Internal Company Directory: What to Show, Who Sees It

An internal company directory looks like a harmless list of names. It isn’t. Every column you add is a decision about who inside your company gets to see something, and every row that leaks outside it is research handed to a stranger. Get the fields right and it’s the page people use more than any other on the intranet. Get them wrong and you’ve published your staff’s home numbers to 400 coworkers.

This post covers what to include, what to leave out, and three judgment calls most companies get wrong: personal phone numbers, pronouns, and contractors.

What belongs in an internal company directory

Start with what someone actually needs to find and reach a colleague. That’s a short list.

• Name and preferred name. If Katherine goes by Kat, show Kat. People search for the name they hear.
• Job title and team. Titles alone are vague. “Analyst” means nothing without “Finance” next to it.
• Work email and work phone. The default ways to reach someone.
• Photo. You’ll recognize a face on a video call before you remember a name. Our post on org charts with photos explains why faces do more work than boxes.
• Manager and direct reports. This is how a new hire learns the org without asking.
• Office or city. For hybrid teams, add local time too. The remote team directory post covers why a live clock beats a time zone code.

If you’re building this in a spreadsheet first, the employee directory template has these columns laid out.

Company directory vs. HR record: keep them separate

A company directory isn’t a copy of your HR system. The HR record holds salary, date of birth, home address, emergency contacts and ID numbers. None of that belongs in a directory, and the easiest mistake is exporting the whole HR table and hiding a few columns.

Privacy law backs this up. Under UK GDPR, the ICO’s data minimisation principle says personal data should be “adequate, relevant and limited to what is necessary” for the purpose. The purpose of a directory is finding and contacting colleagues. Fields that don’t serve that purpose shouldn’t be there. Other jurisdictions have their own rules; check what applies to you. This is general information, not legal advice.

A simple test for any proposed field: would the person be comfortable with every coworker seeing it? If you hesitate, leave it out or make it opt-in.

Personal phone numbers: opt-in only

Here’s where I’d be strict. A personal mobile should never land in the directory because HR happened to have it on file. Some people are happy to be reachable on their own phone. Others took the job partly because work stays at work. You can’t tell which from the outside.

The fix is to let each person add a personal number themselves if they want to. Field staff, on-call engineers and people without a company phone often will. Everyone else keeps a work number and nothing more.

Emergency contact details are a different list. Keep them in the HR system, where a manager can get them when something goes wrong, not in a page the whole company can browse.

Pronouns and bios: offer the field, don’t require it

Pronouns are useful in a directory for the same reason photos are: they help you address someone correctly before you’ve met them. That matters most in larger or distributed companies, where your first contact with a colleague is often an email.

Make the field optional and editable by the employee. Don’t prefill it from HR gender data, and don’t make it mandatory. A blank field is a perfectly fine answer.

Short bios work the same way. “Ask me about the ERP migration” or “Based in Leeds, usually online from 8” gives a new teammate something better to open with than “hi.” Let people write their own, and keep it to a line or two.

Contractors: show them, but label them

Contractors are a bigger share of the workforce than many directories admit. BLS data on contingent and alternative employment arrangements found 11.9 million people were independent contractors on their main job in July 2023, 7.4% of total US employment. Add agency temps and contract-firm staff and the number grows.

If a contractor sits in your standups and answers your tickets, people need to find them. Leaving them out just means someone asks around in chat. But list them with a clear label. A badge or tag saying “Contractor” tells colleagues this person may not have the same system access, approval authority, or length of stay as an employee.

Short-term or one-off contractors are another matter. If someone’s in for a two-week project, a directory entry is more cleanup than it’s worth. Pick a rule, such as “contractors on engagements longer than 90 days get listed,” and apply it consistently.

Who should see it: everyone inside, nobody outside

The directory should be behind your company login. Not a public page, not a shared link that works for anyone who has it, not a PDF attached to an onboarding email that gets forwarded.

Why so strict? A list of names, titles and reporting lines is the starting kit for impersonation. CISA’s guidance on social engineering and phishing warns against giving out information about your organization, “including its structure,” unless you’re sure of the person’s authority to have it. Business email compromise, where an attacker poses as an executive or supplier, cost victims more than $3 billion in 2025 according to the FBI IC3 2025 Internet Crime Report. Knowing exactly who the CFO’s assistant is makes those emails far more convincing.

Inside the company, keep visibility flat. Splitting the directory into tiers where some staff can see more than others adds admin work and confuses people. If a field is too sensitive for everyone to see, it’s probably too sensitive for the directory.

FAQ

What is an internal company directory?

It’s a list of the people who work at your company, visible only to people inside it. At minimum it shows name, title, team, work email and work phone. Better ones add a photo, manager and location so you can find the right person, not just their address.

Should personal phone numbers be in the company directory?

Not by default. A work number or work mobile covers most needs. If someone wants to list a personal mobile, let them add it themselves rather than copying it from HR records.

Should contractors be listed in the employee directory?

Usually yes, if they work alongside your staff day to day, because people need to find them. Mark them clearly as contractors so nobody mistakes them for employees with the same access or authority. Short-term or one-off contractors can be left out.

Who should be able to see the company directory?

Anyone with a company login, and nobody without one. Keep it behind sign-in rather than on a shared link or public page. A full list of names, titles and reporting lines is exactly what someone writing a convincing phishing email wants.

A directory built around these choices

We’re building one. InstaCheckin People, our employee directory and org chart app, is coming soon. Employees will add their own photo and edit their phone, pronouns and bio (coming soon), so personal details are theirs to share. Contractors will show with a badge, or an admin can hide them with one setting (coming soon). Employees will sign in by invite (coming soon), so the directory stays inside the company.

Profiles will show manager, direct reports and local time, and sync with Google Workspace and Microsoft Entra ID is coming soon so joiners and leavers update themselves. Compare the options on our employee directory software page, see what’s planned on the InstaCheckin People page, then join the waitlist and we’ll email you when it opens.