How to Redact Employee Personnel Files

By the SladdPDF team · Published September 15, 2026 · Updated September 15, 2026

A personnel file is rarely reviewed by just one person. It gets pulled for a state-law records request from a current or former employee, subpoenaed in a wrongful-termination suit, sampled by an outside auditor before an acquisition, or forwarded to a new employer confirming past dates of work. Each of those readers is entitled to see something different — and a file built up over years of hiring, reviews, discipline and leave requests usually contains far more than any one of them needs. This guide covers what belongs in a personnel file, what has to live somewhere else entirely, and how to redact a copy before it leaves HR without uploading it to a third-party server.

What's actually in a personnel file?

"Personnel file" is a working label, not a single legal category — what it contains depends on what HR chose to put there. In practice it tends to accumulate the employment application, offer letter, signed policy acknowledgments, performance reviews, disciplinary notices, promotion and pay-change records, training certificates, and termination paperwork. It should not accumulate everything else an employer holds about a worker.

Two of those rows are separate for the same underlying reason: a request that touches one category should never automatically expose the others. A payroll vendor confirming a name and hire date does not need to see a performance-improvement plan. A hiring manager verifying dates of employment does not need to see a coworker's accommodation request. Filing by category is what makes narrow redaction possible later — mixing everything into one PDF is what makes it hard.

Why medical information can't stay in the main file

The Americans with Disabilities Act does not merely encourage separating medical records from the rest of an employee's file — it requires it. Information an employer obtains about an applicant's or employee's medical condition or history, whether from a post-offer medical exam, a disability-related inquiry, or a request for accommodation, must be collected on separate forms, kept in separate medical files, and treated as a confidential medical record (42 U.S.C. § 12112(d)(3)(B)).

The statute then narrows who can even be told what's inside that file, to three situations the EEOC's enforcement guidance spells out:

• Supervisors and managers may be told about necessary restrictions on the employee's work or duties, and any necessary accommodations — not the underlying diagnosis.
• First aid and safety personnel may be informed, when appropriate, if the condition might require emergency treatment.
• Government officials investigating ADA compliance must be given relevant information on request.

Everyone else — a hiring manager reviewing a candidate for promotion, an auditor sampling files, a manager in an unrelated department — has no statutory basis to see it at all. In practice this means: if a doctor's note, an FMLA certification, or an accommodation request was ever filed in the general personnel folder by mistake, it needs to come out of any copy that leaves HR, not merely be moved going forward. HIPAA's PHI rules are a different, stricter framework that applies to covered healthcare entities — but the instinct to isolate medical detail from routine records is the same one driving both laws.

Form I-9: also stored apart, for a different reason

Form I-9 and the identity and work-authorization documents attached to it get the same separate-file treatment as medical records, but for an operational reason rather than a confidentiality mandate: USCIS recommends that employers keep Form I-9 separate from personnel records specifically to make an inspection easier to handle. Immigration and Customs Enforcement can request I-9s on three business days' notice, and a single binder of I-9s lets an employer respond without pulling — and exposing — the rest of every employee's personnel file in the process.

If your I-9s are filed with the general personnel record, an inspection or an internal audit forces you to either hand over unrelated performance and disciplinary history or spend time separating it under time pressure. Our dedicated guide covers what to redact from an I-9 packet before sharing it for purposes other than a live inspection, including the Social Security number and A-Number.

When an employee requests their own file

Most U.S. states give current and, in many cases, former employees a right to inspect or receive a copy of their own personnel file, though the exact rule varies significantly by state, and some states have no such statute at all. California's version is one of the most detailed: Labor Code § 1198.5 entitles current and former employees to inspect and copy the personnel records relating to their performance or to any grievance, and requires the employer to comply within 30 calendar days of a written request (extendable by five days by mutual agreement).

That last point matters for redaction: a personnel-file access law typically isn't a right to see everything HR holds. California's statute, for example, carves out letters of reference, and records relating to the investigation of a possible criminal offense, from what the employer must disclose at all. Where a category is excluded outright, the right move is to leave it out of the production, not to redact it line by line and include a heavily blacked-out page. Where a document is included but references a coworker — a witness statement naming someone else, for instance — redact that third party's identifying details rather than the employee's own record.

Rules differ enough by state and by requester (a current employee, a former employee, their attorney, a litigation subpoena) that this is genuinely a "check your jurisdiction" area — this article is general orientation, not a state-by-state reference.

Payroll records have their own recordkeeping rule

Wage and hour records sit under a completely different statute than the rest of the personnel file. The Fair Labor Standards Act's recordkeeping regulations (29 CFR Part 516, summarized in U.S. Department of Labor Fact Sheet #21) require covered employers to keep payroll records — including hours worked, rate of pay, and wages paid — for at least three years, while records used to compute wages, such as time cards and piece-work tickets, only need two years.

When a payroll record has to go to an outside party — a lender verifying income, an auditor, a garnishment processor — it usually contains a bank account and routing number for direct deposit alongside the wage data the recipient actually needs. Our guide to redacting a pay stub before sharing it covers exactly what to remove; the same principle applies to a printed payroll register pulled from an HR system.

Why a black box fails on a personnel file

Personnel files accumulate scanned documents from years of onboarding — signed offer letters, faxed reference checks, printed-and-rescanned forms — far more than most digital-native records. Drawing a rectangle over a name or a Social Security number on one of those pages hides it visually but leaves the file's own text layer, and any OCR layer added when it was scanned, completely intact underneath. A black box is not redaction, and the older and more scanned a personnel file is, the more likely it is to carry an invisible OCR text layer nobody remembers adding.

Metadata is the other leak specific to HR files: a PDF exported from an HRIS or scanned on a shared office printer can carry the preparer's name, the originating department, or the software used in fields no page displays. Removing metadata from the PDF on export closes that gap.

A practical HR redaction workflow

Whether the trigger is a state-law access request, a subpoena, or an internal audit, a defensible personnel-file production follows the same shape:

1. Work from a copy, never the file of record. The original personnel file stays intact.
2. Sort by what the requester is actually entitled to. A current employee's own access request, a litigation subpoena, and an internal audit each define a different scope — map the file against that scope before touching anything.
3. Pull out anything filed in the wrong place. Medical notes, accommodation requests, I-9 attachments, and background-check reports that ended up mixed into the general file need to be excluded, not merely redacted.
4. Redact identifiers and third-party information. Social Security numbers, direct-deposit account numbers, and any coworker's name or details appearing only incidentally (a witness in a disciplinary note, for example).
5. Exclude what the applicable law carves out entirely, such as reference letters or active-investigation records under statutes that name those exceptions, rather than producing a page that's mostly black boxes.
6. Export with a method that deletes data, not one that covers it, and strip metadata in the same pass.
7. Verify. Open the result, select all, copy, and paste into a plain text editor — if a redacted name or number appears, start over on that page.

You can run this entire workflow in SladdPDF, a free browser-based redaction tool. It processes files locally with JavaScript and WebAssembly — a personnel file never leaves your device to be redacted, and the tool keeps working offline once the page has loaded. Secure mode rasterizes each page on export, destroying the underlying text and any hidden layers, and metadata removal runs in the same step. The free version has no page limit; Pro unlocks high-resolution 300 DPI export for print-quality output.

This article is general guidance, not legal advice. Personnel-file access and disclosure rules vary by state and by the reason a file is being requested — confirm the specific requirements that apply before producing a redacted file.