The personnel file holds a business’s most sensitive data: salary, absences, appraisals and often medical certificates. Since 1 September 2023 the totally revised Federal Act on Data Protection (DSG) has applied, and it applies to the smallest SME too. This guide to employee data protection shows what employers must do: inform, give access, limit access rights and delete data in good time. It separates what the statute says from what is proven practice.
Basis: Art. 328b CO and the DSG
The employer may process data about employees only to the extent that they concern the employee’s suitability for the employment relationship or are necessary for performing the employment contract; otherwise the Data Protection Act applies (Art. 328b CO). Personal data are all information relating to an identified or identifiable natural person. Data on health are, among others, particularly sensitive (Art. 5 lit. a and c DSG). This affects sickness absences and medical certificates.
The principles in everyday work
Art. 6 DSG sets out the principles: personal data must be processed lawfully and in good faith, processing must be proportionate, data may be collected only for a specific and recognisable purpose, and they are destroyed or anonymised as soon as they are no longer needed for it (paras. 1 to 4). Anyone who processes data must make sure they are accurate (para. 5). Where consent is needed, it is valid only if given voluntarily, after appropriate information, for specific processing (para. 6); for particularly sensitive personal data it must be explicit (para. 7 lit. a). The Federal Data Protection and Information Commissioner (FDPIC) points out that, because of their subordinate position, employees only very rarely can consent freely, refuse consent or withdraw it. Do not rely on consent, therefore, where the contract or the law permits the processing anyway.
For the personnel file this means: file only what is necessary for the employment relationship. As early as its 2014 guide, the FDPIC states that there must be no “grey” second files with confidential information the person cannot see, and recommends cleaning up the file regularly (as a rule every second year).
Duty to inform
Anyone who collects personal data informs the person concerned appropriately. At least the identity and contact details of the controller, the purpose of processing and, where applicable, the recipients must be communicated; if data are disclosed abroad, also the state and the safeguards (Art. 19, paras. 1, 2 and 4 DSG). In practice this is a data protection notice for employees that you hand over on joining, and a data protection notice in the application form. Wilful breach of the duty to inform is punished on complaint with a fine of up to CHF 250’000 (Art. 60, para. 1 DSG).
Employees’ right of access
Every person can ask the controller for information on whether personal data about them are being processed (Art. 25, para. 1 DSG). In every case they receive the identity and contact details of the controller, the personal data processed as such, the purpose, the retention period or the criteria for it, the available origin of the data and, where applicable, the recipients (Art. 25, para. 2 DSG). The rules at a glance:
- Form: The person submits the request in writing; if you agree, orally is also possible. Electronic submission is permitted. You must take appropriate measures to identify the person (Art. 16 DSV).
- Period: The information is normally provided within 30 days of receipt of the request (Art. 25, para. 7 DSG, Art. 18, para. 1 DSV). If that is not possible, you inform the person and state the period within which the information will follow (Art. 18, para. 2 DSV).
- Costs: The information is free of charge; where the effort is disproportionate, a contribution to costs of at most CHF 300 can be requested, which you must announce beforehand (Art. 25, para. 6 DSG, Art. 19 DSV).
- No waiver in advance: Nobody can waive the right of access in advance (Art. 25, para. 5 DSG).
- Restrictions: You may refuse, restrict or postpone the information, for example because of overriding interests of third parties or if the request is manifestly unfounded; you must then state the reasons (Art. 26, paras. 1 and 4 DSG).
- Health data: They can be communicated to the person, with their consent, through a healthcare professional designated by them (Art. 25, para. 3 DSG).
The right of access continues after leaving. Incorrect data must be corrected on request (Art. 32, para. 1 DSG).
Access, security and breaches
Controllers must ensure, through appropriate technical and organisational measures, data security appropriate to the risk (Art. 8, para. 1 DSG). The Data Protection Ordinance names confidentiality, availability, integrity and traceability as objectives (Art. 2 DSV). Particularly important for the personnel file:
- Access control: Authorised persons have access only to the data they need for their tasks (Art. 3, para. 1 lit. a DSV). Payroll accounting does not need medical certificates, and line managers do not need other teams’ salary data.
- Input control: It must be possible to verify which personal data were entered or changed, when and by whom (Art. 3, para. 3 lit. a DSV).
- Logging: An express duty to log access exists for private controllers only if particularly sensitive personal data are processed automatically on a large scale or high-risk profiling takes place, and the preventive measures do not guarantee data protection; the logs must be kept for at least one year, separately from the system (Art. 4, paras. 1 and 5 DSV).
- Register: Companies with fewer than 250 employees on 1 January are exempt from the duty to keep a register of processing activities, unless they process particularly sensitive personal data on a large scale or carry out high-risk profiling (Art. 12, para. 5 DSG, Art. 24 DSV). What “on a large scale” means, the statute does not say; if in doubt, keep a register (practice).
- Report a breach: A data security breach that is likely to lead to a high risk for the person concerned you report to the FDPIC as soon as possible (Art. 24, para. 1 DSG). The report is made through the FDPIC’s online form.
Retention and deletion
There is no statute with a single period for the personnel file. Different periods apply to each document:
| Document | Period | Reference |
|---|---|---|
| Payslips and other accounting vouchers | 10 years from the end of the financial year | Art. 958f, para. 1 CO |
| Working time records | at least 5 years after expiry of validity | Art. 73, para. 2 ArGV 1 |
| Limitation of claims from the employment relationship | 5 years | Art. 128 no. 3 CO |
| Rejected applications | return or destroy; practice: at least until the three-month time limit for bringing an action has expired | FDPIC; Art. 8, para. 2 GlG |
| Talent pool | until the agreed date, with consent | FDPIC |
| Rest of the personnel file | set for each type of data; the FDPIC generally mentions 5 to 10 years, depending on statutory requirements (2014 guide: rule 5, exceptionally 10) | FDPIC; practice, not statutory |
The guide dates from before the revised DSG; the principles continue to apply, but set the periods for each type of data in writing and keep to them. After the period expires, you delete or anonymise the data (Art. 6, para. 4 DSG). Check beforehand whether proceedings are pending or a reference letter might be requested.
