HR digital vault: archiving and access

An HR digital vault brings together the documents of the employment relationship (contracts, amendments, payslips, certificates, medical notes) in a secure space, with controlled access and a record of every consultation. An employee file builds up over years and becomes, in a dispute or an inspection, the only evidence the employer has. This guide explains how to structure that archive: which documents, how long to keep them, who can access them, and how to choose and roll out the tool.

What is an HR digital vault?

It is a storage space dedicated to HR documents. It differs from a simple shared folder in three ways: data security (encryption, backups), fine-grained access rights by role, and a trail of uploads, consultations and changes. These properties give a document evidential value and make it possible to meet data protection obligations.

What it is not

A shared drive, an email inbox or a consumer storage tool is not a vault: any user with access to the folder sees everything, versions multiply and nobody knows who looked at what. Nor is an HR digital vault just a company document management system: it is connected to the employee file, to payroll and to approval chains.

Why scattered files are a problem

In many companies, HR documents are spread across a paper binder at head office, a shared drive, several inboxes and, for remote sites, folders kept on location. Three consequences follow.

• It is impossible to produce an old document quickly in a dispute, a social security audit or a request from the labour inspectorate.
• There is no real control over who accesses what, although some documents are sensitive.
• Documents can be lost for good when the person who held the files leaves, or after a hardware failure.

The cost of this disorder never appears in the accounts, but it materialises abruptly the day a dispute arises.

Take an illustration: a company of 300 employees across four sites receives a claim from a former employee about overtime and leave going back several years. Payslips are at head office, amendments on a shared drive, schedules in the inbox of a site manager who has since left. Rebuilding the file takes days, and documents are missing. With an HR digital vault fed as documents are produced, the same search takes minutes.

Which documents to keep, and for how long?

Retention periods depend on the type of document and the applicable texts. The principle has two sides: keep documents long enough to defend yourself and answer audits, but not indefinitely. In Senegal, Law No. 2008-12 on personal data protection requires data to be kept no longer than necessary for the purposes for which it was collected (Article 35).

In practice, distinguish four families of documents.

For payroll, the OHADA accounting rule is set out in the official summary of the Uniform Act of 26 January 2017 on accounting law and financial reporting (OHADA is the body that harmonises business law across its African member states). For everything else, have an adviser draw up your retention schedule country by country, then apply it systematically, ideally through automatic deletion at the end of the period rather than case by case.

Who should have access to what?

Not all HR documents have the same status. Identity and pay data are personal data with restricted access. Health data is sensitive: in Senegal, processing it is prohibited in principle, except in cases provided by law such as the person’s written consent or the defence of a legal claim (Articles 40 and 41 of Law No. 2008-12).

The law also requires the data controller to ensure that authorised people access only the data within their remit, and that it is possible to check afterwards who accessed the system, which data and when (Article 71). An HR digital vault turns these requirements directly into features.

A typical access matrix

• The employee: their own documents, read and download.
• The manager: documents needed for management (job description, reviews), never medical records.
• The HR or payroll officer: files within their scope.
• The HR director: everything, with a consultation log.

The full framework is covered in our article on HR data protection in Senegal.

Does a digital document have evidential value?

This is the question that most often holds back the move away from paper. In Senegal, Law No. 2008-08 of 25 January 2008 on electronic transactions establishes equivalence between electronic and paper documents and recognises electronic evidence subject to reliability conditions. A vault that guarantees document integrity, the identity of whoever uploaded or signed it and the preservation of its history meets these conditions far better than a file sent by email. For older paper originals, clean and indexed scanning makes searching easier; ask your adviser which ones to keep in original form.

Employee self-service: the most visible benefit

Giving each employee permanent access to their own documents (payslips, certificates, contract) markedly reduces the HR team’s workload: requests for reissued documents, which take up a large share of daily queries, become rare. It is also a real improvement for employees far from head office, who no longer need to travel to get a document, provided access works on mobile and on a weak connection. Combined with an HR approval workflow, the vault automatically receives documents once approved and signed.

Choosing an HR digital vault: questions to ask

1. Where is the data hosted, and is any transfer outside the country planned? In Senegal, a transfer to a third country requires an adequate level of protection and prior notice to the CDP, the data protection authority (Article 49 of Law No. 2008-12).
2. Can access be configured by role and by document type?
3. Can the consultation log be viewed and exported?
4. Can retention periods and deletion be configured by document type?
5. Is the vault connected to the employee file and payroll, or must each payslip be uploaded by hand?
6. What happens to the documents when the contract with the vendor ends?

Rolling out the vault in four steps

1. Inventory: list document types and where they are kept today.
2. Rules: access matrix, retention periods, naming.
3. Migration: start with current employees and this year’s documents, then work back in time.
4. Switch-over: from a set date, every new document goes straight into the HR digital vault.

For a mid-sized company, allow a few weeks for the first three steps; migrating the paper history may take longer. Announce the switch-over date to employees in advance and show them, on the first day, how to find their payslips and request a certificate from their phone: adoption of the vault largely depends on that first visit, and every employee who finds a document alone is one fewer request for the HR team.

HR digital vault FAQ

Does an HR digital vault replace paper archives?

For new documents, yes, as long as the electronic evidence is reliable. For older originals, decide with your adviser.

Do employees keep access to their documents after leaving?

That is an internal policy choice. Temporary access after the contract ends makes it easier to retrieve final payslips and certificates.

Who is liable if the vendor suffers a breach?

The employer remains the data controller. Law No. 2008-12 requires a written contract with the processor, who acts only on instructions and applies the security measures (Article 39).

HR digital vault: key takeaways

• An HR digital vault differs from a shared folder through security, access rights and traceability.
• Retention periods are set per document family: neither too short nor unlimited.
• Health data requires far more restricted access than the rest.
• Electronic evidence is recognised subject to reliability conditions.
• Employee self-service removes most requests for reissued documents.

Socium centralises HR documents in a secure space, with role-based access, traceable archiving and a personal space for each employee. Discover our HR digital vault and document management or book a demo.