Transfer of HR Records Between Employers

Meaning

Transfer of HR records between employers refers to the sharing or movement of an employee's employment-related information from one employer to another. This can occur when an employee changes jobs, when businesses merge or are acquired, when employees are transferred as part of a business restructuring, or when a new employer takes over an undertaking.

HR records may include:

• Employee identification and contact information.
• Employment history and joining/exit dates.
• Salary and benefits information.
• Attendance and leave records.
• Performance evaluations.
• Disciplinary records.
• Training records.
• Background-verification information.
• Tax and statutory records.
• Provident-fund and other social-security information.
• Medical or other sensitive employment information, where legally relevant.

The transfer of such records raises questions concerning privacy, confidentiality, lawful disclosure, data security and the employee's rights.

Legal Principles

1. Purpose of the transfer

An employer should have a legitimate employment-related reason for transferring HR records. Information should not ordinarily be transferred merely because another employer requests it.

For example, during a merger or acquisition, transferring employee records may be necessary to continue employment, calculate benefits and comply with statutory obligations.

2. Data minimisation

Only information reasonably necessary for the particular purpose should be transferred.

For example, a new employer may need employment dates, salary history and leave balances but may not automatically require unrelated personal information contained in an old personnel file.

3. Confidentiality

Employment records frequently contain confidential information. The previous employer should take reasonable measures to prevent unauthorised disclosure.

Confidential information can include:

• Compensation information.
• Performance assessments.
• Disciplinary records.
• Personal identification information.
• Bank details.
• Medical information.
• Family information.

4. Employee consent and lawful basis

Depending on the applicable data-protection regime and the nature of the information, processing or disclosure may require consent or another recognised legal basis.

In India, privacy must also be considered in light of Article 21 and the Supreme Court's recognition of informational privacy.

5. Security

HR records should be transferred using appropriate security controls. Employers should consider:

• Access restrictions.
• Encryption.
• Secure file-transfer systems.
• Authentication.
• Audit logs.
• Data-retention controls.
• Restrictions on downloading or copying records.

6. Accuracy

The transferring employer should take reasonable care to ensure that records are accurate.

This is particularly important for:

• Disciplinary findings.
• Performance assessments.
• Employment dates.
• Salary information.
• Qualifications.
• Termination information.

An inaccurate HR record can adversely affect an employee's future employment.

Transfer During Merger or Acquisition

A common situation is where Employer A is acquired by Employer B.

Employee records may need to be transferred so that the new employer can continue:

• Payroll.
• Benefits administration.
• Leave administration.
• Statutory compliance.
• Employee communications.
• Pension or provident-fund administration.
• Employment-contract management.

However, the fact that an acquisition has occurred does not mean that every piece of employee information can automatically be disclosed without considering privacy, confidentiality and applicable employment/data-protection requirements.

Transfer During Change of Contractor

Another common situation occurs when an organisation changes contractors.

For example:

Company A uses Security Contractor X. Contractor X's contract ends and Contractor Y takes over.

Company A may need to provide Contractor Y with certain worker information necessary for continuity of operations. However, the information supplied should generally be limited to what is genuinely required.

Particular care is necessary where records contain:

• Criminal-background information.
• Health information.
• Disciplinary allegations.
• Personal identification documents.
• Financial information.

Transfer of Disciplinary Records

Disciplinary information requires special care.

An employer should distinguish between:

1. A confirmed disciplinary finding;
2. An allegation;
3. An investigation that resulted in no finding;
4. An ongoing investigation.

These categories should not be treated as equivalent.

For example, recording that an employee was accused of misconduct as though the employee was found guilty could create serious fairness and reputational concerns.

Transfer of Medical and Sensitive Information

Medical records and other sensitive information require stronger safeguards.

Where a new employer does not need detailed medical information, transferring the complete medical file may be inappropriate.

A more limited record—for example, confirmation of fitness for a particular role—may sometimes fulfil the employment purpose without transferring unnecessary medical details.

Relevant Case Laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1

The Supreme Court recognised privacy as a fundamental right under Article 21.

The judgment recognised informational privacy as an important aspect of privacy.

Relevance: HR records contain significant personal information. Employers transferring employee records should therefore consider privacy, purpose, necessity and appropriate safeguards rather than treating personnel information as unrestricted corporate property.

