If you run a business with even a handful of employees, you almost certainly have a personnel file for each one — a folder, a shared drive, maybe an HR software tab. Few owners have looked closely at what’s actually in there, whether it should be, or what happens the day an employee asks to see it. That last question is becoming less hypothetical. New York lawmakers are advancing a bill that would require employers to notify employees within ten days any time negative information is added to their file, and California’s Senate Bill 513, which took effect January 1, 2026, expanded employee file-access rights to cover training and education records for the first time. The direction of travel is toward more employee access, not less.
There’s no single federal law that spells out how to run a personnel file. That gap is exactly why so many small businesses get it wrong — they build habits by copying whatever the last bookkeeper or manager did, without ever checking whether it holds up.
The patchwork you’re already operating under
No federal statute grants employees a general right to inspect their own personnel file. Instead, it’s governed state by state, and the list of states that do guarantee access is long and growing — California, Illinois, Michigan, Massachusetts, Connecticut, Pennsylvania, Washington, and roughly twenty others each have their own version of the rule, according to Nolo’s state-by-state summary of personnel file access laws. The details vary widely: some states give employers five business days to produce records, California allows up to 30 calendar days, and a few states let you charge a small copying fee while others don’t.
If you operate in more than one state, or plan to expand, this isn’t a detail you can leave to instinct. The practical fix is the same regardless of where you’re located: build your file system to the strictest standard you’re subject to, and you’ll be compliant everywhere else by default.
What belongs in the main file — and what doesn’t
The mistake most small businesses make is treating “personnel file” as one folder that catches everything related to an employee. That’s a liability problem waiting to happen. Employment law guidance consistently recommends splitting employee records into at least three separate files:
- The main personnel file — application, offer letter, signed policies, performance reviews, disciplinary notices, training completions, and general correspondence.
- A confidential medical file — anything touching health information: FMLA paperwork, accommodation requests, workers’ comp claims, doctor’s notes. The Americans with Disabilities Act requires medical information to be kept separate from the general file and restricted to a much smaller circle of people who have a legitimate need to see it.
- A separate I-9 file — USCIS explicitly recommends keeping Form I-9 out of the personnel file entirely, stored in its own binder or folder, so that if you’re ever audited, an inspector can review I-9s without also gaining access to unrelated personnel information.
Payroll and banking details are worth a fourth, restricted-access folder too. The point of separation isn’t paperwork for its own sake — it limits what any one manager, or any one data breach, can expose at once, and it keeps you from accidentally using medical information in a decision (like a promotion or termination) where it has no legal business being a factor.
What to actually keep, and for how long
Retention rules come from a few different federal sources layered on top of each other. The Department of Labor’s Fair Labor Standards Act guidance requires payroll records — pay rates, hours worked, wage computations — to be kept for at least three years, with the underlying time cards and work schedules kept for two years, per DOL Fact Sheet #21. I-9 forms have their own clock: three years after the hire date, or one year after termination, whichever is later. General personnel and employment records fall under a one-year EEOC retention minimum, longer if there’s been a termination or any hint of a claim.
A simple rule of thumb that covers nearly every federal requirement: keep payroll and time records for at least three years, keep I-9s in their own file per the USCIS schedule, and don’t purge anything from a departed employee’s file for at least a year after their last day — longer if the separation was contentious.
When an employee actually asks to see their file
This is the moment most owners haven’t thought through. In a state with a file-access law, an employee’s written request typically triggers a countdown — often five business days, though your state may differ — during which you need to make the file available during business hours, either for viewing or copying. A few things to get right when it happens:
- Don’t stall. Missing your state’s deadline turns a routine HR request into a compliance violation on its own, independent of whatever the underlying dispute is.
- Only show them their own main personnel file, not the confidential medical file, unless your state law specifically extends to those records.
- Have someone present to answer questions and make sure nothing is added or removed, but don’t use the meeting as an opportunity to relitigate the employee’s performance.
- Log the request and your response. If this ever becomes a legal dispute, your own documentation of having complied on time is your best evidence.
A one-afternoon audit worth doing now
You don’t need outside consultants to get this right. Pull each active employee’s records and check three things: are medical and I-9 documents physically or digitally separated from the general file; is there anything in the main file that shouldn’t be there (a doctor’s note, a copy of a passport, a direct deposit form); and do you know, off the top of your head, what your state requires if an employee asks to see their file tomorrow. If any of those three answers makes you uneasy, that’s the fix to prioritize before it becomes a bigger problem — because the trend across states is clearly toward more access and more transparency, not less, and the businesses that get caught flat-footed are the ones that never looked until an employee, or a lawyer, made them.
