An operational description of a digital employee file: which documents accumulate, why they scatter across systems, who may see what, and what happens when somebody leaves.
Key takeaways
- An employee file is not one folder - it scatters across payroll, email, signed documents and operational systems.
- The practical problem is not what is kept but that nobody knows where all of it is.
- View permissions are the difference between "data exists" and "data is exposed".
- Departure day is the critical checkpoint, and at most businesses it passes with no check at all.
- What is kept and for how long is settled with legal counsel and the accountant, not in an internal procedure.
This is an operational description of managing a digital employee file, not legal or employment-law advice. What must be kept, for how long, and what may be asked for all go to legal counsel and the accountant. What can be described: documents about an employee accumulate in four different places, and that is what turns every question about them into a search.
What is an employee file, and which documents go into it?
An employee file is the set of documents an employer gives, receives and records about one employee. Several of them come with a deadline set by law. The table below lists them as Kol Zchut, the Israeli rights information site, describes them, without interpretation; how long each must be kept is not stated on those pages and stays a question for counsel and the accountant.
| Document | Source as cited by Kol Zchut | Timing | Where it usually sits digitally |
|---|---|---|---|
| Written notice of employment terms | Employee Notice Law (Terms of Employment) | No later than a month from the start of work (7 days for a minor); a change within 30 days (7 days for a minor) | Signature system or email |
| Form 101 | Israel Tax Authority form | Within 7 days of starting or on the first payday, whichever is earlier; again at the start of every tax year and within 7 days of a change | Payroll, or the online Form 101 |
| Payslip | Wage Protection Law | No later than the ninth day after the date the wage is due | Payroll system |
| Wage ledger | Wage Protection Law, section 24 | Entry no later than the ninth day after the wage is due | Payroll system |
| Work and rest hours ledger | Hours of Work and Rest Law, section 25 | Ongoing, reflecting the hours actually worked | Attendance system |
Two details from the same pages change how a digital file works. A payslip may be delivered electronically only if the employee agreed in writing and signed a consent form, under the Wage Protection Regulations (Special Ways of Delivering Payslips), and a written change of mind at any time sends the employer back to a regular payslip. And when the hours ledger is not kept by mechanical, digital or electronic means, the employee signs it every day and a person the employer appointed approves it.
Why the file scatters by itself
Nobody decides to spread documents about an employee across five systems. It happens because each document is created somewhere else: the employment contract is signed in a signature system, the tax form goes to whoever handles payroll, payslips sit in the payroll product, leave notices are in WhatsApp, and an equipment handover confirmation is in email.
The result is that every document has a sensible home and the file as a whole has none. That is also why "what do we hold on this person" cannot be answered in a minute even at an eight-person business - not because anything was hidden, but because there was never a list.
The four places employee data sits
| The place | What is usually there | Who actually reaches it |
|---|---|---|
| Payroll system | Payslips, employment data, bank details | Bookkeeper, accountant |
| Signed documents | Contract, annexes, acknowledgements | Whoever ran the signing, usually the owner |
| Mailboxes and chat | Messages, approvals, requests | Everybody who was in the thread |
| Operational systems | Shifts, tasks, access | Direct managers |
The third row is the problematic one. Employee information sitting in an email thread or a WhatsApp group is not managed in any way: it has no permissions, no expiry, and it stays with everybody who was there - including after that person changed role or left.
What is worth holding in one place
There is no need to centralise everything; what is worth centralising is a list that points at everything. One employee record holding:
- The basic identifying details and the start date.
- A link to wherever each signed document lives.
- A list of the access and systems granted to the employee.
- A list of equipment issued in their name.
- Who the direct manager is, and when that changed.
- The date the record was last reviewed.
The third item pays for itself immediately, and it is also the only one on the list nobody keeps. Without an access list, closing access on departure day becomes a memory exercise, and memory always misses the system opened a year ago for a single project.
Permissions: the difference between existing and exposed
Employee data is not dangerous because it exists but because it is reachable by somebody with no reason to see it. Three failures recur:
- A shared payroll spreadsheet on a drive the whole team can see, because it was once convenient.
- A manager who left still holding access to a system with employee data.
- An outside supplier - an accountant or consultant - with broader access than required.
The third is the least discussed and the easiest to fix: a supplier's access should be scoped to what they need, and in their own name rather than an employee's. That is also what makes it possible to know who saw what, which is precisely the question that arises when something leaks.
