Fax and HR: Sending Employee Documents Without a Slip-Up

Short answer: every week, an HR department sends documents that concentrate everything the GDPR considers sensitive — a sick note reveals a health condition, a third-party garnishment notice reveals a financial situation, a final settlement statement reveals a termination. Fax is still required or tolerated by certain counterparts (occupational health services, bailiffs, social security funds, provident institutions, the occupational physician at an industrial site), but it forgives no carelessness: one wrong digit and an employee's medical file leaves the company. The protocol comes down to five rules: verify the number against an internal reference list rather than an email, reduce the document to the strict minimum (the data minimisation principle, Article 5 of the GDPR), use a named online fax account rather than a shared machine in an open-plan office, keep the transmission receipt in the employee's file, and record the flow in the register of processing activities. Fax is not banned in HR: it is simply one of the channels most exposed to human error.

Why HR is the most exposed department in the company

People readily assume a company's most sensitive data sits with the finance director or the legal department. That is wrong. The human resources department holds, for each employee, an aggregation that few other departments possess: full identity, address, social security number, bank details, family situation, any recognised disability status, sick notes, fitness-for-work assessments, disciplinary proceedings, and sometimes court decisions.

The CNIL regularly points out, in its guidance on personnel management, that this data serves distinct purposes and should not circulate together. Yet fax has a structural flaw: it transmits pages, not fields. When you fax a thirty-page file to an organisation that only needs the March payslip, you are transmitting twenty-nine surplus pages. That is not a technical fault, it is a breach of the minimisation principle.

The second exposure factor is physical. In many SMEs, the multifunction fax machine sits in a corridor or next to the photocopier, within everyone's reach. The incoming fax lands in the output tray, and anyone walking past can read a colleague's medical certificate. That risk cannot be fixed by a contractual clause: it is fixed by switching off automatic printing and moving to paperless reception, as we explain in our guide on receiving a fax without a machine.

Which HR documents still travel by fax in 2026

The question deserves to be asked without ideology: many HR flows have migrated to online portals. The DSN (nominative social declaration) has eliminated a large share of paper mailings to social security bodies, net-entreprises centralises declarations, and the French health insurance system favours its employer e-services. But pockets of fax remain, and they are real.

The practical rule: in HR, fax must remain a fallback and emergency channel, never a routine one. If it becomes routine, that is a sign a flow has not been properly digitised — and that you should launch a migration project rather than buy toner.

The special case of the sick note

This is the document that causes the most mistakes. A sick note has three parts: the first two go to the health insurance fund's medical service, the third to the employer. The employer's copy does not mention the medical reason — and that is exactly what must remain true within your internal circuit. If an employee mistakenly sends you all three parts, you must neither keep nor forward them. The payroll officer has no business knowing the diagnosis.

A fax received in the clear on a shared machine does exactly the opposite: it exposes a diagnosis to anyone walking past. The solution is not to forbid employees from sending a fax, it is to secure reception. A service that routes incoming faxes to an encrypted, named mailbox solves the problem with a single configuration.

The seven-point protocol for an HR transmission

1. Verify the number against a reference list, never in an email thread

The costliest mistake is always the same: copying a number found in a follow-up email or on a scrap of paper lying on the desk. HR departments should maintain an internal directory of recurring recipients — partner bailiffs, occupational health service, provident institution, health insurance scheme — with the number validated once a year. A verification call before any first transmission to a new recipient costs three minutes and prevents a data breach notification.

If the mistake happens anyway, there is a precise procedure, which we detail in our article on a fax sent to the wrong number: it plays out within seventy-two hours.

2. Trim the document before sending it

Before placing a file in the feeder, ask yourself: what is the smallest document that answers the request? A bailiff seeking the attachable portion of wages does not need the annual appraisal. A landlord asking for proof of employment does not need the full contract with its non-compete clause.

When a document must be redacted, technique matters. A stroke of black marker on a photocopy often still lets the text be read through the paper or against the light. Serious HR departments use an opaque redaction marker designed for blackouts, then photocopy the redacted page and send the copy, never the struck-through original. The same rule applies to scans: masking must be done before flattening the file, otherwise the layer remains extractable.

3. Choose a named fax account over a corridor machine

Here, online fax has a decisive advantage over the fax machine: it is tied to a user account. You know who sent what, at what time, and the transmission receipt arrives in an identified mailbox. That is what makes it possible to trace a flow in a GDPR register — impossible with a shared machine where thirty people use the same code.

For sending from an isolated HR office or while working from home, a document scanner with an automatic feeder with duplex capability avoids page-by-page handling and reduces the risk of leaving a sheet in the tray. Compact models swallow a twenty-page file in one pass and produce a PDF that the online fax service can use directly. We covered these constraints in our guide on faxing while working from home.

4. Craft the cover page carefully without overloading it

The cover page of an HR fax should include the recipient's name, their role, the number of pages, a confidentiality notice and a file reference. It must never contain the detailed reason: "Transmission of file no. 2026-418" rather than "Mr Durand's sick leave — depression". A cover page often lands in a shared tray at the recipient's end; treat it like an envelope, not like a letter.

