Personnel Records Request Response Template for Employers

When a current or former employee asks for their personnel or payroll records, the clock often starts the day they ask — including verbally — and missing the deadline can cost a flat statutory penalty before anyone argues about the underlying wages.

This is not another state-by-state survey of every personnel-file statute. That framing already crowds the search results. This page is an operational response template: who can request, how to log the intake, what to produce, what to redact or withhold, how timelines differ in high-risk states, and how retention windows (including federal EEOC personnel-record rules) shape what you can still find. The retention map and inspection penalties live in depth in recordkeeping requirements by state and the underlying research. For a one-minute checklist, see how to respond to a personnel records request.

Quick reference

• Federal baseline: FLSA requires employers to keep wage/hour records (3 years payroll / 2 years underlying time cards under 29 CFR Part 516) and produce central records within 72 hours of a DOL demand — not a general employee "personnel file delivery" mandate.
• EEOC personnel records (29 CFR §1602.14): preserve personnel/employment records 1 year from the record or the personnel action (whichever later); if a charge is filed, keep relevant records until final disposition.
• California payroll inspection (Labor Code §226(c)/(f)): current or former employees may inspect or receive copies of payroll records; respond as soon as practicable, no later than 21 calendar days; failure → $750 statutory penalty per failure (plus injunctive relief). Oral requests count.
• Washington personnel-file access (RCW 49.12.240–.250 as amended by SHB 1308, effective July 27, 2025): production within 21 calendar days; access extends to former employees within 3 years of separation; "personnel file" includes payroll records and employment agreements; graduated damages $250 / $500 / $1,000 for delay past 21 / 28 / 35 days, plus a $500 catch-all for other violations of the production rule.
• Colorado: up to $250 per employee per month (cap $7,500) for recordkeeping/inspection failures under C.R.S. §8-4-103(4.5).
• Work location controls retention and inspection overlays for multi-state employees — track where the work happened, not only HQ.

Response playbook (use this as the template)

Treat every request the same way, even if it arrives as a casual email or exit conversation.

1. Log intake the same day

Record:

Field	Why it matters
Date and time received	Starts 21-day (and other) clocks
How received (oral / written)	California payroll inspection covers oral requests
Requester status	Current employee, former employee, authorized representative
Work location(s)	Which state's access/retention rules apply
Scope requested	Payroll only, full personnel file, date range, specific docs
Deadline you are using	Shortest applicable clock wins
Owner	Named person responsible for production

Do not wait for a "formal" letter if the statute covers oral requests. California §226(c) is explicit: written or oral.

2. Confirm who can request

Requester	Typical treatment under rules covered here
Current employee	Covered under California payroll inspection and Washington personnel-file access
Former employee	Covered under California §226(c)/(f); Washington access for 3 years after separation under SHB 1308
Employee's lawyer / representative	Treat as the employee's request when authorization is clear; log the authorization
Agency (DOL, state labor, EEOC)	Separate track — federal 72-hour production for central FLSA records; charge-related hold under §1602.14

If identity or authorization is unclear, verify in writing without pausing the calendar beyond the time needed to confirm the person is who they claim to be.

3. Decide what to include

Build a production set from systems you already run:

Usually include (when requested and retained):

• Payroll records that show hours, rates, gross/net, deductions, pay-period dates (the FLSA §516.2(a) list and state payroll items)
• Time cards / punch detail and schedules for the retained window (see what is a time card audit trail / quick read)
• Employment agreements and offer letters when the request is for a personnel file (Washington's amended definition expressly includes payroll records and employment agreements)
• Wage statements already furnished (useful cross-check against pay stub requirements)

Usually exclude or carefully segregate:

• Other employees' records (privacy / need-to-know)
• Medical files that belong in a separate confidential file under ADA/FMLA practice (do not dump into a general personnel packet without counsel)
• Privileged investigation materials and attorney work product
• Security credentials, building access codes, system admin secrets
• Third-party confidential commercial information unrelated to the requester's employment

When in doubt on a category, produce the clear payroll/time set on time and note in the cover letter that additional categories are under review — missing the deadline on the core records is worse than sequencing a privilege review.

