Whether you handle payroll in-house or outsource it to a third party you must always bear in mind your responsibilities under GDPR. Broadly speaking, your key obligations include storing data securely, processing data lawfully and having systems in place to deal with any data breach.
Your obligations will differ depending on whether you are a data controller or data processor. If you outsource your payroll function, the third party provider is a data processor while you remain controller of the data. If you retain payroll in-house you will remain both controller and processor.
Here we examine some of the issues that payroll administration raises in the context of GDPR.
You can find more general information on GDPR in our guide to GDPR compliance for business.
We’ll consider the following:
- Why does the security of payroll data matter?
- What aspects of the payroll system are vulnerable to data breaches?
- Mapping out data in your current payroll system
- What payroll data is sensitive or ‘personal’ under GDPR?
- Do you need all the data you capture?
- How do you store data? Could you improve data storage methods?
- Your liability for third party processors and GDPR breaches
- Are your third-party processors secure?
- How often do you audit your data?
Why does the security of payroll data matter?
A business can’t operate effectively without a well-maintained and managed payroll system. As with any data the payroll information must be processed in accordance with GDPR principles. Bear in mind the highly sensitive and personal nature of the data held in a payroll system – clearly security must be at the forefront of your considerations. A data breach of this type of information has the potential to cause significant harm to affected individuals, increasing your liability as a controller or processor to the individuals themselves and adding to any fine or other sanction the Information Commissioner may impose under GDPR.
Payroll is one of many challenges HR professionals face when it comes to data privacy and compliance. We discuss other common issues in this data protection guide for HR professionals.
What aspects of the payroll system are vulnerable to data breaches?
Elements of many payroll systems – spreadsheets, emails containing personal information, the sharing of data among multiple employees and the high level of reliance on external payroll operators – can increase the possibility of a data breach. The nature of the information held in a payroll system (names, addresses, pension rights, bank details and salary levels for example) is also highly prized by hackers increasing the vulnerability of the data further. You should carefully monitor the number of staff with access to sensitive payroll data and introduce password protocols and encryption safeguards for all payroll files that are being shared internally and externally (with third party operators for example).
Mapping out data in your current payroll system
Article 30 of the GDPR obliges companies to maintain a record of the manner in which they process data. This is better known as a Record of Processing Activities (RoPA). Mapping out the data held in your payroll system is an effective way to ensure GDPR compliance. As part of any data mapping exercise for payroll systems you should consider:
- What kind of data are you processing? It may include names, addresses, phone numbers, email addresses and salary details. It’s also likely to encompass bonus levels, pension contributions and bank account details.
- Is the data stored electronically or in hard copy form?
- How do you share the data among accounts staff internally and third party payroll companies?
- Where do you store the data?
- Do you know who is in overall charge of the data at any given time?
- Why do you need the data?
- Who has access to the data?
- What is your legal basis for processing the data under GDPR?
- Have you got a data retention policy in place for payroll data?
What payroll data is sensitive or ‘personal’ under GDPR?
Payroll data is inherently personal so your business must ensure GDPR compliance when handling and processing it. GDPR defines personal data as ‘information that relates to an identified or identifiable individual’. If it is possible to identify an individual directly from the information you are processing then that information may be personal data. It’s highly likely that payroll data will include personally identifiable data. Not only that, it will probably include highly sensitive information. Under GDPR, special categories of data are recognised that require a greater level of protection.
These include data about:
- Race
- Ethnic origin
- Trade union membership
- Genetic data
- Biometric data (where this is used for identification purposes)
- Health data
To lawfully process this type of data you need to identify both a lawful basis (Article 6 GDPR) and a separate condition for processing under Article 9 of GDPR.
Do you need all the data you capture?
Care should be taken with the data captured by your payroll system. If you hold too much information on an individual or you retain personal data for longer than necessary, individual employees can legitimately request deletion of the information, and your organisation will fall foul of data protection rules.
