Personnel files and GDPR in Poland sit at the intersection of two legal regimes that every HR team has to satisfy at the same time: the Polish Labour Code's record-keeping requirements, and the EU General Data Protection Regulation. An employee's personal file typically holds recruitment data, medical examination certificates, contracts and disciplinary records — much of it sensitive. Getting the legal basis, structure and retention rules wrong is one of the most common findings during a National Labour Inspectorate (PIP) or data protection authority (UODO) audit. This article walks through the legal basis for processing, the five-part file structure, how long records must be kept, and how a digital employee-file module can reduce the compliance burden.
What personnel files are and why GDPR applies to them
A personnel file (akta osobowe) is the set of documents and declarations that track an employee's relationship with their employer — from recruitment through to termination. The obligation to maintain one arises from the Polish Labour Code (Article 94, points 9a and 9b) and from the regulation of the Minister of Family, Labour and Social Policy of 10 December 2018 on employee documentation.
Because personnel files contain personal data as defined by GDPR — including special-category data such as health information from medical certificates — the employer acts as the data controller for this documentation. That means the employer must ensure collection, storage and disclosure comply with GDPR's core principles: lawfulness, data minimisation, purpose limitation, integrity and confidentiality, and accountability.
Importantly, maintaining a personnel file does not require the employee's consent. The legal basis is the employer's legal obligation under Article 6(1)(c) GDPR, read together with the Labour Code and the documentation regulation. For health data such as medical certificates, Article 9(2)(b) GDPR provides the additional basis. Employee consent (Article 22¹a of the Labour Code) is only needed when an employer wants to collect data beyond the statutory catalogue.
The five-part structure: parts A, B, C, D and E
Since 21 March 2023, a Polish personnel file is divided into five parts:
• Part A – documents collected during recruitment (personal questionnaire, CV with the candidate's consent) and referrals or certificates from pre-employment, periodic and follow-up medical examinations.
• Part B – documents related to establishing employment and its course: the employment contract, job duties, remote-work arrangements, flexible working requests and parental-leave-related applications.
• Part C – documents related to termination of employment (notice, employment reference/certificate).
• Part D – documents related to an employee's disciplinary liability (warnings, reprimands) — removed from the file after a year of unblemished conduct.
• Part E – documents related to sobriety checks or checks for substances with effects similar to alcohol.
Documents in each part must be stored in chronological order, numbered, and preceded by a list of contents — a formal requirement regardless of whether the file is kept on paper or electronically. Mixing documents between parts A–E is one of the most frequent findings in labour inspections.
Common GDPR mistakes in personnel files
The same handful of errors turn up repeatedly in HR audits, and each one breaches both GDPR and Labour Code rules:
• photocopying or scanning an ID card instead of noting only the necessary data from it,
• collecting candidate or employee photographs without a legal basis,
• requesting a criminal record certificate for positions where the law doesn't require one,
• failing to provide a GDPR privacy notice at the point data is collected,
• mixing documents across parts A–E,
• storing files without access control (unlocked cabinets, shared folders without permissions).
The data minimisation principle means an employer may only collect data that is strictly necessary to meet obligations under labour law — nothing more.
How long to keep personnel files in 2026
Retention depends on the employee's hire date:
• 10 years from the end of the calendar year in which employment ended, for employees hired on or after 1 January 2019.
• 50 years for employees hired earlier, with the option to shorten this to 10 years for those employed between 1999 and 2018, provided the employer files the ZUS OSW declaration and ZUS RIA information report with the Social Insurance Institution.
Once the retention period expires, the employer must notify the former employee that the documentation is available for collection; if unclaimed, it may then be destroyed. Employees and former employees also have the right to request a copy of all or part of their file at any time — the employer must provide it within 30 days.
Electronic personnel files (e-akta) under GDPR
Polish law allows personnel files to be kept electronically, provided the system guarantees confidentiality, integrity, completeness and availability, and protects the documentation from damage or loss. The format must be uniform — an employer keeps either exclusively paper files or exclusively electronic ones (switching format is allowed but requires formal notice to employees).
In practice, electronic files mean less paper, faster access to HR data, and an easier path to meeting retention and security obligations — as long as the system used genuinely satisfies the regulation's requirements.
How Time Harmony supports compliance with employee documentation rules
The electronic employee file module in Time Harmony brings together key HR data — occupational medical examinations, training and competencies, contracts and employment details, and assigned company resources — in one secure digital environment, instead of scattered paper records.
The system automatically reminds HR of upcoming medical examination deadlines and expiring qualifications, reducing the risk of missing obligations under the Labour Code. Access is restricted to authorised users based on assigned roles, and data is encrypted both in transit and at rest — aligning with GDPR's requirements for the security and confidentiality of HR documentation. Because the employee file module is integrated with time-and-attendance tracking, data doesn't need to be duplicated across systems, which itself supports the data minimisation principle.
Personnel files are only one part of an employer's record-keeping duties: the same regulation also requires separate documentation of working time, which we cover in Recording Working Hours – Legal Requirements and Employer Responsibilities.
Penalties for missing or incorrect personnel files
A labour inspector can request a fine of between PLN 1,000 and PLN 30,000 against an employer who fails to maintain or store employee documentation, or who stores it in conditions that risk damage or loss. Independently of Labour Code sanctions, a GDPR breach in how personnel-file data is processed can trigger separate proceedings before the President of UODO, Poland's data protection authority.
Easily manage your company's working time
