Knowledge Hub
for Growth

How does GDPR affect payroll?

Whether you handle payroll in-house or outsource it to a third party you must always bear in mind your responsibilities under GDPR. Broadly speaking, your key obligations include storing data securely, processing data lawfully and having systems in place to deal with any data breach.

Your obligations will differ depending on whether you are a data controller or data processor. If you outsource your payroll function, the third party provider is a data processor while you remain controller of the data. If you retain payroll in-house you will remain both controller and processor.

Here we examine some of the issues that payroll administration raises in the context of GDPR.

You can find more general information on GDPR in our guide to GDPR compliance for business.

Why does the security of payroll data matter?

A business can’t operate effectively without a well-maintained and managed payroll system. As with any data the payroll information must be processed in accordance with GDPR principles. Bear in mind the highly sensitive and personal nature of the data held in a payroll system – clearly security must be at the forefront of your considerations. A data breach of this type of information has the potential to cause significant harm to affected individuals, increasing your liability as a controller or processor to the individuals themselves and adding to any fine or other sanction the Information Commissioner may impose under GDPR.

Payroll is one of many challenges HR professionals face when it comes to data privacy and compliance. We discuss other common issues in this data protection guide for HR professionals.

What aspects of the payroll system are vulnerable to data breaches?

Elements of many payroll systems – spreadsheets, emails containing personal information, the sharing of data among multiple employees and the high level of reliance on external payroll operators – can increase the possibility of a data breach. The nature of the information held in a payroll system (names, addresses, pension rights, bank details and salary levels for example) is also highly prized by hackers increasing the vulnerability of the data further. You should carefully monitor the number of staff with access to sensitive payroll data and introduce password protocols and encryption safeguards for all payroll files that are being shared internally and externally (with third party operators for example).

Mapping out data in your current payroll system

Article 30 of the GDPR obliges companies to maintain a record of the manner in which they process data. This is better known as a Record of Processing Activities (RoPA). Mapping out the data held in your payroll system is an effective way to ensure GDPR compliance. As part of any data mapping exercise for payroll systems you should consider:

  • What kind of data are you processing? It may include names, addresses, phone numbers, email addresses and salary details. It’s also likely to encompass bonus levels, pension contributions and bank account details.
  • Is the data stored electronically or in hard copy form?
  • How do you share the data among accounts staff internally and third party payroll companies?
  • Where do you store the data?
  • Do you know who is in overall charge of the data at any given time?
  • Why do you need the data?
  • Who has access to the data?
  • What is your legal basis for processing the data under GDPR?
  • Have you got a data retention policy in place for payroll data?

What payroll data is sensitive or ‘personal’ under GDPR?

Payroll data is inherently personal so your business must ensure GDPR compliance when handling and processing it. GDPR defines personal data as ‘information that relates to an identified or identifiable individual’. If it is possible to identify an individual directly from the information you are processing then that information may be personal data. It’s highly likely that payroll data will include personally identifiable data. Not only that, it will probably include highly sensitive information. Under GDPR, special categories of data are recognised that require a greater level of protection.

These include data about:

  • Race
  • Ethnic origin
  • Trade union membership
  • Genetic data
  • Biometric data (where this is used for identification purposes)
  • Health data

To lawfully process this type of data you need to identify both a lawful basis (Article 6 GDPR) and a separate condition for processing under Article 9 of GDPR.

Do you need all the data you capture?

Care should be taken with the data captured by your payroll system. If you hold too much information on an individual or you retain personal data for longer than necessary, individual employees can legitimately request deletion of the information, and your organisation will fall foul of data protection rules.

Always bear in mind the principle of transparency that underpins the GDPR regime. It means that:

  1. You must have a lawful basis for processing the data; and
  2. Data can only be used in a way that’s fair (so you can’t mislead employees about how you are using their data).

In addition, the data you hold in your payroll system must only be for a specified purpose and can only be held for as long as you need it.

With these considerations in mind you should regularly review and audit the content of your payroll systems to ensure that you hold the data in a way that’s consistent with GDPR. This can be done as part of a data mapping exercise as described above.

How do you store data? Could you improve data storage methods?