2. District Registrar and Collector, Hyderabad v. Canara Bank, (2005) 1 SCC 496

The Supreme Court considered privacy concerns relating to access to personal and financial records.

The decision recognised that personal information and documents can attract privacy protection.

Relevance: HR files containing financial, personal and employment information should not be disclosed indiscriminately. A transfer between employers should have a legitimate basis and appropriate safeguards.

3. R. Rajagopal v. State of Tamil Nadu, (1994) 6 SCC 632

The Supreme Court dealt with the right to privacy and publication of information concerning private life.

Relevance: Although the case did not specifically concern HR databases, its privacy principles are relevant to the handling and disclosure of personal information held by employers.

4. People's Union for Civil Liberties v. Union of India, (1997) 1 SCC 301

The Supreme Court considered privacy-related concerns in the context of telephone interception and emphasised procedural safeguards for intrusive access to private information.

Relevance: The broader principle of procedural and privacy safeguards is relevant when employers handle sensitive employee information. Transfer of HR records should occur through controlled and authorised processes.

5. Mr. X v. Hospital Z, (1998) 8 SCC 296

The Supreme Court considered confidentiality and disclosure of medical information.

The case demonstrates that medical information can raise significant confidentiality concerns, although confidentiality is not absolute in every circumstance.

Relevance: Where HR records contain medical information, employers should carefully consider whether disclosure is necessary and legally justified before transferring the information to another employer.

6. Suchita Srivastava v. Chandigarh Administration, (2009) 9 SCC 1

The Supreme Court discussed personal autonomy and privacy in the context of reproductive rights.

Relevance: The case reinforces the broader constitutional protection given to individual autonomy and personal information. Employers handling highly personal employee information should therefore avoid unnecessary disclosure.

7. Selvi v. State of Karnataka, (2010) 7 SCC 263

The Supreme Court examined the relationship between personal autonomy, privacy and the collection/use of personal information through investigative techniques.

Relevance: The case illustrates the constitutional importance of individual control over deeply personal information. HR practices involving particularly sensitive employee information should therefore be carefully structured.

Practical Compliance Framework

An employer transferring HR records should ideally follow this process:

Step 1 — Identify the purpose
Determine why the records need to be transferred.

Step 2 — Identify the records
List the categories of information required.

Step 3 — Minimise the information
Remove information that is unnecessary for the stated purpose.

Step 4 — Establish legal authority
Determine whether the transfer is based on consent, contract, statutory obligation, legitimate business necessity or another applicable legal basis.

Step 5 — Secure the transfer
Use appropriate technical and organisational safeguards.

Step 6 — Restrict access
Only authorised personnel should receive the records.

Step 7 — Maintain an audit trail
Record what was transferred, when, to whom and for what purpose.

Step 8 — Apply retention rules
The receiving employer should retain information only for as long as legally or operationally necessary.

Example

Suppose Company A is acquired by Company B.

Company A has 500 employees and holds:

• Employment contracts.
• Salary records.
• Attendance records.
• Performance reviews.
• Disciplinary records.
• Medical records.
• Bank details.

Company B may require employment and payroll information to continue employment administration. But it should not automatically assume that every document in Company A's HR database should be transferred without review.

The parties should identify which information is necessary, establish the applicable legal basis, apply confidentiality and security safeguards, and restrict access to authorised HR personnel.

Difference Between HR Record Transfer and Employee Reference

A reference generally involves communicating selected employment information to a prospective employer.

A record transfer can involve moving an entire collection of employment records from one organisation to another.

Therefore, transferring a complete personnel file can create substantially greater privacy and confidentiality concerns than providing a limited employment reference.

Conclusion

Transfer of HR records between employers must balance legitimate business and employment requirements with employee privacy, confidentiality, accuracy and data security. The safest approach is to use a purpose-based and minimum-necessary approach: identify why the information is needed, transfer only relevant records, establish an appropriate legal basis, protect sensitive information, restrict access and maintain an audit trail.

The constitutional privacy principles recognised by the Supreme Court, particularly in Puttaswamy, provide an important framework for understanding why employee information cannot simply be treated as unrestricted corporate information.