Under German law, an employer may keep personnel files digitally and in the cloud. No statute requires paper, and no statute requires a personnel file (Personalakte) at all. What matters is a valid legal basis, a processor agreement, clear access rights, retention and deletion rules and, where a works council exists, its co-determination.
For many companies the trigger is arriving on its own. From 1 January 2027, employers can no longer be exempted from keeping payroll records electronically. This guide explains what applies to a digital personnel file in Germany, which retention periods apply to which documents, and where the most common gaps are.
German law does not define the "Personalakte" for private employers. The Federal Labour Court (Bundesarbeitsgericht, BAG) treats it as all records about an employment relationship, wherever they are stored. This "material" personnel file therefore includes documents kept in another folder or system.
There is no duty to keep a personnel file as such. There are separate documentation and retention duties: the payroll account under § 41 EStG, payroll records under § 28f SGB IV, working time records, the written statement of essential terms under the Nachweisgesetz, and tax retention rules. In practice, all of this ends up in the personnel file.
Under § 8(2) of the Beitragsverfahrensverordnung, certain documents must be added to the payroll records in electronic form, such as social insurance notification data, work permits and declarations by marginal employees. Until now, employers could apply to the German pension insurance audit service for an exemption. That option exists only "until 31 December 2026".
This is not a duty to digitise the entire personnel file. It concerns payroll records. Companies that have to convert this part anyway can move the rest of the file in the same step.
For years, § 26 of the Federal Data Protection Act (BDSG) was the basis for processing employee data. In 2023 the Court of Justice of the EU ruled that an identical rule in Hesse must not be applied if it does not meet the requirements of Art. 88 GDPR. On 8 May 2025 (8 AZR 209/21) the BAG concluded that § 26(1) BDSG must not be applied. The provision is still on the books, but employers now rely directly on Art. 6 GDPR.
For the personnel file, whatever is needed to perform the employment contract falls under Art. 6(1)(b) GDPR. Legal obligations such as payroll and social insurance data fall under Art. 6(1)(c). Anything else needs a legitimate interest with a balancing test, or consent, which is rarely truly voluntary in an employment relationship. There is no dedicated German employee data protection act yet. The October 2024 draft was not adopted before the previous coalition ended, and no new draft has been published.
The GDPR does not prohibit the cloud. Storing personnel files with a provider requires a processor agreement under Art. 28 GDPR, appropriate technical and organisational measures under Art. 32 GDPR, and a list of sub-processors. With providers outside the EU, international data transfers have to be assessed as well.
The EU-US Data Privacy Framework is valid; the EU General Court upheld it in September 2025. An appeal against that judgment is pending. With a provider based in Germany, data centres in Germany and sub-processors in the EU, the transfer question does not arise.
A May 2025 ruling shows how closely courts look. A group had transferred real employee data into a cloud HR system for testing, beyond what its works agreement allowed. The BAG awarded the employee 200 euros in damages. Testing with real data is only permitted if anonymised test data are not sufficient.
Sick notes, documents from occupational reintegration (BEM) and occupational health certificates are health data under Art. 9 GDPR. As early as 2006, the BAG held that such data must be stored in the personnel file with special protection; at the time, in a sealed envelope. In a digital file, that means a separate area that only a few named people can open, with access logged.
| Part of the file | Typical access |
|---|---|
| Contract, master data, references | HR team, head of HR |
| Payroll and social insurance | HR team, payroll provider or tax adviser |
| Health, BEM | named people only, access logged |
| Warnings, appraisals | head of HR, the line manager where needed |
| The employee's payslips | HR team and the employee |
Line managers rarely need the whole file. The finer the rights per folder, the easier it is to justify every access.
There is no single retention period for a personnel file in Germany. Periods attach to each document. The table shows the most common ones.
| Document | Period | Legal basis |
|---|---|---|
| Payroll account (Lohnkonto) | until the end of the sixth calendar year after the last wage payment | § 41(1) EStG |
| Accounting vouchers, e.g. payslips used as vouchers | eight years | § 147(3) AO |
| Books and annual accounts | ten years | § 147(3) AO |
| Payroll records (Entgeltunterlagen) | until the end of the calendar year after the last social insurance audit | § 28f(1) SGB IV |
| Overtime records | at least two years | § 16(2) ArbZG |
| Files of rejected applicants | no statutory period; supervisory authorities' practice is about six months | § 15(4) AGG, § 61b ArbGG |
Since 1 January 2025, accounting vouchers are kept for eight instead of ten years. This also covers older vouchers whose old period had not expired by the end of 2024. Books and annual accounts stay at ten years. Once an employee leaves, anything no longer covered by one of these periods should be deleted. A deletion concept (Löschkonzept) defines when each folder is reviewed.
