Retrieving human resource records is a critical function in HR management, ensuring that employee information is accessible, accurate, and secure. In Kenya, organizations across sectors such as county governments, banks, and hospitals must adhere to strict data protection laws like the Data Protection Act, 2019, while facilitating efficient records retrieval for operational and compliance purposes. This chapter explores the framework that governs how HR records are retrieved, focusing on policies that balance accessibility with confidentiality and legal requirements.

4.1 Records retrieval policy

A records retrieval policy is a written statement approved by management that sets out who may request records, which records they may see, how requests are made and approved, and how long records may stay out of storage. It turns retrieval from a matter of personal favour into a controlled, fair and traceable process. Without such a policy, files are handed out casually, go missing and expose personal information. Example: a county government office in Machakos that has an approved retrieval policy can show an auditor, for any personnel file, who requested it, who approved the request and when it came back.

4.1.1 Meaning and Purpose of a Records Retrieval Policy

The policy is the rulebook for access to records. It does not describe the step-by-step handling of a file, which belongs to the retrieval procedure, but it states the rules that the procedure must follow. Example: a SACCO in Nyeri has a policy stating that member loan files may be seen only by the loans manager, the credit committee and auditors, and that no file may leave the records room without a signed request.

Purposes of the Policy

• Protect confidentiality: Sensitive records such as salaries, medical reports and disciplinary files are seen only by authorized persons.
• Ensure accountability: Every request and release is traceable to a named officer.
• Prevent loss and misuse: Rules on borrowing periods and handling reduce missing, damaged or altered files.
• Support fair and consistent decisions: All requests are judged against the same criteria, whoever makes them.
• Meet legal requirements: The policy helps the organization comply with the Data Protection Act, 2019 and audit and inspection duties.
• Speed up service: Clear rules and response times let authorized users obtain records without unnecessary delay.

4.1.2 Contents of a Records Retrieval Policy

A good policy is short, specific and easy to apply. It should cover the points below so that staff do not have to guess. Example: a hospital in Kakamega issues its policy as a two-page document that is attached to the staff handbook and displayed in the records room.

Key Elements of the Policy

• Purpose and scope: States what the policy aims to achieve and which records, locations and staff it covers.
• Definitions: Explains terms such as confidential record, active file, archived file and authorized officer.
• Access levels: Lists which posts may see each category of record, such as general, restricted and highly confidential.
• Request and approval rules: Describes who may request, who approves and what documents must be completed.
• Borrowing conditions: States the maximum period a file may be held, where it may be used and rules on copying.
• Response times: Sets the time within which routine and urgent requests must be handled, for example one working day for current files.
• Handling and return rules: Requires safe use, no removal of papers and return in the same order.
• Penalties for breach: States the disciplinary action for misuse, loss or unauthorized disclosure.
• Review date: Shows when the policy will next be reviewed and who owns it.

4.1.3 Access Levels and Authorization

Not every employee needs every record. The policy therefore groups records by sensitivity and links each group to the posts allowed to see it. Example: in a bank in Eldoret, any supervisor may view a staff directory, only the HR manager may view appraisals and only the managing director and HR manager may view disciplinary files.

Typical Access Levels

Who May Request Records

• The employee concerned: May see their own file under supervision, as the Data Protection Act, 2019 gives data subjects a right of access to their personal data.
• Supervisors and managers: May see records of staff they manage, as far as they need them for their work.
• Internal and external auditors: May see records needed for an audit, with the approval of management.
• Regulators and inspectors: May see records required by law, such as labour or safety inspectors.
• Courts and law enforcement: May receive records only through a formal order or request approved by management and legal officers.
• Third parties such as banks or future employers: Receive information only with the written consent of the employee.

4.1.4 Policy on Requests, Approval and Borrowing

The policy must state clearly how a request is made, who approves it and the conditions under which a file may be taken. These rules ensure that the file is not lost and that the user has a genuine need. Example: a technical college in Nyeri allows files to be borrowed for a maximum of three working days and requires an approval signature from the head of department.

Rules on Requests and Borrowing

• Written request required: Every request is made on a standard form or approved electronic system, stating the file, reason and date needed.
• Approval by an authorized officer: The records officer or HR manager approves according to the access level of the record.
• Identity check: The records officer confirms the identity of the requester before issuing a file.
• Use in a controlled place: Highly confidential files are consulted in the records room and not taken away.
• Maximum borrowing period: Files must be returned within the stated time, and extensions need new approval.
• No transfer to others: A borrower may not pass the file to a colleague without informing the records office.
• Copying only with permission: Photocopying or scanning of restricted records needs written authority.
• Emergency requests: Urgent requests may be processed immediately but must be documented and approved afterwards.

