Employee records: what to include, what to leave out, and how long to keep them
Keeping employee records can quickly feel like something reserved for a proper HR department. But even if you only have a few people on staff, managing personnel data carefully matters. In practice, it's not always straightforward: it can be unclear what you need to keep, what you're not allowed to store, and when something needs to be deleted.
The most important thing to know: there's no single retention period that applies to the entire employee file. And the most common problem isn't that employers keep too little... it's that they keep too much.
What belongs in an employee record?
As an employer, you'll need at least the following:
The employment contract and any amendments
Personal data required for the contract and payroll administration
A copy of the employee's ID
The payroll tax form (loonbelastingverklaring)
Relevant documents about the employee's performance
Records of vacation days, leave, and sick leave
Documents like a certificate of conduct, diplomas, or professional certifications can also be part of the file if they're relevant to the role.
What doesn't belong in an employee record?
Not all information about an employee can be stored. The GDPR prohibits keeping special categories of personal data unless a specific legal exception applies. This includes data about health, religious beliefs, political views, trade union membership, sexual orientation, and racial or ethnic origin. Criminal records also cannot be stored without a legal basis.
A common mistake is that medical details end up in the file when someone calls in sick, entered by a manager or HR contact. You are not allowed to note things like:
"Employee is off sick due to burnout."
Or:
"Employee had knee surgery."
Even if the employee mentions having a headache and staying home, you don't record that. As an employer, you don't need to know the diagnosis, cause, or treatment of an illness.
What you should keep: the date the sick leave started and when the employee returned to work. That's what you need for continued salary payments and sick leave tracking.
How long do you need to keep employee records?
As mentioned earlier, there's no fixed retention period for the employee file as a whole. Different rules apply to different types of data:
Payroll administration: 7 years
Copy of ID and payroll tax form: at least 5 years after the end of the calendar year of departure
Employment contract, performance reviews, Poortwachter documents: 2 years after departure
Other personal data: no longer than necessary, unless a legal retention obligation applies
A practical rule of thumb: for every document, ask yourself why you're keeping it, whether you still need it, and whether there's a legal obligation to retain it.
Applicant data. If you didn't hire someone, delete their data once it's no longer needed for the application process. If you want to keep it on file for a future opening, you can only do so with the applicant's explicit consent.
Who can access the file?
Not everyone in your organization needs access to personnel records. Only give access to people who need the data to do their job, such as a direct manager. Separately, every employee always has the right to view their own data, without having to explain why.
Can you keep employee records digitally?
Yes. Digital storage can actually be more practical, especially with a small team. But digital doesn't automatically mean secure. Make sure you have access restrictions in place, strong passwords, proper security, and a clear procedure for deleting data when it's no longer needed.
Keeping employee records as a small business
In practice, personnel administration at small companies often looks like this: an employment contract in Google Drive, a certificate of conduct somewhere in a folder, a performance review as a Word file, leave tracked in a spreadsheet, and sick leave information buried in an email thread.
Separately, that might work fine — until you need to find something, or you start wondering: "Are we even still allowed to keep this?"
A central place for all of it makes things a lot simpler.
How Heartsome helps
In Heartsome, you keep employee data, contracts, and documents in one place. You set access rights per document, so sensitive information is only visible to the right people. And you can attach an expiry date to documents, so you get a notification when something needs to be renewed or deleted. Leave and sick leave are managed from the same environment, so you're no longer hunting through spreadsheets, folders, and loose files.
Or read more about Heartsome for small businesses →
A good employee file isn't one where you store as much as possible. It's one where you store exactly enough — in the right place, for the right amount of time.
This article is based on Dutch law (GDPR as implemented in the Netherlands and Dutch employment law). The rules around employee data can change over time. This article gives a general overview and is not legal advice. When in doubt, always consult a lawyer or HR advisor.