How do I check the data security habits of a payroll service I am buying?

Payroll services hold some of the most sensitive information a small business can have: names, addresses, banking details and pay. Begin by asking for a map of where that data lives, such as the software, shared drives, email and paper, and who touches each place.

Then check the basics. Are accounts protected by more than a password? Are laptops and phones secured? Are former staff removed promptly? Are backups tested? General baseline guidance for small organizations covers these points and gives you a checklist to compare against.

Ask about incidents. Has the business ever sent a file to the wrong person or lost a device? How was it handled, and were clients told? Your lawyer can explain what duties apply to breaches, and you should ask how the seller documents them. Finally, review client agreements for promises about security and ask whether clients have audited the business. A payroll service that has answered security questionnaires will probably have good records. Consider hiring an independent adviser to test the setup before closing. Ask how the team learns about new threats such as fake emails asking for changes to bank details. Training records and sample alerts show whether staff actually pay attention. Ask to see how they verify a request to change banking before processing it.

Key takeaways

• Map where payroll data lives and who can reach each place.
• Ask about incidents, how they were handled and who was told.
• Consider an independent security review before closing.