Where a works council exists, it usually has a right of co-determination when a digital personnel file is introduced. Under § 87(1) no. 6 BetrVG, it is enough that a system is objectively suitable for monitoring behaviour or performance. Whether the employer intends to monitor is irrelevant. Access logs or reports are enough to meet that test.
The usual route is a works agreement (Betriebsvereinbarung) covering access rights, logging and deletion periods. It must itself comply with the GDPR and cannot lower its protection, as the Court of Justice of the EU held in December 2024.
Under § 83 BetrVG, employees may inspect their personnel file and bring a works council member. They may add statements, which must be attached to the file.
The right of access under Art. 15 GDPR applies alongside. On 16 April 2026 (8 AZR 169/25) the BAG clarified that the copy generally covers the personal data, not the entire document. A well-organised digital file makes both rights easier to meet, because one employee's documents are in one place.
For tax records, Section 147(2) of the German Fiscal Code (AO) allows storage as scans if this complies with proper accounting principles and the image matches the original. Annual accounts and the opening balance sheet are excluded. In practice this requires documenting the scanning process. The German Federal Office for Information Security's technical guideline RESISCAN describes how to do this securely. It is not mandatory for companies, but it is a good benchmark.
Some originals should still stay in a paper archive, because their validity or evidential value depends on the handwritten signature.
The written statement of employment terms, by contrast, has become easier. Since 2025 it may be sent electronically in text form, provided the employer requests a confirmation of receipt. This does not apply in certain sectors covered by the act against undeclared work, and employees can still ask for a signed paper copy. Our guide E-signatures in Germany: when SES, AdES or QES is enough covers the signature levels.
Almost every mid-sized company regularly sends personnel documents outside, for example salary changes to the payroll provider, certificates to the tax adviser or documents to insurers. This often happens by email attachment. Health or salary data then sit unencrypted in several mailboxes, and nobody can later say who still has which file.
A safer route is a share link to a folder that contains only the necessary files, protected by a password and an expiry date. The recipient downloads the file or edits it in the browser, access is logged, and once the link expires it no longer works. A processor agreement with the payroll provider belongs in place as well.
SecureCloud is not payroll software and not an HR system with workflows. It is where the documents of the personnel file are stored and shared. HR teams create one folder per employee and set read and write rights per folder. Every file keeps its version history, and documents go to the payroll provider or tax adviser via links with a password and an expiry date.
The data are stored exclusively in German data centres. SecureCloud is ISO/IEC 27001 certified (TÜV Rheinland), BSI C5 attested and GDPR compliant. Contracts that do not require paper by law can be signed electronically with SecureSign, including with a qualified signature. More on use in HR teams: SecureCloud for HR.
If you want to try a personnel file structure, you can test SecureCloud free for 14 days.
This article gives a general overview of German law and does not replace legal advice in an individual case. As of October 2026.
Yes. It needs a processor agreement, appropriate safeguards, clear access rights and, for providers outside the EU, a legal basis for the data transfer.
No. No German statute requires one. Separate duties exist, for example for the payroll account, payroll records and working time records, which in practice end up in the personnel file.
It depends on the document. The payroll account until the end of the sixth year after the last wage payment, accounting vouchers eight years, payroll records until the year after the last audit.
Usually yes. Under § 87(1) no. 6 BetrVG it is enough that the system is objectively suitable for monitoring behaviour or performance. A works agreement is the usual route.
Many may, if the scanning process is documented. Terminations, termination agreements and signed fixed-term contracts should be kept in original, because their validity depends on written form.
They may inspect the file. According to the BAG on 16 April 2026, the copy under Art. 15 GDPR generally covers the personal data, not the entire document.
The exemption from keeping records electronically under § 8(3) BVV ends on 31 December 2026. From 2027 the payroll records listed there must be kept electronically.
Through a protected share link instead of an email attachment, with a password, expiry date and access log, plus a processor agreement with the payroll provider.