Staff Directory Template

In plain language: Captures the employee's legal full name, unique employee ID, job title, and a photo reference field used to link to a profile image.

Common mistake: Using a nickname or preferred name as the primary name field — legal name must be the primary identifier to match payroll and compliance records; preferred name can be a secondary field.

In plain language: Records the employee's department, team, and cost center to support headcount reporting, budget allocation, and directory filtering.

Common mistake: Leaving the cost center blank for small businesses. Even simple cost-center coding makes year-end payroll allocation and audit evidence significantly easier to produce.

In plain language: Lists the employee's work email, direct phone or extension, mobile number (where provided), and physical office or work-from-home location.

Common mistake: Including personal email addresses alongside work emails in a shared directory. Personal contact data in a company-controlled document expands the organization's data-processing obligations under GDPR and similar privacy laws.

In plain language: Identifies the employee's direct manager by name and title, and the next-level skip manager, establishing the formal accountability chain.

Common mistake: Listing only a manager's name without their title or employee ID — when managers change, the directory entry becomes ambiguous and links to the wrong person.

In plain language: Records whether the employee is full-time, part-time, fixed-term, or contractor, along with their current active or inactive status and any leave classification.

Common mistake: Categorizing contractors as employees in the directory without a distinction flag. Misclassification evidence in internal documents can be used against the employer in a worker-status dispute.

In plain language: Records the employee's original hire date and, where applicable, a service credit date that may differ for employees rehired or transferred from a related entity.

Common mistake: Using the payroll start date instead of the actual hire date for employees who completed an unpaid training period. The discrepancy creates incorrect tenure calculations for notice-period and severance entitlement purposes.

In plain language: Defines who within the organization may view, edit, or export the directory, and states that the document is for internal use only and must not be shared externally without authorization.

Common mistake: Publishing an all-staff directory with mobile numbers and locations to a shared drive with no access controls. An unrestricted internal directory creates material risk under GDPR, PIPEDA, and equivalent laws.

In plain language: A signed or initialed section where each employee acknowledges that their personal information is held in the directory, confirms its accuracy, and consents to its use for internal operational purposes.

Common mistake: Omitting the consent block entirely and relying on an employment contract's general data-processing clause. A separate, specific acknowledgment is stronger evidence of informed consent and is increasingly expected by regulators under GDPR Article 7 and equivalent standards.

In plain language: States how often the directory is reviewed and updated, who is responsible for initiating changes, and the process employees must follow to correct inaccurate personal information.

Common mistake: Setting an annual update cycle without a trigger-based update obligation. Stale directory records — listing departed employees as active or showing wrong managers — are a compliance risk and an operational hazard during emergencies.

In plain language: Specifies how long records are retained after an employee leaves and how inactive records are removed or archived, in line with applicable employment and tax law retention minimums.

Common mistake: Deleting all directory data immediately upon termination to 'respect privacy.' Most jurisdictions require employment records to be retained for 3–7 years post-separation for tax, pension, and litigation purposes.

A staff directory is an internal organizational document that records each employee's name, job title, department, contact details, reporting line, and employment status in a single structured reference. It is used by HR, operations, IT, and management to locate colleagues, manage access provisioning, produce headcount reports, and support emergency communications. In organizations subject to data protection law, the staff directory is also a personal data record that must be governed, secured, and retained according to applicable regulations.

A staff directory is an HR record rather than a contract, but it carries significant legal weight. It is personal data under GDPR, UK GDPR, PIPEDA, and similar privacy laws, which means the organization must have a lawful basis to hold it, secure it appropriately, and retain or delete it within defined timeframes. It can also be introduced as evidence in employment disputes to establish reporting lines, employment classification, or tenure. Treating it as a casual contact list rather than a governed document creates material legal and regulatory exposure.

A complete staff directory typically includes full legal name, unique employee ID, job title, department, cost center, work email, direct and mobile phone numbers (with consent), work location, direct manager, employment type (full-time, part-time, contractor), employment status (active, on leave, inactive), and hire date. It should also include an access control header, a data classification notice, employee acknowledgment signatures, and a retention and deletion policy.

Access should be role-based and documented. HR administrators typically have full edit rights. Line managers generally have read access to their direct reports' records. An all-staff view — showing name, title, email, and direct line — is common for operational use but should exclude sensitive fields like employment classification, hire date, and status flags. Access to the full directory should require approval and should be logged.

Under GDPR and UK GDPR, the most common lawful basis for processing employee personal data in a staff directory is legitimate interests or contractual necessity — not consent. However, for optional data fields such as a photo or personal mobile number, explicit consent is typically required. Regardless of the lawful basis used, employees must be informed of how their data is held and used via a privacy notice, and the directory must be included in the organization's Record of Processing Activities (ROPA).

A staff directory should be updated on a trigger basis — any change in employment status, title, department, manager, or contact details should be reflected within 5 business days. A full review should be conducted at minimum annually, ideally aligned with the performance review cycle so employee acknowledgments can be refreshed at the same time. In organizations with high turnover, a quarterly cycle is more appropriate.

Retention requirements vary by jurisdiction. In the US, federal law requires most employment records to be retained for 3 years under FLSA and up to 7 years for tax and benefits records. In Canada, most provincial employment standards require a minimum of 3 years. In the UK, HMRC recommends 6 years for payroll- linked records. In the EU, member state labor laws typically require 3–5 years. A blanket 7-year retention period from the date of separation is a conservative but widely defensible approach across these jurisdictions.

A staff directory is a data record — structured fields containing each employee's contact information, role, and employment details. An organizational chart is a visual map of reporting relationships and hierarchy, typically showing boxes and lines rather than data rows. Both reference the same workforce, but an org chart is used to communicate structure quickly while the directory is used for operational lookups, compliance records, and data governance. Organizations typically maintain both.

Contractors can be included but must be clearly distinguished from employees. Use a separate section, a distinct row color, or an explicit employment-type field to flag the difference. Including contractors in the same undifferentiated list as employees creates misclassification evidence that can be used against the organization in tax authority audits or employment tribunal proceedings. Contractor entries should also reference the governing services agreement rather than an employment contract.