what information may I record in the personnel file of an employee

What belongs and what does not belong in an employee file

An employee file should contain what is necessary to carry out the employment relationship: contract details, position, salary, absence and leave records, appraisals and correspondence about the employment. What should not be included are data that serve no identifiable purpose: notes about someone's private life, opinions about political preferences, assumptions about health outside what is necessary for absence management, or copies of identity documents kept longer than the purpose for which they were requested. The question is never "might this happen to be relevant", but whether the data is actually necessary for a concrete, identifiable purpose within the employment relationship.

This also means that a file grows and shrinks with the circumstances: what was relevant at the time of application may become unnecessary after employment begins, and data recorded during a period of illness should not remain in the file without reason after the person returns to work. How long data may be kept after the purpose has ceased is described under retention periods for personnel and application data. For special data, such as health data, a stricter standard applies than for ordinary personnel data, and that standard is described on the page about the legal grounds on which processing is permitted.

Where this derives from: Article 5 and Article 6 GDPR

That an employee file remains limited to what is necessary follows from Article 5 of the GDPR, which sets out the principles of data minimisation and storage limitation: data are not kept longer or more broadly than the purpose requires. Whether data may be processed at all depends on a valid legal ground as set out in Article 6 of the GDPR — for most personnel data this is the necessity for the performance of the employment contract. These two articles together determine the scope of the file: no legal ground, then no processing; no purpose any longer, then no storage any longer. The Dutch Data Protection Authority provides further guidance on this for Dutch practice, while the core of these standards comes directly from the regulation itself and is therefore the same in every member state.