HRIS Selection
Part of HR software privacy and permissions
Evaluating a vendor's data handling evidence
Check the scope, limits and contract fit of an HR vendor’s access, security, incident and data-exit evidence.
Evaluate an HR vendor’s data handling claims against evidence for the exact service, modules and arrangement on offer. For each document, check its coverage, date, exclusions and the controls the employer must configure. A general assurance about secure hosting does not explain support access, exports or deletion for the proposed account.
Start with the proposed data flow
Describe the employee information the vendor would handle: documents, reports, imports, integrations and support access. Ask where it will be stored and processed, which subcontractors may handle it, who can access live data and what happens at contract end. Compare the answers with the order form and service terms.
Australian privacy treatment depends on the holder and activity. The OAIC publishes guidance on the employee records exemption; check how it applies to the parties and activities involved in the proposed arrangement.
Where an APP entity discloses personal information to an overseas recipient, the OAIC says the entity must take reasonable steps to ensure the recipient does not breach the APPs (other than APP 1) and is accountable for acts or practices of the overseas recipient that would breach the APPs (s 16C). Exceptions apply. Server location alone does not settle the assessment.
Key Privacy and Security Requirements from Australian Guidelines
- Australian Privacy Principle (APP) 11.3Requires reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure
- OAIC Guidance on Employee Records ExemptionApplies only if the entity is an employer and holds employee records in connection with employment
- Cross-Border Disclosure ObligationAPP entities must take reasonable steps to ensure overseas recipients comply with APPs (other than APP 1)
- Shared Responsibility Model (Cyber.gov.au)Cloud security is shared; responsibility depends on the service type (IaaS, PaaS, SaaS)
Request evidence that answers a decision
| Vendor claim to check | Evidence to request | Scope question |
|---|---|---|
| Access is restricted | Role and administrator permission documentation, support-access procedure and available audit events | Does it cover exports, integrations and the quoted tier? |
| Data is protected and recoverable | Security responsibility document, backup and restoration process, and scope of any independent assessment | Which systems, dates and customer tasks are excluded? |
| Incidents will be handled | Reporting route, notification commitments and investigation responsibilities | When will the employer receive information needed to assess its duties? |
| Data can be retrieved and removed | Sample export, field definitions, contract-exit process and deletion or backup treatment | Will required records remain usable after service ends? |
Make these requests; they are not claims that every supplier provides every item. A certificate or assessment can help, but check its named service, period, exclusions and relevance to the employer’s configuration.
Australian Cyber Security Centre guidance describes cloud security as shared, with the division depending on the service. The OAIC’s Guide to securing personal information addresses the reasonable steps entities must take to protect the personal information they hold from misuse, interference, loss, and unauthorised access, modification or disclosure, and to destroy or de-identify it when it is no longer needed (unless an exception applies). It also notes that reasonable steps include technical and organisational measures (APP 11.3). Establish who will configure access, review available logs, manage any customer-side backups and respond to alerts.
Compare evidence with the contract
Confirm which modules, environments, support services and subcontractors are in scope. Ask how changes in data location or subcontractors are communicated. For overseas handling, assess the actual access and contractual control; neither an Australian data centre nor a global-cloud label supplies the answer by itself.
For each requirement, record whether the evidence supports the proposed scope, supports it with a customer action, needs clarification or leaves an unacceptable gap. Keep the document version, supplier answer, owner and decision together. Review material service changes against the evidence used for the original decision.
Further reading: Chapter 8: APP 8 Cross-border disclosure of personal information (oaic.gov.au).
