Controls
When a worker asks, the answer is already worked out.
A worker can ask for a copy of their records and, in some cases, for erasure. Stamped HR prepares the answer, explains what cannot be erased and why, and records it.
A copy of their records.
What is in it
A plain-words README, the worker’s details, every contact entry including corrected ones, every record including replaced versions, every duty and its status, their files and a manifest.
Built when asked
It is made on request and not kept, so there is no standing copy to protect.
Colleagues are not named
The person who recorded a check appears as “a member of staff”.
On the record
The log notes that a copy was made and when, without any names in it.
Erasure that explains itself.
- The system first checks whether the worker’s records can be erased, and lists each record and its date if they cannot.
- It refuses while a legal hold covers them, while any record is still inside its retention period, while a job or sponsorship is live, or while the worker can still sign in.
- When it goes ahead, the worker’s key is destroyed and they are archived. The audit trail keeps a note that it happened, with no personal data.
- The employer receives a statement they can pass on: what was erased, what stays and why, and that backups age out over eight days.
Who can do it.
Handling a request needs its own permission, held by Owners and by Administrators over the worker’s site. A Manager cannot do it by default. Some questions, such as how long a given record must be kept, are for a data protection adviser. The product defaults to the cautious answer and says so.
See the controls on a real record.
Bring one worker file and we will show who could see it, how long it is kept and what leaves the system when it is asked for.