Run onboarding paperwork without an HR platform

Small-company onboarding often runs through email, shared folders, and good intentions. That can work, but only if the documents are separated by purpose and the sensitive material is handled deliberately. A new starter may give you a signed contract, tax information, bank details, identity evidence, emergency contact details, policy acknowledgements, and equipment receipts before they have sent their first work message.

This workflow is about document control. It is not employment-law or data protection advice. The checks you must complete, the documents you may collect, and the retention periods that apply vary by jurisdiction and role. Confirm the local requirements before you build the pack.

Separate documents by purpose

Do not create one mixed PDF called onboarding.pdf and let every document fall into it. Separate the pack by what each document proves and who should be able to see it. A practical small-company structure is:

• Offer letter and employment contract.
• Statutory, tax, or eligibility forms required in your jurisdiction.
• Payroll and bank details.
• Policy acknowledgements, such as handbook, confidentiality, security, or remote working policies.
• Equipment and access records, including laptop issue, software access, keys, badges, or return obligations.
• Identity or right-to-work evidence, stored apart from the general personnel file where appropriate.

The separation matters because not every manager who needs to know that a laptop was issued should also see bank account details or identity documents. It also makes retention easier when one category must be kept longer or deleted sooner than another.

Send fillable forms, not print-and-photo tasks

Asking a new employee to print a form, sign it, photograph it, and email the photo back creates poor records. The photo may be skewed, cropped, low resolution, or missing a page. Someone then retypes the information, which introduces errors in bank details, tax numbers, emergency contacts, and names.

Send fillable PDFs instead. With fill PDF form, the employee can type into the form in the browser tab and return a readable PDF. If a document needs a signature, use sign PDF and keep the signed version with the relevant category. This saves printing, reduces manual entry, and gives payroll or HR a record that can be opened without guessing what a photographed line says.

Make the form names explicit: bank-details-form, emergency-contact-form, policy-acknowledgement, and so on. If the employee sends a correction, retain or dispose of the superseded version according to your policy, but do not leave multiple conflicting copies in the same folder without explanation.

Treat identity and bank details as high-risk records

Onboarding collects some of the most sensitive data an employer will ever hold: identity evidence, right-to-work material, tax identifiers, home addresses, emergency contacts, dates of birth, and bank details. Collect only what is needed for the role and the applicable law. Do not ask for documents because an old checklist did so if the requirement no longer applies.

A browser-local process helps avoid scattering copies of someone's ID and bank details across third-party conversion queues. The document bytes are not sent to a conversion server when the form is filled, signed, flattened, or scanned in the browser tab. You still need secure storage, access control, and retention rules, but you have removed one unnecessary disclosure route from the preparation step.

Before storing a final personnel document, run a check with the privacy scanner where appropriate. It can help you notice visible or embedded personal data that should not be in a general file. Use that finding to move, minimise, or replace the document; do not hide required evidence from a record that must legally contain it.

Flatten signed acknowledgements

Policy acknowledgements and equipment receipts often start as forms. A new starter signs to confirm they received the handbook, accepted an information security policy, or took custody of a laptop and charger. Those records need to look the same later when opened by a different PDF reader or printed for a meeting.

Use flatten PDF on signed acknowledgements so the filled text and signature appearance become part of the page. Flattening stabilises the record, but it also makes fields harder to edit later. That is usually the point for a signed acknowledgement. If details are wrong, issue a corrected form and keep the audit trail according to your policy instead of editing the signed record silently.

Build the per-employee folder

Use one folder per employee with the same subfolder structure every time. For example:

1. 01-offer-contract
2. 02-statutory-tax
3. 03-payroll-bank
4. 04-policy-acknowledgements
5. 05-equipment-access
6. 06-identity-evidence-restricted
7. 07-joiner-checklist

Restrict the sensitive folders to the people who actually need them. If your storage system cannot restrict subfolders properly, use separate restricted locations for identity and payroll records rather than relying on filename warnings.

The joiner checklist closes the loop. It should list every document requested, who requested it, the date sent, the date received, whether it was checked, where it was stored, and what remains outstanding. A line marked "not applicable" is better than a blank line because it shows the item was considered.

Onboarding paperwork checklist

• Offer, contract, statutory forms, payroll details, policies, equipment, and identity evidence are stored by purpose.
• New starters receive fillable forms instead of print-sign-photograph tasks.
• Identity and right-to-work evidence is collected proportionately and stored apart from the general personnel file where appropriate.
• Signed acknowledgements and equipment receipts are flattened before retention.
• The per-employee folder follows the same structure for every joiner.
• The joiner checklist records received, checked, stored, outstanding, and not applicable items.