{"id":4226,"date":"2018-04-10T15:00:42","date_gmt":"2018-04-10T14:00:42","guid":{"rendered":"https:\/\/www.sage.com\/en-gb\/blog\/?p=4226"},"modified":"2026-01-29T10:39:08","modified_gmt":"2026-01-29T10:39:08","slug":"gdpr-and-payroll","status":"publish","type":"post","link":"https:\/\/www.sage.com\/en-gb\/blog\/gdpr-and-payroll\/","title":{"rendered":"GDPR and payroll: 10 things your business needs to have done"},"content":{"rendered":"
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\tStrategy, Legal & Operations<\/a>\t\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\tGDPR and payroll: 10 things your business needs to have done\t\t\t\t\t<\/h1>\n\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n\t\t

\n\t\t
\n\t\t\t
\n\t
\n\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t
\n\t\t\t\n\t\t\t\t\"\"\t\t\t\tStacey McIntosh<\/span>\n\t\t\t<\/a>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n<\/div>\n\n\n\n

The General Data Protection Regulation<\/a> (GDPR) is one of the biggest shake-ups ever seen and will affect how personal data should be handled. When the new legislation comes into force on 25 May 2018 in the European Union, it will have a direct effect in all EU Member States. But what about GDPR and payroll?<\/p>\n\n\n\n

As your payroll team deals with processing lots of personal data, payroll will one of the areas of your business that will likely require its existing processes to be revised significantly for the GDPR<\/a>.<\/p>\n\n\n\n

When it comes to GDPR and payroll, here are 10 things your payroll team needs to do now to prepare for the new legislation.<\/p>\n\n\n\n

1. Consolidate your personnel and payroll data<\/strong><\/h2>\n\n\n\n

If you currently have your personnel and\/or payroll data in lots of different locations, say perhaps across a number of different Excel spreadsheets, then you need to pull everything together into as few locations as possible. Ideally, having this data in one place will help your payroll team to oversee it properly.<\/p>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

Paying the nation<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Want to know how to pay your employees with ease while keeping up with the latest payroll legislation? Request a call back and learn more.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tFind out more<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"\"\t\t\t<\/div>\n<\/div>\n\n\n\n

2. Adopt relevant rules and standards<\/strong><\/h2>\n\n\n\n

By adopting relevant rules and standards such as ISO27001<\/a> \u2013 which is a specification for an information security management system \u2013 you can make the implementation of GDPR smoother for your business, while also meeting some of the legislation\u2019s security requirements.<\/p>\n\n\n\n

3. For GDPR and payroll, consider all sorts of data<\/strong><\/h2>\n\n\n\n

It\u2019s a challenging proposition when it comes to people management but to be GDPR compliant, you need to consider lots of different types of data. For example, how will you securely handle and store timesheets? And what about emails or text messages from employees who are asking for holiday leave?<\/p>\n\n\n\n

There\u2019s also the question of how you will securely store sick notes \u2013 and likely other data you need to consider. Determine what data you have and start to create new processes for how you will securely handle and store it.<\/p>\n\n\n\n

\n
<\/video><\/div><\/div>\n<\/div><\/figure>\n\n\n\n

4. Give payslips to your employees in a secure way<\/strong><\/h2>\n\n\n\n

Do you leave printed payslips on the desks of your employees? When the GDPR comes into force, you will have to make sure they are given to employees in a secure way.<\/p>\n\n\n\n

One solution that businesses are turning to is the use of online payslips, where employees can securely access them \u2013 they need to put a password in, for example, before they can see them. If your business is still using printed payslips, it might be worth considering following the online lead.<\/p>\n\n\n\n

5. Create a GDPR readiness plan<\/strong><\/h2>\n\n\n\n

There\u2019s not long to go until GDPR comes into force \u2013 but there\u2019s still enough time to get prepared. The date that the new legislation begins isn\u2019t going to change and your systems need to be compliant. To make that happen, create a GDPR readiness plan so you can determine where data is stored and what new processes are required to be compliant.<\/p>\n\n\n\n