GDPR means understanding the personal data you hold, where you hold it and ensuring that it is held securely. Payroll data can be held on site or remotely in the cloud. Many organisations use a combination of both methods. We’ll look at both:

  • On-site storage: This may be through a manual filing system or locally saved files. It means you will have easy access to data at all times and enables your organisation to have total control of the data at all times. However, a manual filing system is cumbersome and requires a lot of staff resources to update. GDPR means you must have an in-depth understanding of the data you hold at all times and the reasons why you are holding the information. This is difficult to achieve with a manual storage system. Holding information on company PCs and local servers also leaves the data at greater risk of corruption and destruction if individual devices are damaged. The data may also be more vulnerable to attack.
  • Cloud-based storage: Storing data on the cloud reduces the risk of loss because you won’t be relying on a single device to store your data. Your storage provider should also be able to provide details of the security measures in place (how often back-ups are carried out for example). This is crucial for GDPR compliance. In addition, the flexibility of the cloud means you and your employees can access the information from different locations. Remember however, even when you entrust your data to a cloud storage provider under GDPR, ultimate responsibility for the data security remains with you. Appropriate checks and due diligence should be carried out before deciding on which storage provider to use.

Using a third party payroll operator raises issues around secure data storage that we’ll address in more detail below. Ultimately the method you choose for storing payroll data will depend on a number of factors including security levels, cost, your business needs, and ease of access.

Your liability for third party processors and GDPR breaches

If you manage the payroll function internally you are both the data controller and data processor. For business purposes it’s common for an organisation to outsource all payroll matters to a third party provider. It’s important to remember that by outsourcing in this way you do not avoid all your obligations under GDPR. A business that delegates payroll to a payroll company remains as data controller (with all associated responsibilities for GDPR compliance) while the external company usually becomes the data processor for GDPR purposes. Crucially GDPR requires you to have in place a written contract with the payroll company in place covering:

  • The subject matter and duration of the processing
  • The nature and purpose of the processing
  • The type of personal data processed
  • The categories of data subjects
  • Your obligations and rights
  • Security measures to protect data
  • Confidentiality of data

The payroll company can only process data in accordance with the written contract – so it will at all times be acting on the controllers' instructions.

Are your third-party processors secure?

As controller you must take steps to satisfy yourself of the security measures in place at your third-party payroll provider. To a degree, GDPR assists controllers in this task by requiring third party processors such as payroll companies to:

  • Process personal data only on written instructions from the controller.
  • Ensure that their staff with access to the payroll data are under strict confidentiality obligations.
  • Ensure the security of the data that it processes (using pseudonymisation and encryption for example).
  • Return or destroy the data at the end of the contract.

How often do you audit your data?

We discussed above the importance of ensuring you do not capture too much data and that you keep data accurate and up to date. This means deleting inaccurate information and removing data that you no longer need. In addition, under the storage limitation principle data that identifies individuals (such as payroll data) can only be held for a strict period of time.

To ensure you are not holding information in a way that is inconsistent with GDPR you should implement a comprehensive data retention policy and ensure that all relevant staff members are aware of the need for regular data protection auditing. If outsourcing your payroll function you should satisfy yourself that the payroll operator you choose also has GDPR compliant data retention and data audit policies in place.

Your payroll system contains highly sensitive information on your employees. Under GDPR you must ensure it’s processed securely. If you outsource the payroll function of your business you still have GDPR obligations and the controller/processor relationship can raise complex issues as we’ve seen. Our data protection solicitors are on hand to provide bespoke training and advice for HR and accounting staff and others involved in payroll operations.

What next?

For more advice on GDPR call us on 0800 689 1700, email us at, or fill out the short form below with your enquiry.

Your data will only be used by Harper James Solicitors. We will never sell your data and promise to keep it secure. You can find further information in our Privacy Policy.

Our offices

A national law firm

A national law firm

Our commercial lawyers are based in or close to major cities across the UK, providing expert legal advice to clients both locally and nationally.

We mainly work remotely, so we can work with you wherever you are. But we can arrange face-to-face meeting at our offices or a location of your choosing.

Head Office

Floor 5, Cavendish House, 39-41 Waterloo Street, Birmingham, B2 5PP
Regional Spaces

Stirling House, Cambridge Innovation Park, Denny End Road, Waterbeach, Cambridge, CB25 9QE
13th Floor, Piccadilly Plaza, Manchester, M1 4BT
10 Fitzroy Square, London, W1T 5HP
Harwell Innovation Centre, 173 Curie Avenue, Harwell, Oxfordshire, OX11 0QG
1st Floor, Dearing House, 1 Young St, Sheffield, S1 4UP
White Building Studios, 1-4 Cumberland Place, Southampton, SO15 2NP
A national law firm

Like what you’re reading?

Get new articles delivered to your inbox

Join 8,153 entrepreneurs reading our latest news, guides and insights.


To access legal support from just £145 per hour arrange your no-obligation initial consultation to discuss your business requirements.

Make an enquiry