Retrieving human resource records is a critical function that supports efficient HR management and decision-making in any organization. In Kenya’s dynamic employment environment, HR professionals must ensure that records retrieval aligns with regulatory requirements and organizational policies to safeguard employee information and maintain operational continuity. Effective retrieval processes enable timely access to data for recruitment, payroll, performance management, and compliance audits. This chapter focuses on the policies that govern the retrieval of HR records, ensuring consistency, security, and accountability in their management.

4.1 Records retrieval policy

A records retrieval policy is a written statement that sets out who may request records, how requests are made and approved, how fast records must be produced, and how they are returned. It protects confidential employee information, makes retrieval fair and predictable, and gives staff a clear basis for action when a request is refused. Without a policy, files are handed out on personal favour, go missing and cannot be traced. Example: a county referral hospital adopts a policy stating that a personnel file may be released only to the HR manager, the employee's supervisor or the employee, on a signed request form, and must be returned within three working days.

4.1.1 Purpose and objectives of a retrieval policy

The policy exists to balance two needs: quick access for those who have a legitimate reason, and strong protection against those who do not. It also gives management a basis for auditing how records are used. Example: a commercial bank's HR office uses its retrieval policy to answer an auditor's question on who consulted a senior manager's file in the past year.

Main objectives

• Protect confidentiality: only authorised persons see sensitive records such as salary, medical and disciplinary files.
• Ensure quick and orderly access: set time limits so that requests are answered promptly and work is not delayed.
• Prevent loss and misuse: every movement of a file is recorded, so that a missing file can be traced to the last holder.
• Comply with the law: meet the requirements of the Data Protection Act, 2019, and the Employment Act on access to and keeping of employee records.
• Provide accountability: show who requested, approved, issued and returned each record.
• Maintain consistency: apply the same rules to every department and every requester.

4.1.2 Scope of the policy

The scope states which records, which people and which formats the policy covers. A clear scope avoids gaps, such as scanned copies being treated as free for all. Example: a university's policy covers original paper files, scanned copies in the HR system, and records held on external drives.

What the scope should cover

• Types of records: personnel files, payroll, recruitment papers, training and appraisal records, disciplinary and medical files.
• Formats: paper, electronic and microfilm records, wherever they are stored.
• Persons covered: all employees, contractors and outside bodies who ask for records.
• Locations: the main registry, branch offices, off-site stores and cloud storage.
• Types of request: routine, urgent, and external requests from auditors, courts or government offices.

4.1.3 Who may access records: authority and access levels

Access is given according to role and need to know. The policy classifies records and assigns each class to named posts. Example: a tea company allows the payroll supervisor to see salary records but not medical files, and the HR manager to see both.

Rules of access

• Need to know: a person receives only the records required to do their work.
• Written authority: access to restricted and confidential records needs written approval from the named authority.
• Employee's right to see their own file: the employee may see their own records, subject to the law and to rules on records that concern other persons.
• Temporary access: access given for a task ends when the task is complete.
• Review of access rights: the list of persons with access is checked at least once a year and when staff change posts.

4.1.4 Request and approval requirements

The policy fixes how a request must be made, so that every release leaves a record. Example: an HR officer at a sugar factory fills a records request form giving the file number, reason and return date before the file leaves the registry.

Information required in a request

• Requester's name, post and department: to confirm that the person is entitled to the record.
• Record requested: the name or number of the file and the document needed.
• Purpose of the request: the reason, such as an audit or a promotion board.
• Date and time needed: and the date of return.
• Signature of the requester and approving officer: to prove authority.
• Form of access: original, photocopy, scanned copy or viewing only.

4.1.5 Time limits and service standards

The policy states how soon a request must be answered. Fixed times make the service dependable and show when delay is a fault. Example: a school sets one working day for routine requests and four hours for urgent ones approved by the head teacher.

Typical standards

• Routine requests: answered within one to two working days.
• Urgent requests: answered the same day, with written reasons for urgency.
• Requests for archived records: answered within five working days, because files must be brought from the store.
• Period of loan: a file may be held for a stated period, such as three working days, and then returned or renewed.
• Reminders for overdue files: a notice is sent when the return date passes, and a second notice goes to the supervisor.

