enaio personnel file: access rights concept and retention periods by document type

That is defined by the access rights concept. HR administration works with the complete files of its area of responsibility, payroll accounting with the Pay register, managers see only approved document types of their team. Health data is held in a separate register with a named group of people, and IT administration has no read access to contents.

What matters is whether rights can be assigned through roles to registers and document types, whether index data such as the organisational unit controls views and whether accesses are logged. enaio offers these means. Whether the rights management is GDPR-compliant in the end is decided by the configuration, which is why we agree the rights matrix with your data protection in advance.

As a time-limited assignment to the role being covered, with reason, scope, start and end. HR management approves the deputising, and after the end date the right lapses. For health data, deputising takes place only within the named group of people, and for workflow tasks the deputising is defined in the workflow.

The audit trail records who opened, changed or deleted which file or document and when. Who may evaluate the logs and for what reason you define in the concept, and where a works council exists, in the works agreement. A reason-based evaluation with the involvement of data protection and the works council is customary.

Document management systems such as enaio, in which every document type carries a retention rule consisting of a duration and a start event. Once the period has expired, the system proposes the deletion, an authorised person confirms it, and a deletion log is archived. Automatic does not mean uncontrolled here: deletion blocks for ongoing proceedings are checked before confirmation.

Every period you define in the retention catalogue, as a rule on the document type. Typical examples are eight years for payslips as accounting records under § 147 AO, the payroll account under § 41 EStG and at least two years for working-time records under § 16 ArbZG or § 17 MiLoG. For documents without a statutory period you store the duration from your deletion concept.

From the start event that applies to the document type. For accounting records this is the end of the calendar year in which they arose, for the payroll account the year of the last wage payment, for applications the receipt of the rejection and for many contractual documents the departure. The start date comes as index data from the payroll or applicant system.

enaio proposes the deletion as soon as a period has expired. Deletion only happens once an authorised person has confirmed it. For warnings and other individual cases without a fixed period we set up a follow-up reminder instead of a deletion, so that a decision is made case by case.

They receive a deletion block. Art. 17(3) GDPR exempts data from the obligation to delete as long as it is necessary for the defence of legal claims. The block is checked before every confirmation and only lifted once the reason has ceased to apply. After that the regular deletion rule takes effect.

Not across the board. Under § 83 BetrVG an employee may bring in a works council member when inspecting their own file. The works council receives further views only insofar as law and the works agreement provide for it. On the introduction and on the evaluation of logs it has co-determination under § 87(1) no. 6 BetrVG.

A recertification once a year and a review of the time-limited deputising arrangements once a quarter have proven effective. HR management confirms the HR roles, the division heads their managers. What is not confirmed is withdrawn, and data protection documents the result.

Above all on the number of roles and areas of responsibility, the number of document types, the systems from which start events come, and whether a works agreement is being renegotiated. You receive a concrete quote after a short conversation via our contact form.