Secure Document Sharing for HR Teams

TL;DR: HR teams should share personnel documents through expiring, access-controlled links rather than email attachments, and match the controls to the sensitivity of each file. Offer letters need light protection; payroll, medical and immigration records need identity checks, view-only access and an audit trail, plus a retention schedule that follows employment law.

An HR inbox is one of the densest collections of sensitive information in any company. Passport scans, bank details, salary figures, performance notes, medical certificates and severance terms all pass through it, usually as attachments, usually to people outside the organisation, and usually with no record of who opened what.

That pattern is convenient and risky in equal measure. A misdirected email, a forwarded offer letter or an ex-employee who still has a mailbox full of attachments can turn into a privacy incident. This guide sets out a practical approach: classify the documents, choose controls that fit each class, handle the full employee lifecycle, and keep records for as long as the law expects and no longer.

Why HR documents deserve their own sharing rules

Customer files and financial reports are sensitive, but HR files have two features that raise the stakes. First, they concern identifiable individuals, so a leak harms a person rather than only the company. Second, they cross organisational boundaries constantly: candidates, agencies, background-check providers, payroll processors, benefits brokers, external counsel and, eventually, former employees all need access to some of them.

Because the audience is so varied, one blanket policy fails. Locking down an offer letter as tightly as a medical record frustrates candidates; sending a medical record as casually as an offer letter exposes the employee. The answer is tiering.

A four-tier model for HR files

A simple classification keeps decisions fast. The tiers below are a starting point you can adapt to your own policy and local law.

The tier decides the control set, so a new hire's onboarding checklist does not need a security review each time. It also makes training simpler: staff only have to decide which tier a document sits in.

Controls that matter for personnel documents

Links instead of attachments. An attachment is a copy you cannot recall. A link points to one controlled copy that you can expire or revoke. The comparison in password-protected PDFs versus secure links explains why a password alone is a weak substitute.

Named-recipient access. For anything above the low tier, restrict the link to the exact email address of the intended person. If a candidate forwards it, the recipient cannot open it.

View-only mode. Where a person only needs to read, disable downloading. For a contract that must be signed, send it through the signing process rather than as a loose file.

Expiry. An offer letter has a natural shelf life. A link that dies after fourteen days limits the window in which a forgotten email could be exploited.

Dynamic watermarks. When a document is shown to several internal reviewers, such as a performance panel, a watermark with each viewer's name makes casual leaking less attractive and traceable when it happens.

Audit trail. Knowing who opened a document, when and for how long is useful in two ways: it confirms delivery, and it provides evidence if a complaint or investigation follows.

Onboarding: collecting documents safely

Onboarding is where HR asks for the most sensitive material in the shortest time. New hires send identity documents, tax forms, bank details and sometimes right-to-work evidence, often as phone photos in an email.

A better flow looks like this:

1. Send a single secure request link rather than a long email asking for attachments.
2. Explain exactly which documents are needed and why, to avoid over-collection.
3. Have the new hire upload to a controlled location, not to a personal HR mailbox.
4. Give access only to the people who process each item. Payroll sees bank details; the immigration specialist sees the work authorisation.
5. Delete or archive according to your schedule as soon as the purpose is served.

The guidance on requesting sensitive client documents uses the same logic for any situation where you need someone else's private files, and safe passport copy sharing covers identity documents specifically.

During employment: reviews, changes and internal access

Once someone is on the payroll, the risk shifts from external sharing to internal over-access. Managers often receive documents they do not strictly need, and shared folders tend to accumulate permissions over the years.

Review access to personnel folders on a fixed schedule. Remove people who have changed roles. Prefer sharing a specific document with a specific manager for a specific period over granting standing access to a whole folder. When managers need to review performance paperwork, a watermarked, expiring view is more appropriate than a forwarded PDF.

Be especially careful with sensitive, one-off items: a disciplinary letter, a medical adjustment request or a grievance file. These belong in the highest tier, with the audience listed by name and the access reviewed at the end of the case.

Offboarding and severance

Departure is when mistakes are most expensive. A leaver may be emotional, may have access to systems they should no longer use, and may be negotiating terms that both sides want kept private.

Share severance agreements through a named-recipient, expiring link so the draft cannot circulate freely; the dedicated guide to sharing a severance agreement safely covers the specifics. At the same time, run a file handover checklist: reassign ownership of the departing employee's shared documents, revoke their links and remove stale permissions. The article on transferring files at employee offboarding provides a sequence you can adapt.

