A practical guide for US employers on protecting employee personal data: what counts as sensitive employee information, the main federal and state rules to know, how to collect less, control access, store and retain records, handle biometrics and background checks, respond to breaches and train managers.
Employers hold some of the most sensitive information people have: Social Security numbers, bank accounts, home addresses, dates of birth, medical information, family details and sometimes fingerprints or face scans. If that information is lost, stolen or misused, employees can face identity theft and fraud, and the employer can face legal liability, notification costs, regulatory penalties and a serious loss of trust.
To record clock-ins, breaks and overtime automatically, see EZTime time and attendance software.
Most incidents are not sophisticated hacks. They are a lost laptop, a spreadsheet emailed to the wrong person, a filing cabinet left unlocked, an old employee file thrown in the trash, a former manager who still has access to the HR folder or a phishing email that tricks someone into sharing payroll information. Good habits prevent most of them.
| Category | Examples | Sensitivity |
|---|---|---|
| Identity | Name, address, phone, date of birth | Moderate |
| Government identifiers | Social Security number, driver’s license, passport | High |
| Financial | Bank account for direct deposit, wage garnishments | High |
| Tax and payroll | W-4, wage history, deductions | High |
| Immigration | Form I-9 and supporting documents | High |
| Medical | Doctor’s notes, accommodation requests, leave certifications, drug test results | Very high |
| Background | Background check reports, criminal history | Very high |
| Biometric | Fingerprints, face geometry used for time clocks or access | Very high |
| Performance | Reviews, discipline, investigations | Moderate to high |
| Time and location | Time records, GPS clock-in locations | Moderate |
| Family | Dependents, emergency contacts, beneficiaries | Moderate to high |
Start by listing where each type lives: paper files, payroll provider, HR system, email, shared drives, managers’ phones and spreadsheets. You cannot protect data you do not know you have. See the personnel file guide and employee database.
The US has no single comprehensive employee privacy law. Instead, employers face a mix of federal and state requirements. The most common are:
| Rule | What it covers |
|---|---|
| ADA medical confidentiality | Medical information obtained about employees must be kept confidential and stored separately from the general personnel file |
| FMLA | Medical certifications and records related to family and medical leave must be kept confidential and separate |
| GINA | Genetic information, including family medical history, must be kept confidential |
| Fair Credit Reporting Act | Disclosure, authorization, adverse action steps and secure disposal for background reports from consumer reporting agencies |
| Form I-9 rules | Retention periods and secure storage of employment eligibility records |
| HIPAA | Applies to health plans and healthcare providers as covered entities; employers that sponsor health plans may have obligations for plan data |
| State breach notification laws | Every state requires notice to affected people after certain breaches of personal information |
| State SSN protection laws | Many states limit how Social Security numbers can be displayed, transmitted and used |
| State biometric laws | Some states, notably Illinois, require notice, consent, retention schedules and destruction for biometric data |
| California consumer privacy law | Gives California employees and job applicants rights over their personal information held by covered businesses |
Industry rules can add more. Healthcare employers must also protect patient information under HIPAA. See what is HIPAA compliance and HIPAA training for employees.
Every piece of data you collect is something you must protect. Review your forms and ask why each field is there. Do you need a Social Security number on the job application, or only after an offer? Do managers need copies of driver’s licenses, or only a record that one was checked? Are you collecting dates of birth for a reason? Remove what you do not need, and collect sensitive data as late in the process as possible.
Access should follow the need to know. A shift supervisor needs an employee’s phone number and schedule, not their bank account or medical notes. Payroll needs bank and tax data, not disciplinary investigations.
| Data | Who needs access |
|---|---|
| Contact details and schedule | Direct manager, scheduling staff |
| Pay rate and time records | Direct manager, payroll |
| Bank and tax data | Payroll only |
| Medical and accommodation records | HR only, in a separate file |
| Background check reports | HR and the hiring decision maker, then stored securely |
| Investigations | HR and leaders directly involved |
The small business cybersecurity checklist covers the technical basics.