If for any reason you can\u2019t be compliant by 25 May 2018, you need to make sure you have a documented plan so you can demonstrate that you have been working towards compliance. You will be at serious risk if that isn\u2019t in place and you\u2019re not working to turn the plan into a reality.<\/p>\n\n\n\n

6. Get a GDPR audit done<\/strong><\/h2>\n\n\n\n

To make sure your processes and systems are GDPR compliant, an audit by a suitably qualified individual is a highly recommended step. Remember, there\u2019s the prospect of fines of up to 4% of annual global turnover or \u20ac20m, whichever is the greater, if your business is found not to be compliant \u2013 and doesn\u2019t have a demonstrable plan in place that you\u2019re working towards.<\/p>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

GDPR webinar<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Join us for a live webinar so you have a better understanding of GDPR, which came into force on 25 May 2018, and learn about how the legislation can benefit your business.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tFind out more<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"Here\t\t\t<\/div>\n<\/div>\n\n\n\n

7. Employ or assign a data protection officer if necessary<\/strong><\/h2>\n\n\n\n

According to the GDPR, you need to make sure that data protection is a key part of your firm\u2019s process of designing and operating policies, processes, products and services.<\/p>\n\n\n\n

Certain types of businesses will need to appoint a data protection officer<\/a> (DPO) \u2013 who could be someone contracted from outside your firm or an existing employee. Those business examples include public authorities, firms that regularly monitor individuals on a large scale, and companies whose core activities involve the processing of special categories of personal data on a large scale.<\/p>\n\n\n\n

The DPO will help you to monitor internal compliance, while also informing your business on its data protection obligations, and they will advise where and when necessary.<\/p>\n\n\n\n

8. Remember what data you can and can\u2019t collect<\/strong><\/h2>\n\n\n\n

With GDPR in place, you won\u2019t be able to collect and store lots of personal data if there isn\u2019t a particular purpose for it<\/a> and consent hasn\u2019t been given. Make sure your payroll team is collecting and processing only necessary personal data that is required for each purpose.<\/p>\n\n\n\n

9. Give employees full visibility of data you hold about them<\/strong><\/h2>\n\n\n\n

Your employees need to know what personal data of theirs your payroll team and business holds. Meanwhile, you will have to respond to subject access requests (SARs) and requests for their personal data to be either rectified or erased.<\/p>\n\n\n\n

You do have the right to refuse excessive or unfounded personal data requests, however you will need to demonstrate how they are unfounded in your compliance documentation.<\/p>\n\n\n\n

10. Create GDPR-compliant privacy notices for your employees<\/strong><\/h2>\n\n\n\n

You need to let your employees know what information they are entitled to as per the GDPR\u2019s requirement for transparency and this must be done in a way that\u2019s clear. Remember, you can\u2019t use your employees\u2019 data for a different purpose without notifying them. And you might need to offer simple functionality that allows your employees to opt out of the different ways you use their data.<\/p>\n\n\n\n

How is your business dealing with GDPR and payroll? Share your stories in the comments section below.<\/p>\n\n\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

The ultimate guide to payroll compliance<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Facing the challenge of keeping up with payroll compliance? Read this guide for essential tips to make sure your business complies with the relevant payroll legislation.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tGet your free guide<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t

\n\t\t\t\t\t\n\t\t\t\t\t11,055 readers have downloaded this guide\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"Get\t\t\t<\/div>\n<\/div>\n\n\n
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

Subscribe to the Sage Advice newsletter<\/h2>\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Join more than 500,000 UK readers and get the best business admin strategies and tactics, as well as actionable advice to help your company thrive, in your inbox every month.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tSubscribe now<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\"\"\t\t\t<\/div>\n<\/div>\n\n

\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t

Browse more topics from this article<\/h3>\n\t\t\t<\/div>\n\t\t\t
\n\t\t\t\t