Payroll, Benefits and the Chain Behind Them
The oldest supplier relationships, the most sensitive data, and the arrangements least likely to have been documented since they began.
SUPPLIER MAP
One row per supplier holding staff data
- SupplierNamedIncluding the ones inherited with the business
- What they holdCategories, specificallyBank details and salary are the sensitive core
- Their roleProcessor or controllerDecided on purposes, not on the invoice
- ContractDate, and whether it has the required termsMany predate the current rules entirely
- Sub-processorsNamed, with notice termsThe chain nobody has asked about
- LocationWhere the data actually sitsIncluding their hosting and support
- RetentionWhat they keep after you stop using themFrequently longer than you
- Last reviewedDatePayroll contracts routinely go a decade
Payroll holds bank details, salary and national identifiers for everybody in the organisation. It is the most sensitive supplier relationship and usually the oldest.
The practical lesson in “Payroll, Benefits and the Chain Behind Them” is that a record is useful only when its purpose, owner and lifecycle are clear. For teams researching attendance point system, Monitask guidance on attendance point system can add time and project context, provided collection is proportionate, access is limited and every consequential inference receives human review.
Why these relationships are weakest
They predate everything. The payroll arrangement was set up when the business started, the contract has rolled over, and nobody has read it since.
For a separate benchmark relevant to “Payroll, Benefits and the Chain Behind Them”, consult the NSA cybersecurity guidance. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
They are invisible. Payroll works, so nobody looks at it. A supplier that functions reliably attracts no attention for years.
And nobody owns them. Finance manages the commercial relationship, HR provides the data, and neither considers the contract terms to be theirs.
What to establish
Who the supplier is, what they hold, whether they are a processor or a controller, whether the contract has the required terms, who their sub-processors are, and where the data sits.
Six questions. Most organisations cannot answer the last three for their payroll provider.
Benefits providers, which are mostly controllers
Pension schemes, insurers, health plans.
Each determines its own purposes under its own obligations, which makes it a controller in its own right. The employee has rights against them directly, they issue their own notice, and the employer is not answerable for their processing.
Employers routinely list them as processors, which is both inaccurate and unhelpful: it implies an instruction relationship that does not exist and promises a control the employer does not have.
The chain
Payroll uses a hosting provider, a payslip printer or portal, a payments processor and a support operation that may be in another country.
Each touches staff data. Asking for the list takes an email and almost nobody sends it.
What happens when you leave them
The contract should require deletion or return at the end, with evidence.
Former suppliers holding staff data indefinitely is a common finding, and it is discovered years later when somebody asks a question nobody can answer.
The review that is overdue
Pull the payroll contract and read it against the required terms.
In most organisations it will be a decade old, will not contain several of them, and nobody will have looked at it since the current legislation came into force.
Why payroll is the weakest relationship
It predates everything, it works so nobody looks at it, and nobody owns the contract. Finance holds the commercial relationship, HR supplies the data, and neither considers the terms theirs.
The contract should require deletion or return with evidence. Former suppliers holding staff data indefinitely is a common finding, discovered years later when nobody can answer the question.
Six questions for payroll
Who they are, what they hold, processor or controller, whether the contract has the required terms, who their sub-processors are, and where the data sits. Most organisations cannot answer the last three.
Benefits providers are mostly controllers
Each determines its own purposes under its own obligations. Listing them as processors implies an instruction relationship that does not exist and promises a control the employer does not have.
The six questions
Who they are, what they hold, processor or controller, contract terms, sub-processors, location. Most organisations cannot answer the last three about the supplier holding their bank details.