What function does the personnel file serve?
The file makes it possible to follow how rights and obligations were applied from the formation of the employment relationship until its end. The employment contract, leave, wage, working time, training, health fitness and termination documents should confirm one another. A folder with signatures obtained only at hiring does not serve this function if it is not updated over the years.
Article 75 does not set out a closed list enumerating every document the employer must keep. In addition to identity information, it refers to the record obligations arising from the Labor Law and other legislation. Therefore any ready-made list headed “twenty documents required by law” cannot be used without distinguishing duties and workplaces. [K01]
Keeping documents is different from proving an event
A signed training form does not by itself cure training that was never given, a leave form does not cure an employee actually being made to work, and a payroll does not cure a payment never made. The evidentiary value of the file depends on its consistency with actual practice and the other records. While keeping the documents it regards as in its favor, the employer should not remove the employee’s explanations and objections from the file.
Set up the file in three stages of employment
| Stage | Core record groups | Purpose of the check |
|---|---|---|
| Hiring | Identity, contract, duty, necessary health/qualification, notifications and training | Establishing the conditions for starting work |
| Period of employment | Wages, attendance records, leave, changes, performance, training and explanations | Following the actual application of rights |
| Departure | Notice, the relevant process if a defense statement is required, settlement, payment, return of items and employment certificate | Documenting termination and subsequent obligations |
This classification is a recommended management arrangement. It may be necessary to keep the health file separately, physically or electronically, with more restricted access. The personal data category, basis and retention period of each record group must also be determined separately.
Records in the hiring section
The signed version of the contract and annexes, the documents and certificates the duty really requires, social security notifications and the information given to the employee are kept. It is not right to transfer a candidate’s whole application papers into the personnel file without any selection. Information no longer needed for the recruitment purpose should be set apart.
The AGİ (minimum living allowance) family status declaration in old checklists should not be requested as if a new general document obligation still existed for current wage payments. The current process changed when the AGİ practice was abolished from 2022. Statutory retention of a document from a past period is different from collecting the same information again from all employees today. [K18]
Records in the period of employment
The determination of wages and changes to them, payroll and payment, actual attendance records, overtime approval and notice of withdrawal, leave request/approval/use records, training and change of duties should be kept separately. The existence of a leave request does not by itself show that it was actually used; the preparation of payroll does not by itself show that the wage was paid.
If a performance system is used, notification of targets, the evaluation method and the employee’s objection should be preserved. In the disciplinary file, the incident, the request for a defense statement, the reply and the decision are separate records. These documents should not be created retroactively afterwards; the revision history should remain visible.
Records in the departure section
The termination notice, notification, any defense statement and assessment, the calculation of claims, the bank payment trace, the return of assigned items and the employment certificate must be consistent with one another. The employment certificate arrangement under Labor Law Article 28 should not be made conditional on signing a release. The SGK exit entry is an administrative act separate from the termination notice. [K01][K11]
If a release is used, the conditions of TBK Article 420 are checked separately. A general “I have no claims” signature taken on the day of departure is not a document that closes all the monetary risks of the file. [K04][D04]
How are mandatory documents distinguished from unnecessary data?
Purpose and basis for each piece of data
For each document, the following should be asked: Which legal or operational need does it meet, which data is really necessary, who will use it and how long will it be kept? The existence of an employment relationship does not give authority to investigate the employee’s whole private life. TBK Article 419 and the KVKK principle of being connected with the purpose, limited and proportionate are assessed together. [K04][K07]
For example, a professional qualification certificate suited to the job and the full civil registry records of the employee’s unrelated family members do not have the same necessity. Keeping a bank account number for payment does not justify requesting all of the employee’s bank movements. A candidate’s social media posts being public does not mean that they can be filed for any purpose.
Explicit consent does not cure every deficiency
A general explicit consent text that the employee is made to sign does not remove the review of statutory purpose and proportionality. If there is a suitable basis such as a legal obligation, performance of a contract or protection of a right, it should be identified. Where consent is required, free, specific and informed will is sought; continuing employment should not be made conditional on consent to unnecessary processing. [K07]
A privacy notice explains for what purpose the data is processed. Receipt of the notice is not unlimited consent. Mixing the privacy notice, health information, advertising photograph and transfer abroad in the same signature box is not proper data management.
