Where do payroll firms keep client employee records, and who can open them?

Begin with a map. Where do the records sit? Some firms keep everything in one hosted system, others split data across shared drives, email, spreadsheets and paper. Ask for a plain list of each place, and who is responsible for each. Anything stored in someone’s personal account or on a personal device deserves particular attention.

Next, look at access. Who can open a client’s employee records, and who approved that? Check how a new hire gets access, how a departing employee loses it, and whether the firm keeps a record of who looked at what. If the owner and one long-serving employee hold the only logins, you need to know before closing, not after.

Then ask about backups and what the client agreements say about holding data. Find out what happens to records when a client leaves. Your lawyer can tell you what privacy obligations come with the data, and an independent technical adviser can test the setup. Do not take over any logins until the handover is agreed in writing. Ask for a copy of the access list on a given date and compare it with the staff list. Any person on one who is missing from the other needs an explanation. Include any outside contractor, such as a technical helper, who can reach the data.

Key takeaways

• Get a written map of every place employee records are kept.
• Check who has access, how it is added and removed, and whether it is logged.
• Have a lawyer review privacy duties and a technical adviser test the setup.