HR Records, Cybersecurity & Data Breaches
HR records contain information that needs both protection and an appropriate retention schedule. Keeping everything indefinitely is not a substitute for knowing which records must be kept, secured, or deleted.
Questions and Answers
How long should an employer retain personnel and payroll records?
Use a schedule based on record type and applicable law, not a single deadline for every file. Federal payroll, discrimination, leave, immigration, and workplace-safety rules can impose different periods. State requirements may add others.
For example, Form I-9 generally must be kept for three years after hire or one year after employment ends, whichever is later. Claims and preservation holds can extend retention. Medical and biometric information also require attention to confidentiality and, in some circumstances, deletion obligations.
Sources: USCIS: Retaining Form I-9; EEOC: Recordkeeping Requirements; U.S. Department of Labor: FLSA Recordkeeping; Texas Workforce Commission: General Recordkeeping.
May an employee inspect their personnel file?
Check the law governing the employee and the particular records requested. Colorado provides a statutory inspection right for certain personnel records, with limits and exclusions. Other states and record categories may follow different rules.
Review company policy as well as the law before responding. Separate medical information, protected investigation material, and other employees’ information as appropriate. A request for a file and a litigation discovery request are different processes and should not be treated as interchangeable.
Sources: Colorado Legislature: Access to Personnel Files, HB 16-1432.
Do AI prompts, transcripts, and summaries belong in a retention policy?
Yes. Classify them by what they document rather than by the tool that created them. An AI-assisted employment decision or investigation note may be relevant to a retention rule or preservation obligation.
Define which versions and supporting data need to be kept, where they are stored, and who can access them. Do not automatically delete originals after producing a summary. Equally, do not retain all sensitive prompts forever without considering privacy, contractual, and statutory deletion requirements.
Sources: EEOC: Recordkeeping Requirements; U.S. Courts: Federal Rules of Civil Procedure.
What security controls should protect HR and payroll information?
Limit access by role, use strong authentication, secure transfers and storage, and remove access promptly when duties change. Keep sensitive medical information separate where required. Review vendor permissions and incident-reporting commitments.
HIPAA does not generally govern employment records held in an employer capacity, but other confidentiality duties can still apply. Security requirements depend on the information and the organization; a practical control review should involve IT, HR, and counsel.
Sources: NIST: Cybersecurity Framework; HHS: Employers and Health Information in the Workplace; EEOC: Disability Discrimination.
How quickly must an employer respond to a possible data breach?
Begin investigation and containment promptly. Notification requirements depend on the affected information, residents’ locations, applicable thresholds, and when the relevant statutory trigger occurs. Do not wait for a complete forensic report before assessing deadlines.
Texas requires reporting to its Attorney General for qualifying breaches affecting 250 or more Texans, generally no later than 30 days after discovery. Colorado generally requires affected-resident notice within 30 days after determination, and Attorney General notice when 500 or more residents are affected. Wyoming has its own prompt-notification standard. Other notices and exceptions may apply.
Sources: Texas Attorney General: Data Breach Reporting; Colorado Attorney General: Data Protection Laws; Wyoming Legislature: Data Breach Law, Title 40.
How can HR reduce payroll-diversion and W-2 phishing risk?
Verify sensitive requests through an established, independent channel. For example, confirm a bank-account change using a known contact method rather than a phone number supplied in the request. Limit access to tax files and require approval for bulk exports.
Train employees to report suspicious requests even when a message sounds familiar or a voice appears convincing. If W-2 information is stolen, coordinate the response with counsel and follow the IRS reporting guidance alongside any other required notices.
Sources: IRS: Form W-2 and SSN Data Theft; NIST: Cybersecurity Framework.
What should HR do during a security incident?
Help identify affected employees and data, preserve relevant communications, and coordinate accurate employee contact information. Work with the incident lead, IT, counsel, insurers, and forensic specialists through a defined response process.
Avoid speculative statements about what happened or promises about outcomes. Keep a decision log and use approved channels for updates. Review employee conduct separately and on established facts rather than delaying containment while deciding who may be at fault.
Sources: NIST: Cybersecurity Framework.
When should records or cybersecurity questions go to counsel?
Seek advice when a retention schedule changes, a request involves protected or disputed records, or deletion requirements conflict with a preservation hold. A suspected exposure of employee information, lost device, or unauthorized vendor access can also warrant immediate review.
Bring the affected data categories, locations, known dates, contracts, retention settings, and the steps already taken. Clear facts help determine which obligations apply without assuming that every incident has the same notice requirements.
Updated October 21, 2026. General information for employers, not legal advice. Requirements depend on the facts, the employer, and the locations involved. Reading these FAQs does not create an attorney-client relationship.