Habeas Data (Law 1581): What It Means for Employee Files
An employee file isn't one single block of information with a single retention period — part of it should be kept indefinitely, and part of it must be deleted the moment it stops serving a purpose. How to tell one from the other.
A personnel file mixes two kinds of information with different rules, and treating them the same is the most common mistake: on one side, the employment contract and its supporting documents, which are worth keeping indefinitely as evidence against a future claim; on the other, personal data collected for a specific purpose — an entry medical exam, a psychometric test — that Colombia's Law 1581 of 2012 requires deleting once that purpose no longer applies, not keeping "just in case" alongside everything else.
What counts as personal data in a file
The law covers any information that identifies or could identify a person: name, ID number, salary, performance reviews, health data, family information. In a personnel file, practically everything except the contract itself falls into this category — which makes it relevant to almost every document an HR department handles day to day.
The principle that clashes most with intuition: no keeping data "just in case"
The natural instinct with any employee document is to keep it indefinitely, in case it's needed later. Law 1581 goes the opposite direction for personal data specifically: it can only be kept for as long as the purpose that justified collecting it remains valid. Once that purpose has been fulfilled or no longer applies, it should be deleted — piling it up with no such limit is, on its own, a violation.
That doesn't mean deleting the whole file when someone leaves the company. It means distinguishing which part of that file still serves a current purpose (the contract, for evidentiary purposes) from which part has already served its purpose and should be purged.
Consent: asking for it, and keeping proof that you did
Before collecting personal information, the law requires informed consent — but the part many companies overlook is that this consent has to be documented and available for when an authority asks for it. Colombia's Superintendency of Industry and Commerce (SIC) enforces this law, and in an audit, saying you asked for consent isn't enough: you have to be able to show it.
The obligation doesn't end when the person stops working with you
Anyone who had access to personal data as part of the employment relationship remains obligated to keep it confidential even after that relationship ends — confidentiality isn't tied to an active contract, it keeps applying indefinitely to that specific data.
In practice, this reinforces why access control matters as much as retention: it's not just about deciding how long to keep each piece of data, but who can see it while it exists, and keeping a record of who accessed it — the same audit logic that applies to any sensitive Record.
Frequently asked questions
How long should I keep an employee's file after they leave?
It depends on which part of the file. The employment contract itself has no specific private-law time limit, so indefinite retention is recommended as backup against a future claim. But personal data collected for a specific purpose (an entry medical exam, for example) should only be kept for as long as that purpose exists — after that, it should be deleted, not kept alongside the rest of the file with no limit at all.
Do I need an employee's consent to keep their personal information?
Yes, and you also need to be able to prove you asked for it — keeping the consent document identified separately from the rest of the file is what lets you respond to an audit from Colombia's Superintendency of Industry and Commerce, the authority that enforces this law.