HR and payroll accounting in light of RODO regulations

Sensitive data should always be properly protected, especially from those not authorized to see it. A breach of personal data protection is tantamount to a breach of security due to improper destruction, loss, modification, sharing or disclosure to third parties. You can talk about violations of confidentiality, availability and integrity. If personal data is leaked, the data controller is obliged to immediately notify the relevant supervisory authority of the situation.

If a company decides to outsource HR and payroll services to an external entity, it must remember to properly secure personal data. Without this, the outsourcer should not process sensitive data. This is in violation of the Data Protection Law. However, if all the guidelines in it are met, the outsourcing company can also act as a data controller.

When signing a contract with a service provider, care should be taken to include provisions clearly stating the obligation to secure all data sets in accordance with Article 36-39 in the Law on Personal Data Protection. It is also worth noting from the outset that their processing can only take place within the scope of the contract. Any infraction should be treated as a violation of the terms of the contract and the Data Protection Law.Wszelkie wykroczenia należy traktować jako naruszenie warunków umowy i ustawy o ochronie danych osobowych. The party responsible for the misconduct must expect criminal proceedings against him.

Care should be taken to ensure that the contract signed with the outsourcing company clearly indicates how it will process personal data. The most common activities are based on their collection, storage, modification, development, sharing, deletion. If unlawful data processing occurs, which involves the violation of personal rights, compensation can be claimed in accordance with the provisions seen in the Civil Code. Employers, as data controllers, are responsible for properly preparing or updating regulations, contracts and various procedures taking place in the company. This is extremely important to protect yourself from the consequences resulting from a violation of the RODO regulations.

Internal documentation needs to be brought into compliance. It is also important to know what data can be requested from employees. Develop the correct content of the statement on consent to the processing of personal data. Take care to develop RODO information clauses for all employees. In the case of HR and payroll outsourcing, the employer does not have to deal with it all personally. Under the signed contract, the service provider will become the controller of personal data and will be responsible for any data protection violations.

When processing personal data, it is necessary to comply with the principle of lawfulness, fairness and transparency, the principle of purpose limitation of data processing, the principle of data minimization, the principle of data accuracy, the principle of data storage limitation, the principle of data integrity and confidentiality, the principle of accountability. The circulation of documents in the HR department and the use of appropriate information systems designed for processing HR and payroll data are becoming very important issues. Everything must be brought into compliance with RODO regulations.

It’s also worth knowing that data controllers can count on expert support. This is the Data Protection Supervisor. It must operate in accordance with data processing protection regulations. It is also tasked with contacting the Data Protection Authority. The data controller is responsible for appointing a data protection officer. It is worth noting right away, however, that the data protection officer does not have to be an employee of the company. You can choose to use the services of a specialized company, or outsourcing. In the second case, the need for high costs associated with retraining employees disappears. A third-party company specializes in regulatory violations, and is familiar with the data processing mechanisms of the industry. He has experience from handling many clients and thus procedurally prevents data breaches.

Source: akademia.infor.pl