5. Keep the transmission receipt in the file

An HR transmission without proof of sending is a transmission you will not be able to defend. In employment tribunal disputes, the question "did you actually send the summons, the certificate, the document?" comes up constantly. The transmission report from an online fax — with timestamp, number called, page count, duration and status — must be exported as a PDF and filed in the employee's record, not left in the provider's history.

Be careful, however, not to overestimate its scope: a transmission report proves that a call reached a number, not that the recipient read the content. We compare these levels of evidence in our analysis of the evidentiary value of a fax before a judge.

6. Record the flow in the register of processing activities

Article 30 of the GDPR requires a register of processing activities. Personnel management always appears in it; the transmission channel, however, is often forgotten. If your sick notes pass through an online fax provider, that provider is a processor: it must appear in the register, along with the agreement required by Article 28, the hosting location and the retention period for files.

This is a point that data protection officers systematically flag in internal audits. The criteria for selecting a compliant provider are detailed in our article on the ten criteria for choosing a provider.

7. Set a retention period and stick to it

HR retention periods are regulated: five years for payslips on the employer's side under the French Labour Code, up to fifty years for certain items relating to careers and pensions, two years for unsuccessful applications unless consent is given. A fax archived "forever" in a shared mailbox is a non-compliance waiting to be found.

The right reflex is to schedule a documented annual purge. For paper files that must disappear, a cross-cut shredder at security level P-4 is the minimum acceptable standard for personal data: strip-cut shredders, whose output can be reassembled, offer no real protection. And for files awaiting destruction, a lockable tambour cabinet prevents a box of sensitive documents from sitting under a desk.

What fax cannot do in HR

You have to be clear about the limits, because confusion is expensive.

• Fax does not serve notice of dismissal. Article L1232-6 of the French Labour Code requires registered post with acknowledgement of receipt, or hand delivery against signed receipt. A fax starts no time limit and irreparably weakens the procedure.
• Fax does not count as signing a contract. An employment contract faxed and returned signed is a copy; it may serve as prima facie evidence, but a qualified electronic signature or a paper original remains far superior. See our feature on contracts and online fax.
• Fax does not replace the DSN. Social declarations go through the official channels; a fax sent to a fund in parallel regularises nothing.
• Fax does not provide security on its own. Transmission travels across networks; what really protects you is checking the number, minimising the content and receiving documents digitally.

Organising the HR workstation: the habits that count

HR compliance depends as much on how the office is arranged as on written procedures. Three points come up in every audit.

The first is screen visibility. In many companies, a payroll officer works in an open-plan office; a privacy screen filter prevents side-angle reading while a colleague walks past behind. It is a simple technical measure, explicitly cited by the CNIL among good workstation security practices.

The second is storing documents in transit. Between printing and sending, a file physically sits on a desk. Opaque flap folders with a closure stop a pile of medical certificates from being readable on the first page.

The third is training. The CNIL's documentation on personal data security and the ANSSI's guides for SMEs are freely available and are enough to build a one-hour internal awareness session. To go further, a practical guide to the GDPR in business, updated and written for non-lawyers, makes a useful reference on the department's shelf — provided you check its edition year.

Frequently asked questions

Can a sick note be sent to an employer by fax?

Yes, nothing prohibits it, and some employees do so for lack of another fast option. What matters is what the employer receives: only the copy intended for the employer should be kept. If the medical copies arrive by mistake, they must be destroyed without being circulated internally, and the employee must be told the correct procedure.

Must an HR fax appear in the GDPR register?

The "personnel management" processing activity must appear there. The online fax provider must be listed as a processor, with the hosting location and the retention period for documents on its servers. A simple subscription paid by credit card with no data processing agreement puts you in breach during an inspection.

What should I do if a fax containing a payslip goes to the wrong number?

You are facing a potential personal data breach. It must be logged immediately in the breach register, the risk to the data subject must be assessed and, if that risk is significant, the CNIL must be notified within seventy-two hours and the employee informed. Trying to have the unintended recipient destroy the document is useful but does not exempt you from logging the incident.

Is a fax admissible before the employment tribunal?

A faxed document can be submitted in evidence, but its probative force depends on the context. A timestamped transmission receipt reinforces a chronology; it does not prove the content of the page received if that content is disputed. For acts subject to formal requirements — dismissal, notified precautionary suspension, mutually agreed termination — fax never replaces the legally required form.

How long should an HR fax transmission receipt be kept?

Align it with the retention period of the document sent. A receipt linked to a payslip follows the period applicable to payslips; a receipt linked to a job application follows the period applicable to applications. A receipt kept longer than its subject is orphaned data, and therefore a non-compliance.

In summary

• The HR department concentrates the company's most sensitive data: health, finances, family situation, court decisions.
• Fax remains a useful fallback channel, never a routine one; if it becomes routine, the flow needs digitising.
• Five habits: a number verified against an internal reference list, a document reduced to the strict minimum, a named sender account, the receipt exported into the file, the flow recorded in the register.
• The medical part of a sick note must never circulate internally or come out on a shared tray.
• Fax serves notice of neither a dismissal, nor a termination, nor a social declaration: these acts follow their own formal requirements.
• Retention periods also apply to transmission receipts; a documented annual purge prevents build-up.
• Compliance depends as much on equipment and workstation layout as on written procedures.

For more, see our FAQ and our page on available countries if your transmissions involve subsidiaries or organisations outside France.