Health, disability and criminal information must be specially protected
KVKK Article 6, as amended in 2024, separately regulates the processing of special categories of data that is necessary for legal obligations in employment, occupational health and safety, social security and related fields. This facility is not an unlimited authority that opens health and criminal information to every manager. The adequate measures prescribed by the Board and the purpose limitation continue. [K07]
Health file and administrative file
The details of the physician’s assessment should be separated from the suitability or restriction information necessary for work planning. The employer’s access to the information needed to fulfill its health and safety obligation is not the same as distributing diagnosis and treatment details to a wide group of staff.
Keeping health reports in ordinary e-mail groups or in a cloud folder everyone can reach is risky. Who viewed them and for what purpose they were transferred should be traceable. In sharing with a health service provider or a new employer, the special rules and data transfer conditions apply together. [K12][K16]
Criminal record and connection with the duty
A judicial record/suitability document that legislation requires in certain sectors or duties should be distinguished from a record habitually requested of all employees. The special arrangement introduced in 2026 for certain workplaces where children are present is assessed with the obligations within its own scope. Outside this, it cannot be concluded that every employee’s criminal history may be archived indefinitely. [K02][K07]
How is the electronic personnel file managed?
Electronic filing does not by itself remove all requirements of signature and original documents. The image of a scanned document and an original document with a secure electronic signature are not the same. What the document is, what form it is subject to and how its original will be produced when necessary should be determined. [K01][K08]
Minimum security and integrity arrangement
As an institutional recommendation, person-based access authorizations, multi-factor authentication, backup, change logs and closing accounts when an employee leaves should be used. File names should not contain unnecessary health or criminal details; sharing links should not be left open to everyone. These technical measures should be adapted to the risk of the actual system.
A timestamp or digest of a digital record does not prove that all its content is correct; it can help track later changes. An employer’s altering file versions retroactively and putting new text in place of an old document damages legal certainty. The signed earlier version and which change took effect when should be preserved.
Cloud services abroad
Use of a foreign service provider may be assessed separately with respect to transfer of personal data abroad. Besides the server location, support access and sharing with group companies should also be examined. A statement that a “platform is secure” does not take the place of the appropriate transfer mechanism under KVKK Article 9. [K07]
The retention period is not the same for all documents
| Record group | Example legal framework | Distinction to note |
|---|---|---|
| Workplace books, records and documents within the scope of SGK | For a private employer, ten years from the beginning of the year following the relevant year | Public administrations and other special cases differ. |
| The employee’s personal health file | At least fifteen years from departure | Special exposure or other legislation may require a longer period. |
| Contract, wage, leave and dispute documents | The relevant legal obligation and the need to protect rights | Not deleted automatically by a single general file period. |
| Candidate application data | Continuation of the purpose and legal ground | The file of everyone not hired is not kept indefinitely. |
SGK’s ten-year record obligation does not mean giving the whole personnel file the same start and end dates. The at-least-fifteen-year period for the health file is a special provision of the Regulation on Occupational Health and Safety Services. Different obligations should be matched document by document. [K11][K16]
If a case or inspection is pending
The retention of records needed for a pending dispute is assessed separately. Relying on this to keep every piece of data about all staff indefinitely is also not right. The relevant file, document group, reason for retention and review point should be determined. Deletion should be carried out with regard to the need to protect rights and the obligations under legislation.
When retention ends
When the conditions for processing no longer exist, the obligation to delete, destroy or anonymize is assessed. Throwing a paper document in the bin is not a destruction policy consistent with electronic copies and backups remaining with unlimited access. Destruction operations should also be recorded to the necessary extent; unnecessary content should not be reproduced in the destruction record. [K07]
Access, production and employee applications
Human resources, payroll, legal, the workplace physician and the manager do not need the same document to the same extent. For example, a unit manager should know the employee’s leave dates; they may not need access to the whole health history. The role-based authorization arrangement should be re-checked when duties change.
