Payroll data security: evidence before assurances
Payroll records contain salary, payment, tax, absence and other information that can create serious harm if mishandled. A padlock in the browser and a statement saying “GDPR compliant” are not enough evidence to trust a processor with live employee data.
The right security discussion happens before onboarding and looks at the real operating model: people, platforms, access, data transfer, subcontractors, incidents, retention and exit.
The ten controls to request
| Control | Evidence to request |
|---|---|
| Legal roles | Named controller(s), processor(s), their responsibilities and relevant instructions |
| Written agreement | Article 28 terms where applicable, approved subprocessors and incident obligations |
| Access rights | Role-based permissions, leaver process, admin access review and MFA policy |
| Safe file transfer | Approved portal or encrypted transfer route with defined retention |
| Data storage | Actual providers, location and relevant international transfer assessment |
| Change approvals | Dual review or suitable controls around payee/bank changes and bulk exports |
| Audit trail | Logs of significant data changes, reviews and authorised actions |
| Continuity | Backup, recovery, incident escalation and payroll deadline contingency |
| Retention | Defined record schedule and deletion/return process |
| Verification | Contracts, policies and independent evidence for any certifications claimed |
Under ICO guidance on controller–processor contracts, the written terms must address processing instructions, confidentiality, security, subprocessors, rights support, end-of-contract arrangements and audits. ICO notes that some of its guidance is under review following legislative changes; verify the latest source before final legal sign-off.
Separate provider controls from this website
This public website is a static information and initial enquiry resource, operated for a proposed service contracted by PEARL LEMON ACCOUNTANTS LTD. It is not a secure payroll upload portal. The initial email composition form does not transmit files to a database, and you should not include NI numbers, bank details, payslips or full worker records in a qualification email.
We will identify the processing platform, supplier identities where applicable, hosting locations and relevant Article 28 terms within a proposed engagement before requesting worker records. No ISO 27001 certification, penetration-test history, cyber-insurance level or UK-only data hosting is represented here without evidence.
Questions for the first security demonstration
Who can view a payroll export? Can a junior administrator download the full bank file? Are third-party support operators restricted? How are employees informed about a personal data incident? Can the business retrieve a complete history if it changes supplier? What happens to temporary copies after a run?
These operational questions are more informative than a generic marketing badge. Read how a payroll engagement would work and use the provider checklist to record answers.
Do not send personal payroll records through the sales contact page. Start with a general requirements enquiry, then agree a secure onboarding method with the selected specialist.
How our white-label processing arrangement must be contracted
An employer will typically act as controller for employee payroll data. The services agreement must identify Pearl Lemon Accountants’ processing role and any specialist subprocessor relationship based on the actual operations performed, not merely on a label. Before receiving employee files we must document purpose, duration, categories of workers and data, security measures, authorised subprocessors, international-transfer controls if relevant, incident notice, assistance with rights requests, deletion or return on exit and audit provisions. The ICO processor-contract checklist is the starting point; final agreements need legal review.