Retention rules set minimum periods, and many businesses then keep everything forever. Old records are a liability if breached. Build a retention schedule that meets legal minimums and then disposes of records securely.
| Record | Common federal minimum |
|---|---|
| Payroll records (FLSA) | 3 years |
| Time cards and wage rate tables (FLSA) | 2 years |
| Form I-9 | 3 years after hire or 1 year after employment ends, whichever is later |
| Employment tax records (IRS) | At least 4 years |
| FMLA records | 3 years |
States often require longer periods, and pending claims or lawsuits require you to keep related records until resolved. See time record retention requirements and the Form I-9 guide. Dispose of records by shredding paper and securely deleting digital files, not by putting them in the recycling bin.
Fingerprint and face recognition time clocks reduce buddy punching, but biometric data is permanent: an employee cannot change their fingerprint after a breach. Some states regulate biometric data closely. Illinois’ Biometric Information Privacy Act, for example, requires written notice, written consent, a public retention and destruction policy and limits on disclosure, and it has led to significant litigation. Other states have their own rules.
Before using biometrics, check the rules in each state where you operate, get written consent, publish a retention policy and confirm how your vendor stores and deletes the data. Many employers choose non-biometric methods instead, such as mobile clock-ins with GPS or NFC tags. See NFC vs GPS vs biometric time clocks and how to prevent buddy punching.
If you use a consumer reporting agency for background checks, the Fair Credit Reporting Act requires a standalone written disclosure, the applicant’s written authorization and specific pre-adverse and adverse action notices before you make a negative decision based on the report. Many states and cities add ban-the-box and fair chance rules that limit when and how criminal history can be considered. Store reports securely with restricted access and dispose of them properly.
Employers increasingly collect GPS location at clock-in, computer activity or camera footage. Be transparent: tell employees what you collect, why and when. Collect location at clock-in and clock-out or during working time for a clear business purpose, not off-duty. Some states require notice before electronic monitoring. A clear policy in your employee handbook with a signed acknowledgment avoids surprises. See geofencing.
Write this plan before you need it. A breach is a bad time to figure out who to call.
Most data mistakes come from people, not systems. Train managers and anyone who handles HR or payroll data at hire and once a year on:
Record training with the training record template.
A 35-employee landscaping company kept employee files in an unlocked cabinet, emailed direct deposit forms to the office manager and stored a payroll spreadsheet on a shared drive every supervisor could open. After a phishing email nearly redirected a crew lead’s paycheck, the owner reviewed everything. The company moved personnel forms into a digital HR system, restricted the payroll spreadsheet to two people, set up a rule that bank changes must be confirmed by phone, moved medical notes into a separate locked file and shredded records past their retention periods. The whole cleanup took about two weeks of part-time work.
EZTime helps replace paper forms and scattered spreadsheets with a single system for workforce records. Employees complete digital HR forms with e-signatures, documents are kept in a digital employee file with expiry reminders, timecard corrections go through manager approval with an audit trail and data history is kept for up to 7 years to support record retention. Clock-ins can use the mobile app with a GPS stamp or NFC tags rather than biometrics. See EZTime features and the EZTime privacy policy.
Social Security numbers, bank and tax information, medical and disability records, background check reports, immigration documents, biometric data and investigation records.
There is no single comprehensive law. Employers follow a mix of federal rules, such as ADA and FMLA medical confidentiality and the Fair Credit Reporting Act, plus state laws on breaches, Social Security numbers, biometrics and, in California, privacy rights for employees.
No. Medical information should be kept confidential in a separate file with restricted access.
It depends on the record and the state. Federal minimums include 3 years for payroll records, 2 years for time cards and the later of 3 years after hire or 1 year after termination for Form I-9.
Contain it, assess what was exposed, get legal and technical help, notify affected people and regulators as state law requires, support employees and fix the cause.
Generally yes, but some states, notably Illinois, require notice, written consent and retention policies. Check your state’s rules first.
EZTime keeps digital HR forms, e-signatures and employee files in one place with audit trails.