyed too early | No retention schedule; files cleaned out when cabinet fills up | Keep all files 7 years after termination. Label destruction dates on each file. |
The mistake that costs the most is the sixth one: no disciplinary documentation. When a termination leads to a wrongful termination claim and the employer has no written record of performance issues, the claim becomes significantly harder to defend. The employer says "we warned them multiple times." The former employee says "I was never warned." Without documentation, the employer's credibility is at parity with the former employee's. A signed employee warning notice for every incident is what closes that gap.
Frequently Asked Questions
What is a personnel file?
A personnel file is the official record an employer maintains for each employee. It contains documents related to the employment relationship: the job application, offer letter, tax forms, signed policies, performance reviews, disciplinary records, compensation changes, and termination documents. Federal and state laws require employers to maintain certain documents, and the ADA requires medical information to sit in a separate confidential file. USCIS recommends holding I-9 forms separately as well, so that an immigration audit reaches only the I-9s.
What should be in a personnel file?
A personnel file should contain: the job application and resume, signed offer letter, W-4 form, direct deposit authorization, emergency contact information, signed employee handbook acknowledgment, signed policy acknowledgments, non-disclosure or non-compete agreements, performance reviews, disciplinary records, promotion and transfer records, compensation change documentation, training completion records, and the termination letter or resignation. Medical records, I-9 forms, and investigation files should NOT be in the main personnel file.
What should NOT be in a personnel file?
The following should never be in the main personnel file: medical records of any kind (the ADA requires separate storage), Form I-9 and immigration documents (USCIS recommends a separate file so an audit reaches only the I-9s), background check reports and credit checks (FCRA restrictions), EEO and demographic data (prevent bias claims), investigation files (separate for legal privilege), personal notes or unofficial observations, and any document revealing a disability, pregnancy, genetic information, or medical condition.
How long do you have to keep a personnel file?
Federal minimums vary by document type: EEOC requires personnel records for 1 year after the personnel action or an involuntary termination, FLSA and the ADEA both require payroll records for 3 years, ERISA requires benefits records for 6 years, and OSHA requires certain records for 5-30 years. Many states have additional requirements. The safest practice for small businesses: keep all personnel files for 7 years after the employee's last day. This covers the longest common federal and state requirements.
Can an employee see their personnel file?
It depends on the state. Many states give employees the right to inspect their personnel file, with varying rules on timing, copying, and cost. California allows 30 calendar days, Washington 21 calendar days, Oregon 45 days, Massachusetts 5 business days, and Illinois 7 working days. New York joins that group on November 8, 2026, with a 5-business-day deadline and a fine of $500 to $2,500 for missing it. Several states also let an employee attach a written statement of disagreement, which then travels with the disputed document. Even where no access law exists, letting a current or former employee see their own record is the practical choice, because a flat refusal is usually the moment an ordinary dispute turns into a legal one.
Is an employer required to keep personnel files?
Yes. While no single federal law requires a unified personnel file, multiple federal laws require employers to create or retain specific employment documents: FLSA requires payroll records, IRCA requires I-9 forms, EEOC rules under Title VII and the ADEA require keeping the personnel records you do make (applications, promotions, terminations) for at least a year, and OSHA injury logs become mandatory above 10 employees outside the industries OSHA exempts. The practical result is that every employer must maintain records that collectively constitute a personnel file, whether organized as one file or multiple.
What is the difference between a personnel file and an employee file?
In practice, the terms are used interchangeably. Both refer to the collection of documents an employer maintains for each employee. Some HR professionals use personnel file to mean the main employment record (excluding medical and I-9 documents) and employee file to mean the complete set of all files for one person (personnel, medical, I-9, and payroll). The important distinction is not terminology but structure: regardless of what you call it, medical records must be stored separately from the main file, and I-9 forms are best kept in a file of their own.
Can a personnel file be stored digitally?
Yes. Federal law does not require paper personnel files, and digital storage is legally acceptable for employment documents. I-9 forms may be stored electronically too, but USCIS sets conditions for that system: controls that protect the integrity of each form, an audit trail of every change, a detailed index for retrieval, and legible copies for an inspection. E-signatures are valid under the ESIGN Act and UETA for employment documents. Digital storage is recommended for businesses with 5 or more employees because it provides better access controls, search capability, and disaster recovery than paper files.