Requests of competent supervisory authorities are met after verifying scope and legal basis. With regard to production of SGK records, the special periods in the law should be observed. The employee’s applications and rights concerning personal data are also handled within the KVKK framework; answering an application does not require sharing, without control, all the information of third persons. [K07][K11]
A short check that can be used in a file audit
The first check should examine not only the existence of documents but their consistency with one another: entry into work in the contract against the SGK notification, payroll against bank, leave form against shifts, defense against termination, and termination against payment records are compared. When a missing record emerges, instead of having a new document signed as if the event had occurred in the past, the actual state of the deficiency is recorded.
The second check concerns excess data and access: unnecessary identity copies, old candidate data, open sharing links and unrelated health documents are assessed. The third check is the retention and destruction calendar. If these three checks are not done together, the file may remain legally and operationally incomplete even if physically full.
How should a retention, access and destruction matrix be set up?
The safe method in a personnel file is not to keep all documents in one folder and indefinitely. The document group, purpose of processing, access authority, basis of minimum retention and destruction trigger should be determined separately. This matrix should be updated regularly; if there is a case, an inspection or a legal request, deletion should be suspended for the relevant records. [K07][K11][K16]
| Document group | Typical access | Retention approach | Control point |
|---|---|---|---|
| Contract, wage, payroll and bank records | HR, payroll and, where necessary, legal | Labor and social security legislation, limitation periods and the likelihood of dispute are assessed together | Is the document consistent with actual payment and work records? |
| Health and disability data | Workplace physician and limited authorized persons | Special health retention provisions apply; separated from the general personnel folder | Does the manager access the necessary work restriction rather than diagnosis details? |
| Disciplinary, complaint and defense records | Limited HR/legal and the decision-making authority | The result of the allegation, objection and time limits for suit are taken into account | Has unnecessary third-party information been separated out? |
| Camera, access and system logs | IT/security and, per incident, authorized persons | A short period suited to the purpose; a preservation decision if there is an incident or case | Is there continuous and disproportionate monitoring? |
| Departure and payment documents | HR, payroll and legal | Consistent with the periods for claims, mediation and litigation | Are the exit code, ground for termination and payment record consistent with one another? |
Integrity and change log in the electronic file
A document’s merely being scanned does not guarantee its reliability. A file-name standard, version information, the uploader, upload date, change history and backup arrangement should be set up. Access authority should be updated when a job changes or an employee leaves; shared user accounts and unlimited folder sharing should be prevented.
Employee applications and suspension of retention because of a case
When an employee’s request for access, correction or deletion comes in, the request and the retention obligation are examined together. If there is statutory retention or a pending dispute, the record may not be deleted immediately; the reason and scope are explained. Taking the relevant records out of the ordinary destruction calendar when a case or inspection becomes likely prevents a later dispute about destruction of evidence.
First steps on a data breach or wrong access
A payroll sent to the wrong person, a health folder left open or a former employee’s system access continuing is not only a technical error. Access should be cut off, the incident and affected data identified, logs preserved, and the necessary legal notification and correction obligations assessed. Concealing the incident or altering the records afterwards enlarges the risk.
Annual destruction and archive record
The destruction decision should be taken per document group; which record was destroyed, on what basis, by whom and by what method should be recorded. The position of electronic copies, backups and e-mail attachments should be addressed together with physical destruction. The review of the personnel file should be done not only for missing documents but also for unnecessary and expired data.
Conclusion
A personnel file is not a folder in which the employer piles up every piece of information it holds; it is a controlled record system that documents the employment relationship correctly, currently and to the extent needed. Records of hiring, work and departure should be consistent; special categories of data should be separated out; retention periods should be determined document by document. The goal of a complete record does not mean unlimited data collection.
Frequently Asked Questions
Is a personnel file kept for every employee?
Under Article 75 of the Labor Law, the employer prepares a file for each employee; the special legislation that applies is also taken into account separately. [K01]
Is there a single list of all documents in the law?
