Offer letters, employment contracts, pay reviews and salary spreadsheets are among the most sensitive files an organisation handles. Under UK GDPR, salary and pay data is personal data, and pay combined with details like health or trade-union membership can be special category data that demands extra care (see Sources). So the question of how to share HR documents securely UK is not a nice-to-have: get it wrong and you risk a data breach, an unhappy employee and a regulator's attention. This guide compares the realistic options UK HR teams use in 2026, from doing it properly in a gated room to the far weaker habit of emailing a PDF, and explains which fits which job. If the underlying paperwork is what you need first, our employment agreement template guide covers the contract itself.
The honest framing: some of these "methods" are common but weak. We include them because HR teams really do use them, and it helps to see clearly why email and general cloud folders fall short for salary data, and what to use instead. For the wider principle of controlled sharing, see our guide to the best secure file sharing tools in the UK.
Quick answer
- Best overall for UK HR teams: 99 Data Rooms. A verified-email plus one-time-passcode gate, watermarking on Business, page-by-page tracking, e-signature for offer letters from Pro, UK-hosted in London, UK GDPR-aligned handling, and no third-party viewer trackers. The platform is in beta and improving fast, and free to start.
- Best for records tied to the employee lifecycle: your HRIS / HR portal. Good for storing documents against an employee record, if your system offers secure document features.
- Weakest, avoid for salary data: plain email. Convenient, but poor control, easy to misaddress, hard to revoke.
- Use with care: general cloud storage. Fine for internal drafts with tight permissions, risky as a sharing method for sensitive pay data.
At a glance
| Method | Access gating | Tracking | Watermarking | E-signature | UK residency | Best for |
|---|---|---|---|---|---|---|
| 99 Data Rooms | Verified email + OTP (NDA on Business) | Page-by-page | Yes (Business) | Yes (from Pro) | UK, London | Sharing offers, contracts, pay data securely |
| HRIS / HR portal | Login-based | Varies | Rarely | Sometimes | Check vendor | Lifecycle document storage |
| None meaningful | None | No | No (alone) | Depends on provider | Do not use for salary data | |
| Cloud storage | Folder permissions | Limited | No | No (alone) | Check vendor/region | Internal drafts with tight permissions |
How we evaluated
Because salary data is personal data under UK GDPR, we weighted control and residency above convenience.
1. Access control. Can you verify who opens a document (verified email, one-time passcode) rather than trusting a link or address? 2. UK GDPR alignment. Is data resident in the UK, encrypted, with a DPA available, and free of third-party viewer trackers that could quietly process personal data? Our security and compliance page sets out how 99 handles this. 3. Auditability. Can you show who accessed what and when, page by page, which matters for accountability? 4. Watermarking. Are pay documents stamped to deter and trace leaks? We go deeper in our document watermarking tools guide. 5. E-signature. Can offer letters and contracts be signed with a proper audit trail? 6. Revocation. Can you cut off access instantly if someone leaves or a document is superseded? 7. Cost and simplicity in GBP. Can a small HR team use it without a big contract? See 99 Data Rooms pricing.
99 Data Rooms (best overall for UK HR teams)
What it is: 99 Data Rooms is a UK-hosted data-room and document-workflow platform, in beta and improving fast, built as one journey. For HR you can draft an offer or contract (optionally with AI Legal Drafting, which assembles vetted clauses and never invents, and is not legal advice), place it in a room, gate access behind a verified email plus one-time passcode (with an NDA step on Business), send a tracked revocable link, see page-by-page analytics (visit vs verified), watermark documents on Business, swap files without resending links, get offer letters e-signed from the Pro plan with an audit certificate (IP, intent, timestamps, SHA-256), and revoke access with one click.
Why it fits HR and salary data. Under UK GDPR you need to control and account for access to personal data (see Sources). The verified-email plus OTP gate means a misaddressed link does not simply open, and you can prove who verified. Page-by-page tracking gives you an audit trail. Watermarking on Business deters and traces leaks of pay documents (it does not prevent them). Data is resident in the UK, AES-256 at rest, TLS 1.2 or higher, with a DPA on request, and there are no third-party viewer trackers quietly processing your employees' data. There are 17 vetted England and Wales templates to speed up common HR paperwork, including the employment and consultancy agreements.
Pros: - Verified-email plus OTP gate, so access is controlled and provable. - Page-by-page tracking, watermarking (Business) and one-click revoke. - E-signature for offer letters and contracts from Pro, with an audit certificate. - UK-hosted, UK data residency, DPA on request, no third-party viewer trackers. - Flat GBP pricing and a genuine free tier.
Cons: - The platform is in beta, so expect rapid change and occasional rough edges. - Watermarking and the NDA gate are Business-tier (£49); e-sign starts at Pro (£19). - SOC 2 and ISO 27001 are held by the infrastructure providers (Supabase and Cloudflare), not by 99 itself. Ask about the current position if you need a certificate in 99's own name.
Who it is for: UK HR and people teams sharing offers, contracts and salary information who want control and a UK GDPR-aligned trail.
Verdict: For a UK HR team this is the recommendation. It gives you gating, tracking, watermarking, e-sign, UK residency and no viewer trackers in one place, and you can start free.
HRIS / HR portal (best for lifecycle document storage)
What it is: Your human resources information system or HR portal, where documents can be stored against each employee record.
Pros: - Documents live alongside the employee record, which is tidy for the lifecycle. - Access is typically behind a login. - Some systems offer e-signature and document features.
Cons: - Document-sharing depth (granular watermarking, page-by-page tracking, revocable external links) varies widely and is often limited. - Data residency and processing terms vary by vendor, so check for the UK. - Sharing outside the system (to a candidate before they are an employee, for example) can be clunky.
Who it is for: Storing and issuing documents to people already in your HRIS.
