HR PDF Documents: Employee Data Privacy Without Upload

Payslips, employment contracts, annual appraisals, disciplinary files, sick notes: HR handles the most personal documents in the company, every day. Social security number, IBAN, salary, sometimes health data — a single file can concentrate most of what GDPR protects. Dropping those PDFs on a free online tool is not a harmless shortcut: it is subcontracting, with obligations attached. Local processing avoids that without changing the gestures.

Why uploading an HR document triggers GDPR

The mechanism is the same as for lawyers and professional secrecy, under a different legal regime: as soon as a service receives employees’ personal data to process it, it becomes a data processor under Article 28 GDPR. Concrete consequences for the employer, who remains the data controller:

• a processing agreement (DPA) must govern the subcontracting — free tools almost never offer one;
• the processing must appear in the record of processing activities;
• if the provider hosts outside the EU, additional transfer safeguards are required.

Processing that runs inside the browser removes the transfer at the root: no upload means no recipient and no processor for that step. This is verifiable rather than promised — the full framework is in our article on GDPR and local PDF processing.

Fellowes 6M — P-4 micro-cutP-4 micro-cut: right for ID documents and financial papers.affiliate

HR workflows, with no file leaving the workstation

Assemble an onboarding bundle

Signed contract, ID document, bank details, insurance certificate: a new hire’s file is a stack of PDFs. The merge tool combines 2 to 20 of them (50 MiB total) in the chosen order; thumbnail organization removes a stray page or matches the checklist order.

Redact before internal sharing

A manager asks for “just the appraisal page” of a file, an internal audit requires anonymized documents: partial sharing is everyday HR work. The classic trap — a black rectangle drawn over text — leaves it copyable and extractable. The redaction tool works differently: on open, a local scan flags nine types of personal data — IBANs (mod-97 check digit), French social security numbers, bank cards (Luhn-validated), SIREN and SIRET, emails, phone numbers, context-marked birth dates and IPv4 addresses. You tick the occurrences to mask, or redact by keyword the names and references detection does not know. Affected pages are rasterized to images: the text under the masks no longer exists as an extractable object. Full tutorial: redacting personal data in a PDF.

Extract a partial file

To share only an excerpt — the contractual pages without the bank details, say — page extraction produces a new PDF limited to your selection (up to 1,000 pages, entered order preserved). The source is never modified.

Visually sign an internal document

Acknowledgement of receipt, amendment to initial, internal memo: the signature tool places a visual signature through the editor — drawn with mouse or finger, imported from an image, or typed as handwritten-style text. To be clear about scope: this is a visual signature, not an advanced or qualified electronic signature under eIDAS — an employment contract still requires a dedicated e-signature platform. The full distinction in visual signature vs eIDAS.

Encrypt what travels

A payslip sent by email should travel encrypted. The protection tool encrypts the PDF with AES-256 (revision 5 of the PDF standard, PDF 1.7 Extension Level 3) — the highest level the format provides, applied whatever the source document. Share the password over a separate channel. To process an entire payroll run — twenty payslips to encrypt at once — batch mode applies the same password to every file.

Clean before archiving or sending

The cleanup tool optionally removes metadata (author, edit history), JavaScript, attachments and annotations — traces that page redaction does not touch. Useful before filing a document in personnel records or sending it to a third party.

What local guarantees — and what it does not

Local processing guarantees one verifiable thing: no network request carries the document. There is therefore no server retaining the payslip, no processor to contract with for that handling, no retention window to hope is honored.

Local does not guarantee the rest: workstation security (access rights, locked sessions, browser extensions), file retention policies and the legitimacy of each disclosure remain the organization’s responsibility. And it is not a certification: no tool makes you “GDPR compliant” — it removes one cause of non-compliance for one specific step.

Checklist before sharing an HR document

1. Identify what must go out: excerpt, anonymized version or complete file.
2. Extract the relevant pages rather than sending the whole file.
3. Redact unnecessary data, then verify: open the produced PDF and try copying text under a black area — nothing must be selectable.
4. Clean residual metadata and annotations.
5. Encrypt with a password if the file travels, shared over a separate channel.
6. Check in the Network tab that no request carried the document.

Disclaimer

This article is informational content about a tool and a workflow; it is neither legal advice nor an analysis of your situation. Applicable obligations depend on your jurisdiction, collective agreements and your processing records — your DPO or legal counsel remains the reference.

Every operation described runs in your browser, like the rest of the catalog covered in the pillar article on PDF tools without upload. After a first visit, they work even without a connection.

And for the paper originals?

Fellowes 6M — P-4 micro-cutP-4 micro-cut: right for ID documents and financial papers.affiliate Fellowes 60Cs — 10-sheet shredderTen sheets per pass and a 22 L bin: sized for regular office use.affiliate Amazon Basics — cross-cut shredderCross-cut sufficient for everyday documents; budget-friendly.affiliate