Storing and organizing performance review data - SharePoint lists or something else?

You've been given some really sound advice here! SharePoint lists will technically work for maybe 30-50 people but once you hit a few hundred it becomes really painful. While everyone mentioned the difficulty on the admin side, I also actually want to address this from the performance review aspect. The experience you're describing.

The bigger issue is that employees and managers need a clean, guided experience for reviews. A list view with 15 columns and a bunch of filtered views doesnt feel right for something this sensitive. Since someone already mentioned Entra ID integrated performance platforms, I'll double down on that too. 

I know that Teamflect, Leapsome, and Performyard all have that feature. So all worth looking into. I know Teamflect is best for MS365 but I know the others are also worth checking out.

While it CAN be done with SharePoint, the question is really one of SHOULD it be done. Personally, I think the complexity of managing all the permissions and the risks of getting it wrong are too great. It will be far easier and cheaper in the long run to get a purpose-built piece of software. Otherwise, this will become your entire life cuz it never stops with the initial "simple" request. Once you give them the one thing, then they want to expand and have something else and then they want to tie it to another thing. And "Hey can we use that data for X?" 

And then if it goes wrong and something gets out, it's a major privacy violation that I would not want to bear responsibility for. 

Trust me. Voice of experience. While it CAN be done, I don't think it SHOULD be done. Run screaming. Instead you can become the product owner for whatever system you buy and sleep well at night knowing that you won't be responsible for privacy violations.

Yes this can be done with a SharePoint list and a Power Automate flow. What one of our teams does is to use a SharePoint list where the employee initially records some data about their role, their manager and their mentor. A flow which I built for them then triggers and stops sharing the item with anyone,. Then using the Grant Access to an item or a folder SharePoint action sets the the following permissions:

• Employee: permissions set to read only.
• Employee's Manager:  permissions set to Edit.
• If the Employee has added a mentor: set the mentor permissions to read only.

Rob
Los Gallardos
Microsoft Power Platform Community Super User.
Principal Consultant, Power Platform, WSP Global (and classic 1967 Morris Traveller driver)

At 400 employees, SharePoint capacity is not the concern; a list can hold far more records. The difficult part is maintaining confidential, per-review access as managers, reporting lines, and review cycles change. SharePoint can assign unique permissions to items, but every exception adds a security scope and ongoing administration. It also does not provide a complete performance-management process.

I would evaluate a purpose-built HR or performance platform first, with Entra ID single sign-on and documented Microsoft 365 integration. Require role-based access, manager reassignment, audit history, retention, exports, and employee lifecycle controls.

Before procurement, run a small SharePoint pilot with synthetic data in a dedicated private site. Test employee, manager, HR, and administrator roles; manager changes; terminated accounts; exports; retention labels; and reporting. Have HR, security, privacy, and records-management owners approve the design before migrating real reviews. Use SharePoint only if the pilot proves the permissions and lifecycle are supportable.