4.1.5 Policy on Handling, Return and Loss of Records

Rules for handling protect the condition and completeness of a record while it is outside storage. They also state what happens when a record is late, damaged or lost. Example: a hotel in Mombasa requires every borrower to check the contents of a file against the checklist on the folder at the time of issue and return.

Handling and Return Rules

• Keep documents in order: Papers are not removed, rearranged or marked in any way.
• Protect from damage and exposure: Files are not left on open desks, in vehicles or in public places.
• Return promptly: Files are returned by the stated date, and the records officer checks completeness before closing the loan.
• Follow up on overdue files: The records officer sends reminders and reports persistent delay to the HR manager.
• Report loss at once: A missing document or file is reported immediately to the HR manager, who starts a search and investigation.
• Reconstruction and discipline: Lost records are reconstructed where possible from copies, and the person responsible may face disciplinary action as the policy states.

4.1.6 Legal and Regulatory Basis for the Policy

The policy must reflect the laws that govern personal information and public records, so that it will stand up to inspection and court scrutiny. Example: a county referral hospital in Kisii refers to the Data Protection Act, 2019 and the Public Archives and Documentation Service Act when drafting its policy.

Main Legal Sources

• Data Protection Act, 2019: Requires lawful, limited and secure use of personal data and gives employees the right to see and correct their records.
• Constitution of Kenya, 2010: Article 31 protects privacy and Article 35 provides for access to information held by the State and by others where needed to protect a right.
• Access to Information Act, 2016: Sets out how public bodies must handle requests for information.
• Employment Act, 2007: Requires employers to keep employment records and to provide employees with certain documents, such as certificates of service.
• Public Archives and Documentation Service Act: Governs the management and disposal of public records.
• Organizational policies and employment contracts: Add specific rules on confidentiality and conduct.

4.1.7 Developing, Approving and Communicating the Policy

A policy is effective only if it is accurate, approved and known. Developing it is therefore a managed process with consultation and communication. Example: a manufacturing company in Thika drafts its policy with the HR, legal and IT departments, then presents it to the board for approval.

Steps in Developing a Records Retrieval Policy

1. Review records and risks: Identify the types of records, how they are used and where leaks and losses have occurred.
2. Consult stakeholders: Meet HR, legal, IT, auditors and department heads to find out their needs and concerns.
3. Review legal requirements: Confirm the laws and regulations that affect access to each type of record.
4. Draft the policy: Write clear and short statements covering the elements listed earlier.
5. Obtain approval: Present the draft to senior management or the board, and sign and date the approved version.
6. Communicate and train staff: Distribute the policy, display summaries in the records office and explain it at induction and meetings.
7. Implement with forms and systems: Provide the request forms, registers or software that put the policy into practice.
8. Monitor and review: Check compliance regularly and review the policy at least once a year or when laws or systems change.

4.1.8 Challenges in Applying the Policy and Solutions

Even a well-written policy can fail in practice. Knowing the usual obstacles helps managers to prevent them. Example: a school in Kitale found that teachers ignored its borrowing rules, and corrected the problem by training staff and making the head teacher approve every request.

Common Challenges

• Lack of awareness: Staff do not know the policy exists or what it requires.
• Pressure to bypass rules: Senior officers demand files without following the procedure.
• Outdated policy: The rules do not cover electronic records or new laws.
• Weak enforcement: Breaches are not punished, so rules are ignored.
• Inadequate records tools: There are no forms, registers or systems to support the rules.

Solutions

• Train and remind staff: Teach the policy at induction and refresh it regularly.
• Gain management support: Senior officers follow the policy themselves and back the records officer.
• Review and update regularly: Revise the policy as laws and technology change.
• Apply consistent consequences: Deal with breaches fairly and promptly.
• Provide practical tools: Supply standard forms, registers and system controls that make compliance easy.

Chapter Summary

This chapter explored the essential framework for retrieving human resource records, beginning with the establishment of a clear records retrieval policy that guides the access and management of employee information. It then detailed the document retrieval procedure, outlining the systematic steps required to locate and obtain records efficiently and securely. The execution of human resource records focused on the proper handling and processing of these documents to ensure accuracy and confidentiality throughout their use. Finally, the chapter addressed the monitoring of record circulation, emphasizing the importance of tracking the movement of records to prevent loss or unauthorized access and to maintain accountability within the human resource management system. Together, these components form a comprehensive approach to managing human resource records that supports organizational integrity and operational effectiveness.