Do not forget the reverse flow. Former employees often request copies of their own records. A secure, expiring link to a defined set of documents is safer than attaching them to an email.

Retention: how long to keep personnel records

Sharing securely is only half of the picture; you also need to know when to stop holding the data. In the United States, retention periods come from several sources and are not interchangeable.

The Equal Employment Opportunity Commission explains in its recordkeeping requirements that employers must keep personnel and employment records for one year, and for an involuntarily terminated employee the one year runs from the termination date. Payroll records under the Age Discrimination in Employment Act must be kept for three years. Records relating to employee benefit plans and seniority or merit systems must be kept for as long as the plan or system is in effect and at least one year after.

Separately, the Department of Labor's FLSA recordkeeping fact sheet states that employers must preserve payroll records for at least three years, and that the supporting records used to compute wages, such as time cards and wage rate tables, should be kept for two years.

These figures describe federal minimums for covered employers. State law, sector rules and litigation holds can require longer, and privacy laws in some countries require deletion once the purpose is served. Treat the periods above as inputs to a retention schedule you confirm with counsel, not as a complete answer. Whatever the schedule says, build it into your sharing tools by setting expiry dates and by removing stored copies when the period ends.

Candidates and recruiters

Recruitment generates its own flow of documents. Candidates send CVs, references and sometimes identity documents; agencies send shortlists; hiring managers circulate feedback. Keep candidate files out of general-purpose shared drives, limit who can see interview notes, and delete unsuccessful applications on a defined schedule. If a candidate must send payslips or similar evidence to a recruiter, the article on sending payslips to a recruiter safely offers practical steps from the candidate's side that HR can mirror in its own requests.

Writing a one-page HR sharing policy

Policies fail when they are long. A one-page version that people actually follow can cover:

• The four tiers and an example of each.
• Approved channels. Which tools may be used for each tier, and a clear statement that personal email and messaging apps are not on the list.
• Standing rules. No attachments for high and critical tiers; named-recipient links only; downloads off by default.
• Retention. The schedule, who owns deletion, and how it is evidenced.
• Incident handling. Whom to tell and how quickly if a document goes to the wrong person. The article on sending a confidential document to the wrong recipient gives a response sequence.
• Review cadence. Quarterly access reviews and an annual policy refresh.

Choosing a tool for HR sharing

The right tool depends on volume and sensitivity. Teams with a full HR information system may already have an employee portal for payslips and contracts, and that is often the best channel for those items. A gap usually appears around ad hoc sharing with outsiders: candidates, contractors, advisers, former staff and external counsel.

For that gap, a link-based sharing tool with named-recipient access, expiry, watermarking and an activity log is proportionate. SendNow is one option; disclosure: SendNow is our own product, so compare it with the alternatives you shortlist.

SendNow: secure document sharing with view tracking, NDA gating and dynamic watermarks, from $9/month.

Its document plans run from Lite at $9 through Pro at $17 to Business at $43 per month, and features relevant to HR include expiring links, download blocking and per-viewer watermarks. It is not an HR information system and does not replace a payroll platform.

Frequently Asked Questions

What is the safest way to send an offer letter?+

Send it as a link restricted to the candidate's email address, with an expiry date and view tracking, and keep the downloadable signing step inside your e-signature process. This avoids loose attachments and lets you confirm the candidate opened the letter.

How long should HR keep employee records?+

It depends on the record type and jurisdiction. In the United States, the EEOC lists one year for personnel records and three years for ADEA payroll records, and the Department of Labor lists at least three years for payroll records under the FLSA. State rules, sector rules and legal holds can extend these, so confirm the schedule with counsel.

Is email ever acceptable for HR documents?+

Email is fine for low-tier material such as job descriptions. For payroll, medical, immigration or settlement documents, email creates uncontrolled copies in several mailboxes. A controlled link with named access and an audit log is a better channel.

Who should have access to personnel files?+

Only people with a defined business need: the employee's HR contact, payroll for payroll data, and a manager for specific items such as performance reviews. Review access on a schedule and remove it when roles change.

How do I share documents with an employee who has left?+

Create an expiring link to a defined set of documents, restrict it to the former employee's personal email, and record the delivery. Avoid sending attachments to a mailbox you cannot verify.

What should I do if an HR document goes to the wrong person?+

Revoke the link or recall the message at once, document what was sent and to whom, tell your privacy or legal lead, and follow your incident policy. Fast revocation is only possible when documents were shared as controlled links rather than attachments.