Practical example: Muster Elektro AG
Muster Elektro AG is a fictitious business with 45 employees (as at 1 January 2026). Because it keeps records of sickness absences and medical certificates, it maintains a register of processing activities as a precaution.
On Tuesday, 3 November 2026, a former employee requests information in writing. The reply is due by Thursday, 3 December 2026 at the latest (30 days from receipt). The HR manager prepares the export on 10 November, checks it for third-party data and sends it on 12 November.
During the annual review of the deletion list, Mr Roth appears, who left on 31 March 2016. The company has set the period for personnel files at 10 years, and he has been on the list since 1 April 2026. His payslips for 2016, however, are accounting vouchers: the period starts at the end of the financial year on 31 December 2016 and runs for ten years, that is until 31 December 2026 (Art. 958f, para. 1 CO, where the financial year is the calendar year). The HR manager therefore deletes only after 31 December 2026.
Checklist
- Data protection information for employees and notice in the application form in place
- Only data in the file that are necessary for the employment relationship; no second files
- Roles and access defined by task; health data only for a few persons
- Procedure for access requests: receipt noted, identity checked, reply within 30 days
- Access is logged; logs are kept for at least one year
- Register of processing activities checked
- Procedure for a data breach, with report to the FDPIC, known
- Retention periods set in writing for each type of data
- Expired data are deleted or anonymised regularly
How KMU | base helps
HR | base supports the technical parts. The decisions you must make, the software does not take from you. These include the periods, the register of processing activities, any data protection impact assessment and the report of a breach to the FDPIC.
1. Access. Under People › Employees open the file and choose Export subject access data in the More actions menu. You receive all the person’s personal data as a ZIP with a structured file, a readable view and the original documents. Sensitive parts such as salary or health are exported only with the appropriate permission; what is missing appears in the export as “not exported”. For the reply to the person, therefore, someone with all the necessary permissions should export. The retrieval is logged. Whether you withhold anything under Art. 26 DSG is for you to decide; check the export before sending. For applications there is the same export in the application.
2. Roles and access. There are four base roles (Administration, HR, line managers, employees) and roles of your own with levels for each area. Sensitive fields (salary, AHV, bank, health, private) and the data scope (all, companies, departments, locations, team, self) can be assigned separately.
3. Access log. Under Company settings › Access log you see who viewed or changed personal data, and when. Read access (file, history, documents, downloads, exports) is also logged, as are logins and failed attempts, with IP and channel. The list can be filtered by area, person and period. The log is in the same system; whether it meets the requirements of Art. 4 DSV (retention separate from the system) you must clarify yourself if necessary.
4. Deletion periods. Under HR settings › Data › Deletion periods you set the periods: clock-in photos (default 30 days), access log (default 24 months, adjustable from 12 months), email log (default 12 months) and personnel file (default 10 years after leaving). A daily background job deletes clock-in photos and access and email logs after the period expires. Personnel files are never deleted automatically: after expiry the person appears in the “Due for deletion” list, and you delete them yourself in the file after checking. The defaults are suggestions from KMU | base and do not replace legal advice. Have them approved internally or legally, especially for documents with a statutory period (payroll vouchers).
5. Applications. Under HR settings › Applications you set the period for closed applications (1 to 24 months, default 6) and choose whether to delete or anonymise after expiry. The talent pool exists only with consent; you set the duration between 6 and 36 months, and the person can withdraw at any time.
The basics on application data are in the guide to applicant management, and on leaving in the guide to the offboarding checklist. On the reference letter see Write a reference letter; on recording working time Working time recording duties. If you would like to try it yourself, take a look at the Demo or open a test account. For prices, see the Prices page. If you have questions, we will help you via the Contact page.
Sources
- Federal Act on Data Protection (DSG, SR 235.1), Art. 5, 6, 8, 12, 19, 24, 25, 26, 32, 60, as at 7 July 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
- Data Protection Ordinance (DSV, SR 235.11), Art. 2 to 4, 16, 18, 19, 24, as at 1 December 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
- Code of Obligations (OR, SR 220), Art. 128 no. 3, 328b, 958f, as at 1 October 2026: fedlex.admin.ch (German original), accessed on 27.10.2026.
- Ordinance 1 to the Labour Act (ArGV 1, SR 822.111), Art. 73, para. 2, as at 1 September 2024: fedlex.admin.ch (German original), accessed on 27.10.2026.
- Gender Equality Act (GlG, SR 151.1), Art. 8, para. 2, as at 1 July 2020: fedlex.admin.ch (German original), accessed on 27.10.2026.
- FDPIC, data processing by the employer (page without date): edoeb.admin.ch (in German), accessed on 27.10.2026; different phases of the employment relationship: edoeb.admin.ch (in German), accessed on 27.10.2026.
- FDPIC, guide to processing personal data in the work area, private employers, as at October 2014, no. 3.2.1 and 3.3.1 (written under the former Data Protection Act): edoeb.admin.ch (in German), accessed on 27.10.2026.
- FDPIC, notification of data security breaches (online form): edoeb.admin.ch (in German), accessed on 27.10.2026.
This guide does not replace legal or tax advice. Information as at 27.10.2026.