To share offer letters securely, send the candidate a gated, tracked link to the letter rather than an email attachment, require them to verify their identity before opening it, and collect their acceptance by electronic signature with an audit trail. An offer letter carries genuinely sensitive personal data: the candidate's name, the role, and above all the salary and package. Emailed as an attachment, it sits unprotected in an inbox that may be a shared work address, gets forwarded, and leaves you with no record of whether it was read or by whom. For a UK employer, handling that information carelessly is both a data protection concern and a needless commercial risk, because salary details have a way of travelling. This guide explains how to do it properly. It is general information, not legal advice.
The offer stage is a delicate one. You are making a formal commitment, the candidate is weighing it up, and the details are confidential to both sides. Getting the mechanics right, secure delivery and a clean acceptance, sets a professional tone and protects the pay data at the centre of the document. It sits within the wider discipline of handling HR and salary documents carefully, which we cover in best ways to share HR and salary documents.
Why an offer letter needs more than an email attachment
An offer letter is not just a nice message; it contains structured personal and financial data about an identifiable person, which brings it within UK data protection expectations. Three risks follow from emailing it as an attachment.
Confidentiality. Salary is the single most sensitive number in most organisations. A forwarded or misdirected offer letter can reveal what you pay, seed internal pay disputes, or hand a competitor useful intelligence. Once it is an attachment in an inbox, you have no control over where it goes.
No delivery confirmation. With an attachment you cannot reliably tell whether the candidate opened it, which matters when an offer has a deadline and a start date hanging on it. You are left chasing by email with no visibility.
Weak acceptance record. Replying "yes, I accept" by email is legally workable but messy: it is easy to lose, hard to tie definitively to the person, and offers no structured record of when and how acceptance happened. A proper electronic signature with an audit trail is cleaner and more defensible.
The offer letter is also the front door to the employment relationship, and it should line up with the contract that follows. What that contract must contain is set out in what every UK employment contract must include, and you can draft the agreement itself from a vetted template, which we cover in the employment agreement template guide. Treating the offer as the first controlled document in that chain, rather than a loose email, keeps the whole hire tidy.
The two jobs: deliver securely and capture acceptance
Sharing an offer letter well has two halves, and both matter.
Secure delivery means the letter reaches the named candidate and only them. Rather than a forwardable attachment, you send a tracked link that requires the candidate to verify their identity, typically a verified email and a one-time code, before the letter opens. That ties the open to the individual and keeps the salary details out of open inboxes and off shared drives. You also get to see when they opened it, so you know the offer has landed and can time your follow-up rather than guessing.
Capturing acceptance means turning "I'd like to accept" into a clean, dated, attributable record. An electronic signature does this: the candidate signs the letter in the browser, and you receive an executed document with an audit certificate recording who signed, when, from where, their intent to sign, and a tamper-evident fingerprint. That is a far stronger record than a one-line email reply, and it is admissible for this kind of document. Electronic signatures are recognised as valid for most commercial and employment documents in England and Wales, with special formalities reserved for things like deeds and land transfers (see Sources). Whether e-signatures hold up is a common worry, and we answer it in full in are electronic signatures legal in England and Wales.
What good looks like, step by step
A tidy, secure offer process runs like this. Prepare the offer letter, ideally consistent with the employment contract that will follow. Share it as a gated, tracked link to the candidate's personal email, requiring verification to open. Watch for the open so you know it has been received, and follow up warmly if it sits unread as a deadline approaches. When the candidate is ready, have them accept by signing electronically, so you receive an executed letter with an audit trail. Keep the signed letter and the contract together in one place, so the record of the hire is complete and retrievable.
This also respects the candidate's data. You are minimising who can see their salary, not broadcasting it; you are keeping the record in a controlled place rather than scattered across inboxes; and you have a clear log of access and acceptance if anyone ever queries the process. For a UK employer, that is simply good practice around personal data as well as good hiring hygiene.
How 99 Data Rooms handles offer letters
99 Data Rooms lets you run both halves in one place. You upload the offer letter and share it as a tracked, revocable link to the candidate. Before it opens, you can require a verified email and a one-time code through our gating and access-control feature, so the salary details only reveal themselves to the named candidate, not to whoever an inbox is shared with or a link is forwarded to. Page-by-page analytics tell you when the letter was opened, with a clear split between a verified viewer and a raw visit, so you know the offer has genuinely landed.
When the candidate accepts, they sign in the browser through our e-signature feature, available from the Pro tier, and you receive the executed letter with an audit certificate recording who signed, when, their IP and intent to sign, plus a SHA-256 fingerprint, the kind of record we explain in what is an e-signature audit trail. If an offer is withdrawn or superseded before acceptance, one click revokes the link. And because you can draft the accompanying employment agreement from a vetted England and Wales template in the same platform, the letter and the contract stay together as one clean record of the hire.
The drafting side is worth a word, because it is genuinely useful here: the AI Legal Drafting feature is live, and it assembles documents from vetted England and Wales clauses rather than inventing wording, so your employment paperwork starts from a solid, current baseline. You can browse the template library on our site. It is a starting point, not a substitute for advice on anything unusual. The wider platform is in beta and improving fast, but the offer-and-accept loop works today.
Send your next offer letter securely, for free
You can gate, track and e-sign an offer letter, and draft the matching contract, inside 99 Data Rooms. The free tier is a real tier, not a trial: three rooms, twenty-five active links, forever, no card required (e-signature is available from the Pro tier). Start for free and send your next offer as a controlled, signable link.
Sources
- Electronic signatures are valid for most documents in England and Wales, with formalities reserved for deeds and certain instruments: Law Commission, Electronic execution of documents (2019), https://lawcom.gov.uk/project/electronic-execution-of-documents/ ; HM Land Registry Practice Guide 82, https://www.gov.uk/government/publications/electronic-signatures-accepted-by-hm-land-registry-pg82
- Handling personal data such as salary details: Information Commissioner's Office, UK GDPR guidance, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
How do I share an offer letter securely with a candidate?
Send a gated, tracked link to the candidate's personal email rather than an attachment, require them to verify their identity before opening it, and collect acceptance by electronic signature with an audit trail. This keeps the salary details out of open inboxes and gives you a clean record of delivery and acceptance.
Is an offer accepted by electronic signature legally valid in England and Wales?
Electronic signatures are recognised as valid for most commercial and employment documents in England and Wales, provided the usual contract requirements are met; special formalities apply to a limited set of instruments such as deeds and land transfers (see Sources). Acceptance by e-signature is generally cleaner and more defensible than a one-line email reply. See are electronic signatures legal. This is general information, not legal advice.
Should the offer letter match the employment contract?
Yes, the offer should be consistent with the contract that follows, which must contain the particulars set out in what every UK employment contract must include. Keeping the letter and the contract together, drafted from a consistent employment template, avoids mismatches and disputes later.
How do I protect the candidate's salary data?
Minimise who can see it: gate the letter to the named candidate behind verified access, keep it out of shared inboxes and drives, and hold the record in one controlled place with an access log. This aligns with careful handling of HR and salary documents, covered in best ways to share HR and salary documents.
Can I tell whether the candidate has opened the offer?
Yes, page-by-page analytics show when the letter was opened and whether the viewer was verified or a raw visit, so you know the offer has landed and can time your follow-up rather than chasing blindly.