What to ask a payroll supplier

A payroll bureau holds names, addresses, dates of birth, bank details, National Insurance numbers and pay for everyone you employ. It may also see sickness absence, union membership or other sensitive information. It is also a service you cannot easily do without. That combination puts it near the top of any supplier review.

This is a starting point, not a complete list. Adjust it to what your bureau actually does for you, and take advice on your own legal obligations.

Understand the service first

• Exactly which data do they receive, and how does it get to them?
• Do they have access to any of your systems, such as your HR system, and with what level of access?
• Where is the data stored and processed, including backups and support teams?
• How long would it take you to move to another provider if you had to?

Data protection

• A processing agreement. Under UK GDPR, a processor handling personal data on your behalf needs a written contract covering what they may do with it. Ask for theirs, or check yours is signed.
• Sub-processors. Who else touches the data, such as hosting providers or offshore support? How will they tell you when that list changes?
• Locations. If data leaves the UK, what safeguards apply?
• Retention and return. What happens to your data at the end of the contract, and how will they confirm it has been returned or deleted?

Security

• Multi-factor authentication for their staff, especially anyone who can see or change your payroll data. Ask whether it is enforced for all staff, not just administrators.
• Access to your data: who at the bureau can see it, and how is that access reviewed?
• Certificates or reports such as Cyber Essentials Plus, ISO/IEC 27001 or a SOC 2 Type II report. Check the scope covers the payroll service and the dates are current. Our guide to supplier certificates explains what to look for.
• Testing: when did they last have an independent penetration test, and what happened to the findings?

Incidents and continuity

• How quickly will they tell you about a breach affecting your data, and how?
• What happens if their service is unavailable on a pay day? Ask for their business continuity plan and when it was last tested.
• Do they hold appropriate insurance, such as professional indemnity and cyber cover? Ask for current certificates.

Changes worth hearing about

Agree that the bureau will tell you about things like these, and decide in advance that they will prompt a fresh look:

• moving where data is hosted or processed
• adding or changing a sub-processor
• a security incident, even one that did not affect you
• a change of ownership

Recording what you decided

If something is missing, such as evidence that MFA is enforced, you might still approve with a condition: the evidence by a set date. Record the condition, who owns it and when it is due, and check it when the date comes.

Vendwise’s built-in questionnaire covers these areas, asks the deeper questions automatically when a service handles personal data or is a critical dependency, and turns each condition into an action with an owner and a date.