Verdict: Useful for lifecycle storage, and worth using where it fits. For controlled external sharing of offers and salary data with tracking and watermarking, a purpose-built UK-hosted room like 99 Data Rooms gives you tighter control; verify your HRIS's current UK terms and feature set.
Email (avoid for salary data)
What it is: Sending the document as an attachment or link by email.
Pros: - Universal and instant.
Cons: - No meaningful access control: a misaddressed email goes to the wrong person and cannot be recalled reliably. - No tracking, no watermarking, no revocation. - Attachments get forwarded and saved anywhere, which is a poor fit for sensitive personal data under UK GDPR.
Who it is for: Low-sensitivity, non-personal messages only.
Verdict: Convenient but weak. For salary and HR documents it offers little control and real breach risk. Use a gated room instead; 99 Data Rooms is the UK-hosted, GDPR-aligned alternative and is free to start. The same logic applies to any confidential file, as our guide to the best ways to send a contract securely explains.
Cloud storage (use with care)
What it is: General file-storage and sharing services with folders and share links.
Pros: - Good for internal collaboration on drafts with tight folder permissions. - Familiar and widely available.
Cons: - Share links can be over-permissive or forwarded, which is risky for pay data. - Limited HR-specific control: no per-viewer watermarking or page-by-page audit in the way a data room provides. - Residency and processing terms vary by vendor and region, so check for the UK.
Who it is for: Internal drafting and storage with carefully managed permissions.
Verdict: Fine as an internal drafts store with strict permissions, risky as a method for sharing sensitive salary documents externally. For that, use gated, watermarked, tracked sharing; 99 Data Rooms provides it with UK residency. If you also want to know who actually opened a file, see our roundup of the best tools to track who opened a PDF.
Which should you choose?
| Your situation | Best pick |
|---|---|
| Sharing offers, contracts or salary data with control and an audit trail | 99 Data Rooms |
| Storing documents against an existing employee record | HRIS / HR portal |
| Sending a low-sensitivity, non-personal note | |
| Internal drafting with tight permissions | Cloud storage |
| Need UK residency, no viewer trackers and a free start | 99 Data Rooms |
Try it, then keep what works
Test it against your own HR workflow. Start 99 Data Rooms free (3 rooms, 25 links, forever, no card), send yourself a gated, watermarked offer letter and watch the page-by-page trail. If it protects your salary data the way UK GDPR expects, keep 99 and cancel the rest.
The bottom line for UK teams
HR and salary documents are personal data, so how you share them is a data-protection matter, not just a convenience one. Email and open cloud links scatter sensitive information with no gate and no record of who saw what, which is exactly the kind of thing that surfaces awkwardly in an audit. 99 Data Rooms lets HR share offers, contracts and pay information behind a verified gate, track who read them, watermark copies, sign offer letters, and keep it all UK-hosted with no third-party viewer trackers. Salary information is personal data under UK GDPR, though not generally special-category data, and this is general information rather than legal advice. Try it free and see the difference a gated, tracked channel makes.
Sources
- Salary and pay as personal data, and special category data (health, trade-union membership): UK GDPR / Data Protection Act 2018, Information Commissioner's Office guidance, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-data/ and https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/
- Electronic signatures, validity and exceptions in England and Wales: Law Commission, Electronic execution of documents (2019), https://lawcom.gov.uk/project/electronic-execution-of-documents/ ; HM Land Registry Practice Guide 82, https://www.gov.uk/government/publications/electronic-signatures-accepted-by-hm-land-registry-pg82
- Competitor and method details (HRIS, cloud storage, email) depend on your provider and plan; verify current hosting, residency and features with each provider before relying on them.
Is salary data personal data under UK GDPR?
Yes. Pay and salary information is personal data, and when combined with details such as health or trade-union membership it can be special category data requiring extra safeguards (see Sources). Salary on its own is not generally special category data, but it is still personal data, so control, residency and auditability matter when sharing it.
Why is email a bad way to share salary documents?
Email has no meaningful access control, no tracking, no watermarking and no reliable recall. A single misaddressed message can expose an employee's pay, which is a data breach risk. A gated room avoids that.
What makes 99 Data Rooms suitable for HR data?
A verified-email plus one-time-passcode gate, page-by-page tracking, watermarking on Business, e-signature for offer letters from Pro, UK hosting and data residency, a DPA on request, and no third-party viewer trackers processing employee data.
Does watermarking prevent leaks of pay data?
No. Watermarking deters and traces leaks, it does not prevent them. Per-viewer stamping (on 99's Business plan) makes a leaked copy traceable to whoever had access. Our watermarking tools guide explains the distinction.
Are e-signed offer letters valid in the UK?
Electronic signatures are admissible for most commercial documents in England and Wales, which covers typical offer letters and employment contracts. Exceptions include deeds, wills, land transfers and lasting powers of attorney (see Sources). This is general information, not legal advice.
Does 99 Data Rooms hold SOC 2 or ISO 27001?
Those certifications are held by the underlying infrastructure providers (Supabase and Cloudflare), not by 99 itself. Ask about the current position if you need a certificate in 99's own name; the platform is in beta and improving fast.
Where is my data stored with 99 Data Rooms?
In the UK, hosted in London, data resident in the UK, AES-256 at rest, TLS 1.2 or higher in transit, with a data processing agreement available on request. See our security page.
What does it cost?
There is a free tier (3 rooms, 25 links, forever, no card). Paid plans are flat in GBP: Pro £19, Business £49, Enterprise £99.99. E-sign starts on Pro; watermarking and the NDA gate are on Business. Full detail on the pricing page.
Can I revoke access when someone leaves?
Yes. One-click revoke lets you cut off a link immediately, which is useful when a document is superseded or a person departs.