4.1.6 Conditions for release and handling

Records must be protected while outside the registry. The policy sets rules for use, copying and transfer. Example: a clinic allows the file to be read only in a supervised room, and forbids photographing pages with a phone.

Conditions

• Records stay on the premises: originals may not leave the organisation without written authority from the head of institution.
• Use of copies: copies are given instead of originals wherever possible, and each copy is marked and recorded.
• No removal of pages: pages must not be taken out, added or altered.
• Safe keeping during use: files are kept locked or in view when not being read, and are not left on desks overnight.
• No passing on to others: a holder may not give the file to someone else without recording the transfer.
• Electronic records: access is through individual passwords, and downloading or emailing is allowed only when authorised.

4.1.7 Control documents and registers

The policy requires forms and registers that give proof of every movement. Example: a hotel records each file issue in a movement register and places a tracing card in the empty place on the shelf.

Main control tools

• Records request form: shows who asked for what, for what purpose and with whose approval.
• File movement register or log: records the date out, the holder, the date due and the date returned.
• Out-guide or tracer card: a card left in the file's place that shows where the file has gone.
• Electronic audit trail: in a document management system, the software records who opened, copied or changed each file.
• Overdue list: a regular list of files not returned on time.
• Disclosure log: a record of any release to outside parties such as auditors or courts.

4.1.8 Release of records to third parties

Records of employees contain personal data, so release to outsiders is strictly controlled. Example: a manufacturing company receives a letter from a bank asking for an employee's salary details for a loan, and releases them only after getting the employee's written consent.

Rules for external requests

• Written request: the outsider must state the purpose, the legal basis and the records needed.
• Consent of the data subject: the employee's written consent is obtained unless the law requires release.
• Legal orders: a court order, a notice from the Kenya Revenue Authority or an inspector's request is verified before release.
• Limit to what is needed: only the parts of the record required are released.
• Record the release: the disclosure log shows the date, recipient, records and authority.
• Approval by senior officer: the head of HR or head of institution authorises the release.

4.1.9 Responsibilities under the policy

The policy assigns duties so that no part of control is left to chance. Example: a county government names the records manager as policy owner and asks each department head to confirm monthly that borrowed files are returned.

Duties of each party

• Head of institution: approves the policy, provides resources and decides on highly confidential requests.
• HR manager or records manager: enforces the policy, authorises releases and reports on compliance.
• Records clerks: issue and receive files, update registers and check forms.
• Department heads: make sure staff follow the policy and return files on time.
• All employees who handle records: protect files, use them only for the stated purpose and report loss or misuse at once.
• Internal auditor: checks compliance and reports weaknesses.

4.1.10 Breaches, sanctions and review of the policy

A policy has force only if breaches are dealt with and the document is kept up to date. Example: a school finds that a clerk gave a teacher's file to a colleague without a form, and the clerk receives a written warning in accordance with the disciplinary code.

Dealing with breaches

• Report immediately: loss, theft or unauthorised disclosure is reported to the records manager and, where personal data is involved, to the Data Protection Commissioner within the time required by law.
• Investigate: find the cause, the persons involved and the records affected.
• Apply disciplinary action: sanctions range from a warning to dismissal, depending on the seriousness.
• Correct the weakness: change forms, training or access rights to prevent repetition.

Review of the policy

• Annual review: check that the policy matches current laws and practice.
• Review after incidents: revise after any major loss or breach.
• Consultation: ask users and auditors for comments.
• Version control: keep a number and date on each version, and withdraw older copies.
• Communication and training: inform all staff of changes and train new employees on the policy at induction.

Chapter Summary

This chapter focused on the essential aspects of retrieving human resource records effectively and securely. It began by examining the records retrieval policy, which sets the framework for authorized access and the protection of sensitive employee information. The document retrieval procedure was then detailed, outlining the systematic steps required to locate and handle records efficiently while maintaining confidentiality. Execution of human resource records highlighted the practical implementation of retrieval processes, ensuring that records are accessed correctly and used appropriately within the organisation. Finally, the chapter covered the monitoring of record circulation, emphasizing the importance of tracking who accesses records and when, to prevent misuse and preserve data integrity. Together, these components establish a robust system for managing human resource information that supports operational needs and compliance with data protection standards.