GDPR Data processing modelPayroll Administration and Statutory Payroll Reporting

By: Jérôme de Mercey

Organisation: PrivateFunction: Human resourcesOrganisation: Public

Processing payroll data to calculate and pay remuneration, issue payslips, and fulfil statutory payroll and tax reporting obligations to HMRC.

Purposes (2)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Establishment of remuneration, provision of payslips

Art. 6(1)(b) UK GDPR

Contract

Payroll/tax declarations to HMRC

Art. 6(1)(c) UK GDPR

Legal obligation

Data categories (3)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Transfer order for payment

Payment instructions and transaction details for employee salary payments

Data details

Data conservation rules

Active base:

Until payroll cycle completed and payment cleared

Income Tax (PAYE) Regulations 2003, reg. 97; Companies Act 2006, s.388; Limitation Act 1980, s.5

Intermediate archiving:

At least 3 years after the end of the tax year they relate to (Income Tax (PAYE) Regulations 2003, reg. 97); as accounting records, 3 years from when they are made for a private company and 6 years for a public company (Companies Act 2006, s.388). Many employers keep them for 6 years to cover the contractual limitation period (Limitation Act 1980, s.5) and National Minimum Wage records (6 years).

Income Tax (PAYE) Regulations 2003, reg. 97; Companies Act 2006, s.388; National Minimum Wage Regulations 2015, reg. 59

Destruction

Data for tax base calculation and submission (PAYE/RTI)

Data details

Employment events

required

Employee's payroll datarequired

Tax base calculationsrequired

Data conservation rules

Active base:

Until completion of relevant HMRC submission

Income Tax (Pay As You Earn) Regulations 2003

Intermediate archiving:

3 years from end of tax year (HMRC minimum)

recommended 6 years for limitation periods

Destruction

Payslips

Data details

Withholding Tax Raterequired

Business expensesrequired

Leaves and absences giving rise to deductible or compensable deductions and any deductions legally made by the employerrequired

factors determining the award of additional compensationrequired

compensation plan and basis of calculation

required

Family status

required

National Insurance numberoptionalsensitive data

Data conservation rules

Active base:

Until payslip delivered to employee

Employment Rights Act 1996

Intermediate archiving:

Minimum 3 years (Employment Rights Act 1996) – recommended 6 years; certain pension data up to 75 years

Destruction

Data subject (1)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Employees

Author:

Jérôme de Mercey

Created at:04/21/2023

Updated on:10/05/2026

Nb using:0