How to Share HR Documents Securely
By Simon Themiot - freelance cybersecurity consultant. Published May 21, 2026.
Summary
- HR documents concentrate confidential personal data (salaries, evaluations, family situation, bank details). Some, such as health data, also fall under Article 9 special categories.
- An insufficiently controlled attachment or link increases wrong-recipient, excessive-retention, and account-compromise risk. A penalty is not automatic; it depends on the infringement and context.
- A robust approach combines E2E where warranted by risk, automatic expiry, an access password, a verified recipient, strong authentication, and documented HR rules.
Table of contents
1. Why HR documents are highly sensitive
A payslip alone contains: first name, last name, address, social security number, gross and net salary, family situation (number of children, marital status), health insurance, pension contributions, possibly wage garnishments. It is a mine of personal data concentrated in a single document.
Other HR documents are no less sensitive:
- Employment contracts: salary, non-compete clause, negotiated benefits.
- Annual evaluations: performance, improvement points, manager comments.
- Sick leave / medical certificates: health data (GDPR Article 9 special category).
- Warning letters / disciplinary procedures: information that could harm reputation.
- Bank details (IBAN): banking data enabling wire fraud.
- Identity documents: identity theft risk.
Concrete risk
A payslip leak can trigger internal conflicts (salary comparisons), targeted harassment, bank fraud, or collective employee action against the employer. The cost of an incident is incomparable with the cost of a secure tool.
2. Common risky practices
Email with PDF attachment
SMTP transport may be protected by TLS without providing end-to-end encryption. The attachment often remains in sender and recipient mailboxes and backups; one compromised account can then expose years of documents.
Shared folder on internal network
Access rights are often misconfigured. An intern, IT contractor, or colleague from another department can access them. In case of ransomware, these files are encrypted by the attacker (and potentially exfiltrated before).
Google Drive / Dropbox / OneDrive link
These providers generally manage the keys and remain inside the content trust boundary. The main risk is often an overly broad or non-expiring link. Also review the DPA, entities, subprocessors, and applicable transfer mechanisms.
3. Employer's legal obligations
In France, the employer is the data controller under GDPR for employee data. This implies:
- GDPR Article 32: Implement appropriate technical measures (encryption explicitly cited).
- French Labour Code L1222-4: Employee personal information is collected in good faith and confidentiality must be ensured.
- Accountability and security: insufficient protection may result in a formal notice, administrative penalty, litigation, or notification duty depending on the facts.
- Employment and criminal law: additional obligations may apply; their classification depends on conduct, data, and circumstances.
4. The secure method step by step
Here is a simple workflow to better control delivery of an HR document:
- Upload the document and enable E2E on a service such as PrivCloud. The file is then encrypted in your browser before upload.
- Add a strong random password to the sharing link. Never derive it from a social-security number, birth date, or other predictable HR data. Communicate it through a separate channel.
- Configure a short expiration (24h to 7 days). The employee has time to download, but the file does not remain accessible indefinitely.
- Send the link via professional email or internal messaging. The link alone is not enough (password is needed).
- Communicate the password via a second channel (professional SMS, call, or different secure messaging).
5. FAQ
Can I send a payslip by email if I password-protect the PDF?
It depends on the PDF format, algorithm, password, delivery channel, and risk. Avoid legacy RC4 modes and use modern tooling. Even encrypted, the PDF remains in mailboxes; this approach may suit some cases without being a universal answer to Article 32.
What about bulk sending (200 payslips per month)?
For large volumes, a dedicated digital vault is better suited to recurring workflows. For one-off sends or a limited number of employees, PrivCloud supports individual sharing with a strong password and short expiry. The application does not yet provide an automation API and should not be presented as a bulk payroll solution.
Must the DPO validate the HR transfer tool?
The DPO should be involved early in data-protection matters, but GDPR does not necessarily give them formal approval power over every tool. Document the processor and processing. A DPIA is required where processing is likely to result in high risk based on all relevant criteria, not solely because one health item is present.
Related articles
Protect your employees' documents
PrivCloud supports temporary HR document sharing with optional E2E, an access password, automatic expiry, France hosting, and up to 2 GB without an account.
This article is provided for informational purposes. Consult your DPO or legal department for compliance adapted to your organisation. Last updated: July 14, 2026.