Always bear in mind the principle of transparency that underpins the GDPR regime. It means that:
- You must have a lawful basis for processing the data; and
- Data can only be used in a way that’s fair (so you can’t mislead employees about how you are using their data).
In addition, the data you hold in your payroll system must only be for a specified purpose and can only be held for as long as you need it.
With these considerations in mind you should regularly review and audit the content of your payroll systems to ensure that you hold the data in a way that’s consistent with GDPR. This can be done as part of a data mapping exercise as described above.
How do you store data? Could you improve data storage methods?
GDPR means understanding the personal data you hold, where you hold it and ensuring that it is held securely. Payroll data can be held on site or remotely in the cloud. Many organisations use a combination of both methods. We’ll look at both:
- On-site storage: This may be through a manual filing system or locally saved files. It means you will have easy access to data at all times and enables your organisation to have total control of the data at all times. However, a manual filing system is cumbersome and requires a lot of staff resources to update. GDPR means you must have an in-depth understanding of the data you hold at all times and the reasons why you are holding the information. This is difficult to achieve with a manual storage system. Holding information on company PCs and local servers also leaves the data at greater risk of corruption and destruction if individual devices are damaged. The data may also be more vulnerable to attack.
- Cloud-based storage: Storing data on the cloud reduces the risk of loss because you won’t be relying on a single device to store your data. Your storage provider should also be able to provide details of the security measures in place (how often back-ups are carried out for example). This is crucial for GDPR compliance. In addition, the flexibility of the cloud means you and your employees can access the information from different locations. Remember however, even when you entrust your data to a cloud storage provider under GDPR, ultimate responsibility for the data security remains with you. Appropriate checks and due diligence should be carried out before deciding on which storage provider to use.
Using a third party payroll operator raises issues around secure data storage that we’ll address in more detail below. Ultimately the method you choose for storing payroll data will depend on a number of factors including security levels, cost, your business needs, and ease of access.
Your liability for third party processors and GDPR breaches
If you manage the payroll function internally you are both the data controller and data processor. For business purposes it’s common for an organisation to outsource all payroll matters to a third party provider. It’s important to remember that by outsourcing in this way you do not avoid all your obligations under GDPR. A business that delegates payroll to a payroll company remains as data controller (with all associated responsibilities for GDPR compliance) while the external company usually becomes the data processor for GDPR purposes. Crucially GDPR requires you to have in place a written contract with the payroll company in place covering:
- The subject matter and duration of the processing
- The nature and purpose of the processing
- The type of personal data processed
- The categories of data subjects
- Your obligations and rights
- Security measures to protect data
- Confidentiality of data
The payroll company can only process data in accordance with the written contract – so it will at all times be acting on the controllers' instructions.
Are your third-party processors secure?
As controller you must take steps to satisfy yourself of the security measures in place at your third-party payroll provider. To a degree, GDPR assists controllers in this task by requiring third party processors such as payroll companies to:
- Process personal data only on written instructions from the controller.
- Ensure that their staff with access to the payroll data are under strict confidentiality obligations.
- Ensure the security of the data that it processes (using pseudonymisation and encryption for example).
- Return or destroy the data at the end of the contract.
How often do you audit your data?
We discussed above the importance of ensuring you do not capture too much data and that you keep data accurate and up to date. This means deleting inaccurate information and removing data that you no longer need. In addition, under the storage limitation principle data that identifies individuals (such as payroll data) can only be held for a strict period of time.
To ensure you are not holding information in a way that is inconsistent with GDPR you should implement a comprehensive data retention policy and ensure that all relevant staff members are aware of the need for regular data protection auditing. If outsourcing your payroll function you should satisfy yourself that the payroll operator you choose also has GDPR compliant data retention and data audit policies in place.
Your payroll system contains highly sensitive information on your employees. Under GDPR you must ensure it’s processed securely. If you outsource the payroll function of your business you still have GDPR obligations and the controller/processor relationship can raise complex issues as we’ve seen. Our data protection solicitors are on hand to provide bespoke training and advice for HR and accounting staff and others involved in payroll operations.