4. Redact with a light, documented hand

Redact:

• Full SSNs of anyone other than last-four already used as employee ID on statements
• Bank account numbers (leave last-four if needed for reconciliation)
• Other employees' personal identifiers that appear on shared reports
• Medical details not properly requested through the right channel

Do not redact the employee's own hours, rates, or gross-to-net math to "clean up" a bad look. Incomplete production of the employee's own wage data is often the point of the request — and the penalty trigger.

Keep a redaction log: page/file, field redacted, reason. That log is your defense if completeness is challenged later.

5. Produce, acknowledge, and calendar follow-ups

Cover letter skeleton (adapt, do not invent rights):

1. Acknowledge request date and method (oral/written)
2. State what is enclosed and the date range covered
3. State any category withheld and a non-argumentative reason (e.g., "third-party personal information redacted," "medical records maintained separately")
4. Invite clarification if the requester wanted a wider date range
5. Name a contact for questions
6. Keep a copy of everything sent

Delivery: secure portal, encrypted email, or in-person pickup with signed receipt. Track the production date against the deadline.

If you will miss a deadline: escalate the same day you know — partial production of complete payroll/time records is better than silence; document good-faith retrieval efforts (vendor export delays, restored archives).

6. Preserve — the request can be a litigation trigger

A records request, demand letter, DOL notice, or EEOC charge can attach a litigation hold. Suspend automatic deletion on timekeeping, payroll, and email for that person. EEOC §1602.14 extends personnel-record retention for the duration of a charge. Routine three-year rotation that wipes responsive files after notice is spoliation risk under the federal evidence rules discussed in the recordkeeping research — not "we hit our retention schedule."

High-risk clocks (do not invent extras)

Jurisdiction / rule	Who	Deadline	Money risk if late
California Labor Code §226(c)/(f)	Current or former employee	21 calendar days (payroll records)	$750 per failure
Washington RCW 49.12.250 (SHB 1308, 7/27/25)	Current; former within 3 years	21 calendar days (personnel file)	$250 / $500 / $1,000 graduated delay; $500 other
Federal DOL central records (29 CFR §516.7)	WHD investigator	72 hours	§211(c) violation + Mt. Clemens proof problems
Colorado C.R.S. §8-4-103(4.5)	Employees (inspection/recordkeeping)	Per statute/agency practice	Up to $250/employee/month, $7,500 cap

California's $750 is per request failure, not per pay period — class size multiplies it. Washington's graduated schedule rewards every week you wait. Neither replaces unpaid-wage exposure if the records reveal shortfalls.

Multi-state and remote notes

• Work location governs which state's retention and inspection overlays apply to those hours.
• A multi-state technician who worked California days and Colorado days can trigger both California inspection rights for CA payroll records and Colorado's penalty regime for CO hours.
• Headquarters in Texas does not erase California or Washington access for employees who worked there.
• Build exports that filter by employee + date range + work location, not only company-wide dumps.

How long you should still have the files

Operational retention (from research — use the longest applicable window):

Record type	Floor to remember
FLSA payroll (§516.5)	3 years
Underlying time cards (§516.6)	2 years (practitioner: keep 3 to match willful SOL)
EEOC personnel records (§1602.14)	1 year, longer during a charge
California payroll practice	3 years statutory; 4 years practical (UCL)
New York / New Jersey / Hawaii	6 years wage-and-hour records
IRS employment tax	4 years
ERISA plan support	6 years from filing date

If a request lands outside your retention window, produce what you still have, state the retention period in plain terms, and do not invent missing years.

Common failure modes

1. Waiting for a written demand while California's oral request already started the 21-day clock.
2. Ignoring former employees — covered under California §226 and Washington's 3-year post-separation access.
3. Producing only rounded weekly totals without punch detail — weakens any later wage defense and frustrates the requester's actual question.
4. Cloud export that fails the day of production — no credentials, lapsed vendor, untested export. Test retrieval before a request arrives (72-hour DOL readiness is the same muscle).
5. Over-redacting the employee's own wage data to hide problems.
6. Deleting on schedule after a charge or demand — §1602.14 and litigation-hold duty override routine rotation.

FAQ

The rule of thumb

Log the request the day it arrives, produce payroll and time records inside the shortest applicable clock, and keep a copy of what you sent. Personnel and payroll requests are operational deadlines first and legal strategy second. Clean time records, tested exports, and a written production log turn a scramble into a routine — and they are the same habits that defend wage claims if the file becomes a case.