This article gives an overview of some of the most common employee roles and access rights. It also offers best practices for assigning access rights to each role.

Administrator

The Administrator role is a preset role in Personio that has the highest access rights. Assign the Administrator role only to people responsible for Personio.

You can't assign Administrator access rights to other roles, but you can allow other roles to have Administrator access. To do this:

1. Go to Settings.
2. In the People section, click Employee roles.
3. Select the role you want to give administrator access to.
4. Click the three-dots icon on the right side of the screen and select Allow admin access.

Learn more about access rights for Administrators.

All Employees

The All Employees role is a preset role that includes every employee. As a best practice, it has limited access rights. Employees can view their own data. They also have propose rights in specific sections. The propose rights include uploading medical certificates in case of illness.

Personal data

		View	Propose	Edit
Public profile	Own
	My reports
	Custom
	All
HR information	Own
	My reports
	Custom
	All
Payroll information	Own
	My reports
	Custom
	All
Bank details	Own
	My reports
	Custom
	All
Emergency contact	Own
	My reports
	Custom
	All
Personal data	Own
	My reports
	Custom
	All

 

Salary information

		View	Propose	Edit
Salary information	Own
	My reports
	Custom
	All

 

Attendance data

		View	Propose	Edit
Attendance data	Own
	My reports
	Custom
	All

 

Documents

		View	Propose	Edit
Work contracts	Own
	My reports
	Custom
	All
Absence certificates	Own
	My reports
	Custom
	All
Application documents	Own
	My reports
	Custom
	All
Payroll	Own
	My reports
	Custom
	All
Other Documents	Own
	My reports
	Custom
	All
Performance	Own
	My reports
	Custom
	All

 

Performance data

		View	Propose	Edit
Performance data	Own
	My reports
	Custom
	All

 

Manage accounts

		View	Propose	Edit
Manage accounts	Own
	My reports
	Custom
	All
Reset password	Own
	My reports
	Custom
	All

 

Absence

		View	Propose	Edit
Paid Vacation	Own
	My reports
	Custom
	All
Sickness	Own
	My reports
	Custom
	All
Parental Leave	Own
	My reports
	Custom
	All
Maternity Leave	Own
	My reports
	Custom
	All
Home Office	Own
	My reports
	Custom
	All

 

Employee history

		View	Propose	Edit
Overview	Own
	My reports
	Custom
	All
Detailed View	Own
	My reports
	Custom
	All

 

Org Chart

		View	Propose	Edit
Org Chart	All

 

Working Students

"Working Students" use the All Employees role as a basis. They also have edit rights for study-related documents, such as enrollment certificates. With these rights, they can upload these documents themselves.

They have propose rights for attendance data so they can enter their daily working hours in Personio. You can also add an approval process requiring the supervisor to confirm the hours. Learn more about how to set up an approval process.

 

Documents

		View	Propose	Edit
Study documents	Own
	My reports
	Custom
	All

 

Attendance data

		View	Propose	Edit
Attendance data	Own
	My reports
	Custom
	All

 

HR Manager

The "HR Manager" has rights similar to the Administrator. The key difference relates to salary information. In this best practice, a filter prevents HR managers from viewing or editing their colleagues' salaries in the HR department. To set up a filter like this:

1. Create the attributes "Department" and "HR"
2. Customize the filter using "Department" is not "HR"

The "HR Manager" role also has edit rights for HR documents.

Salary information

		View	Propose	Edit
Salary information	Own
	My reports
	Custom
	All

 

To ensure salary data isn't visible during onboarding, use these recommended settings. These settings prevent the visibility of attributes that contain salary data. Example attributes include:

• "Fixed Salary"
• "Hourly Salary"
• "Recurring Compensations"

		View	Propose	Edit
Onboarding	Own
	My reports
	Custom
	All

 

Documents

		View	Propose	Edit
Work contracts	Own
	My reports
	Custom
	All
Absence certificates	Own
	My reports
	Custom
	All
Application documents	Own
	My reports
	Custom
	All
Payroll	Own
	My reports
	Custom
	All
Other Documents	Own
	My reports
	Custom
	All
Performance	Own
	My reports
	Custom
	All

 

Finance

The "Finance" role has access rights for payroll accounting and salary reports. Employees in this role have access to salary data for all employees.

 

Salary information

		View	Propose	Edit
Salary information	Own
	My reports
	Custom
	All

 

Documents

		View	Propose	Edit
Payroll	Own
	My reports
	Custom
	All

 

Reporting

		View	Propose	Edit
Salary	Custom
	All

 

Account configuration

		View	Propose	Edit
Cost centers	All
Payroll	All

 

Imports

		View	Propose	Edit
Document Import	All

 

Recruiter

The "Recruiter" role has all the access rights necessary for the application pipeline.

Documents

		View	Propose	Edit
Application documents	Own
	My reports
	Custom
	All
Recruiting email attachments	Own
	My reports
	Custom
	All

 

Reporting

		View	Propose	Edit
Headcount	Custom
	All
Hires	Custom
	All
Applications	All
Channels	Custom
	All
Application Funnel	All
Rejected Applicants	All

 

Recruiting

		View	Propose	Edit
Recruiting	All