Departure day: the check nobody runs
On the day somebody leaves, three things usually happen: equipment comes back, the mailbox is closed, and payroll is finalised. What is not done is going through the access list - because, as noted, there is not one.
The procedure that works is a short check against the record, covering five things: system access, access to external services, equipment, documents the employee holds, and authorisations with outside bodies such as the Tax Authority. That last item is the forgotten one, and it belongs to the same review described in the Tax Authority's online services.
What remains after departure - which documents, and for how long - is a question for legal counsel and the accountant. What is operational is that one decision exists, is applied identically to every employee, and that somebody can state what it is.
What happens on the first day
The same record used on departure day is built on the first day, and there it is cheap. A new employee typically receives between five and ten kinds of access in their first week - email, the operational system, a shared drive, and often an external tool or two - and each is granted by a different person, with no record.
What is needed is not a formal onboarding process but one line: who granted which access and when. Five minutes in the first week, and departure day turns from a memory exercise into a list you work through.
It has an immediate second benefit: it answers "who has access to this system" without opening the system. That question comes up far more often than people expect - when changing supplier, when something breaks, and when reviewing subscription costs.
What changes when the employee file moves from paper to digital?
Moving an employee file to digital does not remove documents; it adds two that a paper file never had. The first is the signed consent to an electronic payslip, which has to be findable, together with any later written withdrawal, because the withdrawal changes what payroll must send. The second is the attendance export: a digital attendance system replaces the daily signature, so the record of hours now lives in that system rather than in a binder. In practice the employee record from the list above gains two more pointers - where the payslip consent sits, and which attendance system holds the hours.
How does this connect to an access request?
An employee or former employee can make a request about the data held on them, and that is exactly where a scattered file turns from an administrative nuisance into a timeline problem. A business that does not know where the data sits will not answer within a reasonable window.
So the work on an orderly employee record is not separate from the process described in handling an access or deletion request - it is its first stage, and at a small business it is also the only stage requiring real effort.
Sources
- Kol Zchut - notice of employment terms
- Kol Zchut - Form 101
- Kol Zchut - payslip
- Kol Zchut - keeping a wage ledger
- Kol Zchut - work and rest hours ledger
- Israel Privacy Protection Authority
- Israel Labour Administration - information for employers
- Handling an access or deletion request
- A personal data map for a small business
- Book a call
Frequently asked questions
Do you need dedicated HR software?
At a ten-person business, no. What is needed is one record per employee pointing at everything else, and that works fine in a spreadsheet - as long as it is permission-limited and not sitting on a shared drive.
Who needs access to employee files?
Whoever runs payroll and whoever manages the employee, at different scopes. What does not work is access by seniority or by job title, because it produces exposure with no use.
What about employee data in WhatsApp?
Operationally, what matters is moving decisions and approvals into a managed place rather than leaving them in chat. What may be retained from such correspondence, and for how long, is a matter for legal counsel.
Should you keep a copy of an ID document?
That is a distinctly legal question settled with counsel, not in an internal procedure. What is operational is knowing exactly where each identifying document is held, so that any decision is capable of being carried out.
What goes into an employee file?
Among the documents Kol Zchut describes: the written notice of employment terms, Form 101, payslips, the wage ledger and the work and rest hours ledger. In a digital file each sits in a different system - signatures, payroll, attendance - so a single employee record that points to all of them is what makes the file manageable.
Can a payslip be sent to the employee by email?
According to Kol Zchut, an electronic payslip requires the employee's written agreement and a signed consent form, under the Wage Protection Regulations (Special Ways of Delivering Payslips). A written change of mind at any time obliges the employer to return to a regular payslip. The signed consent is worth keeping in the employee record.
When must the notice of employment terms be given?
Kol Zchut states that the written notice must be given no later than a month from the start of work, and within 7 days for an employee under 18. A change in the terms is notified within 30 days of the change, or 7 days for a minor. The law is the Employee Notice Law (Terms of Employment).
Keep reading
Related service
MVP Development
Turn an idea into a validated product in weeks, not months.
Have a project like this?
Tell me what you're trying to automate or build. I reply within 24 business hours with a few targeted questions, then we walk through it on a free 30-minute call, with no commitment. You come away with a scope, a timeline and a fixed price - or a straight answer that it isn't worth building.