No. Article 75 refers, in addition to identity information, to the record obligations arising from other legislation. [K01]
Can health and criminal record documents be requested from every employee without limit?
No. Job-specific necessity, special provisions and the current KVKK processing conditions must be determined. [K07]
Is the AGİ form still a general mandatory document today?
Because the AGİ was abolished, applying the old list as it stands to current wage transactions is not right; retention of past documents is a separate matter. [K18]
Is the whole file kept for ten years?
No. The periods and starting points of SGK records, the health file and other documents may differ. [K11][K16]
What is the general minimum period for the health file?
Subject to the relevant special provisions, at least fifteen years from departure. [K16]
Does scanning documents make the originals unnecessary in every case?
No. Form and evidentiary rules are assessed by document type; scanning and a secure electronic original are not the same.
Can every manager see the whole file?
No. Access should be limited by duty, purpose and necessity. [K07]
Are all records deleted when the employee leaves?
No. If the statutory retention and the need to protect rights continue, the relevant records are preserved; a separate destruction assessment is made for unnecessary data. [K07][K11]
If the file is full, is the employer certain to be protected in a case?
No. The authenticity of the document, its lawfulness and its consistency with actual practice are assessed separately.
Related Labor Law Guides
- Which Documents Should Be Obtained from an Employee at Hiring? Employment Contract, Consents, Information and Delivery Records: The document framework at hiring for the employment contract, SGK notification, health, training, KVKK, overtime approval and delivery of equipment.
- Labor Law Guide for Employers: Managing Documents, Time Limits and Legal Risk from Hiring to Departure: A guide to managing documents, time limits and legal risk in contracts, personnel files, leave, defense statements, termination and release, from hiring to departure.
- How Is a Defense Statement Taken from an Employee? Request for a Defense, Reasonable Time, Refusal to Sign and Termination: A guide to the defense request letter, concrete allegation, reasonable time, notification, refusal to sign, failure to reply, assessment and procedure in termination.
Sources
K01 — Labor Law No. 4857; in particular Arts. 8, 11, 13, 15, 17–29, 32, 40–44, 53, 59, 74, 75 and 109. Together with the amendments of Laws No. 7555 and No. 7578. View source.
K07 — Law No. 6698 on the Protection of Personal Data; Arts. 4–7, 9–12. KVKK explanation on Special Categories of Personal Data; employment and occupational health/safety obligations under Article 6 as amended by Law No. 7499. View source.
K18 — Revenue Administration (Gelir İdaresi Başkanlığı), private ruling explaining Article 4/7 of Income Tax General Communiqué Serial No. 319; abolition of the AGİ practice for wage payments after January 1, 2022. View source.
K11 — Social Security Institution (Sosyal Güvenlik Kurumu), Employer’s Obligations; explanations on hiring, departure, record retention and production. View source.
K04 — Law No. 6098, Turkish Code of Obligations; in particular the provisions on the contract of service, protection of personality, personal data and release (Arts. 417, 419 and 420). View source.
D04 — 9th Civil Chamber of the Court of Cassation (Yargıtay 9. Hukuk Dairesi), E.2025/6206, K.2025/7368, October 2, 2025. Validity of a release, bank payment, actual performance and offsetting. The full text was reviewed through De Jure. View source.
K12 — Occupational Health and Safety Law No. 6331, in particular Arts. 4, 15 and 17; Ministry of Labor and Social Security (ÇSGB) General Directorate of Occupational Health and Safety frequently asked questions. View source.
K16 — Regulation on Occupational Health and Safety Services (İş Sağlığı ve Güvenliği Hizmetleri Yönetmeliği), Art. 7; retention of the personal health file for at least fifteen years from departure. Ministry of Health legislation publication. View source.
K02 — Law No. 7578 on Amendments to the Social Services Law and Certain Other Laws; adopted April 22, 2026, in particular Arts. 15–18, Provisional Art. 1 and the entry-into-force provisions. View source.
K08 — Law No. 7555, Art. 23; amendment of Art. 109 of Labor Law No. 4857: written notice, KEP with the employee’s written consent and the special position of the termination notice. View source.