Understanding GDPR and Payroll: Everything You Need to Know

---

The very nature of payroll requires key professionals within a business to collect and process accurate and reliable data about its employees. Payroll data is, then, at the centre of what you do. But when it comes to General Data Protection Regulation (GDPR), what are the rules affecting payroll data, and how can you ensure its compliance?

GDPR, Explained

It was once estimated that many global companies would look to spend roughly a budget of $7.8 billion to acknowledge General Data Protection Rules. But for those businesses in Europe, especially the UK, its less the case of budgeting for GDPR. You only need to understand how to operate compliantly to avoid costly penalties and fines.

On the 25^th of May 2018, the General Data Protection Regulations established a broad framework of compliance for how personal data should be processed and handled. This legislation (once considered one of the largest regulatory changes) directly affected all EU Member States. GDPR strengthened rules regarding personal data, which was initially governed by the Data Protection Act 1998. The focus of GDPR has been to create even greater transparency and accountability for those organisations that collect and process personal information. 

The relevance of GDPR grows stronger – and more urgently – with every new breach of its regulation. In the third quarter of 2021, the fines levied from GDPR breaches totalled over £1 billion across Europe. This included high profile retailers and tech companies like H&M, Amazon, and WhatsApp. These have become cautionary tales for many industries, as areas of businesses, such as payroll data, can easily create non-compliance that can escalate into a costly fine.

How Did Brexit Affect Payroll Data?

Even after Brexit, English law still honours data protection and privacy governed under GDPR rules, although it’s now called the Data Protection Act 2018. For those in the UK, you need to understand how GDPR affects how you operate, including how you process sensitive or personal information.

Making Payroll Data GDPR Compliant

Since 2018, many UK businesses have been navigating GDPR compliance and asking questions about the kinds of data they collect – and likely wondering if they should even be collecting it at all.

It is best practice to review and audit the data that your payroll system uses on a regular basis to ensure consistency with GDPR principles. Yet, payroll data compliance will vary depending on how you run payroll and whether it’s processed internally or externally by a third party.

You need to be cautious about the availability and accuracy of payroll information, as well as avoiding, where possible, the risks of a costly data breach.

What Data is Affected by GDPR?

As defined broadly by GDPR, any business operating in Europe (including the UK) will need to ensure consistency with data protection regulations. So, whether you’re an umbrella company or an independent firm handling bulks CSV files, you will need to monitor how information is managed, processed, secured and stored.

As GDPR is largely concerned with “general consent”, employers will need to be more aware about safeguarding employee data. That’s because revisions to data protection have placed even greater focus on the individual controlling how their information is collected and processed.

There are two main types of information to be aware of, including data that’s personal and anything that’s categorised as sensitive.

 What Payroll Data is Considered “Personal”?

Under GDPR regulations, information becomes personal when it “relates to an identified or identifiable individual”, meaning your data contains enough information to identify an individual. 

You will need to ensure that this kind of information is secure and remains unaffected by data breaches to avoid harm to your employees, clients, and the business’ reputation.

What Payroll Data is Considered “Sensitive”?

Within GDPR compliance, there are ‘special categories’ described under Article 9, and this type of information requires additional protection.

Data recognised here includes:

• Racial or ethnic origin
• Political opinions
• Trade union membership
• Religious information
• Data about someone’s health 

There are limited circumstances governing when you can process “sensitive” information, which requires strict compliance under GDPR.

GDPR & Payroll Data – What Should You Be Considering?

When it comes to understanding how GDPR affects your data, consider how you currently process payroll.

1. Do you need the data you collect?
2. Have you mapped out what data you should be collecting?
3. Are you prepared for a data breach (including when one should be reported)?
4. Do you have a process for removing inaccurate (or out-of-date) information?
5. The size of your organisation doesn’t matter – you will still likely be the target of a data breach.

It’s worth remembering that tightening data protections has not put an end to data breaches, it has only made it more urgent for companies to safeguard their data, and anything used by your payroll system could be vulnerable. 

How Does GDPR Affect Payroll?

Regardless of whether you conduct payroll in-house or if you outsource to a third party, you must always be considerate of your responsibilities under GDPR.

The main areas on which to broadly focus include::

• Securely storing data
• Having prevention plans in place in the event of a breach
• Processing any and all data lawfully

Importantly, if you run payroll internally you will be both data controller and processor. This means you have full responsibility to ensure that data is being compliantly managed by the right professionals within your organisation. 

Securing Your Payroll Data

An accurate and reliable record of payroll data is critical to your business operation, ensuring you pay staff correctly and on-time. But you must manage all payroll information or data in a way that is compliant with GDPR principles.

Security matters to your payroll operation because, handling financial and personally sensitive information, you may be the target of a data breach. If a data breach were to occur, the consequences could be costly for your business. Potentially this could lead to financial or personal harm to those employees who have been affected by a breach, making you both more liable and increasing the risk of data loss and penalties from the Information Commissioner (IC).

Avoid a breach, data loss or corruption, and potential costly fines by securing your payroll data. If unmanaged, a data breach could create more than financial damage. It could also cause reputational harm, causing your employees, clients, or both, to lose trust and faith in the business.

So, What Areas of Payroll Are Most Vulnerable?

The possibility of a data breach increases when payroll data is most vulnerable. But most companies do not know how to identify this.

A payroll system processes large volumes of personal or sensitive information, containing everything from financial data to employee information. You can collect this via spreadsheets, emails, or perhaps when you distribute a payslip digitally.

The kind of information typically processed in a payroll system might include:

• Name of employees
• Private addresses of employees
• Pension information
• Salary
• Bank details

This data may be pursued by cybercriminals, and will often be the target of a breach. This is especially the case with any financial information, such as bank details and salaries. This makes it urgently important for employers – and those running payroll – to be carefully cautious and aware of any system vulnerabilities.

The most effective starting point is to monitor and review the number of staff with access to payroll data. Then, introduce password walls, encryption, and other protections to ensure the safety and security of payroll files, particularly preventing information sharing.

Making Payroll Compliance Easier Than Before

Cloud payroll can make securely and efficiently handling payroll data easier than before. When payments and payroll records are manually processed, there is a greater risk of error and data insecurity. When your payroll system suffers from vulnerabilities, you become an increased target for cybercrime. 

Unlike other payroll systems, cloud payroll offers employer a secure, efficient way to collect, store and process their payroll. Working on a platform like Staffology, your business can benefit from an effective way of handling payroll data – ensuring that your records are reliable, accurate and consistent with GDPR principles.

To find out more, get in touch.

Duane Jackson, June 29th, 2022

---

---