Employee Records
HR software privacy and permissions
Map employee data, set HR software permissions, review retention and assess supplier handling against Australian requirements.
Three decisions set the foundation: what employee information the HR system will hold, who needs each part for their work, and when it must remain available or be removed. Apply those decisions to the service and configuration the employer will actually use.
Map the information and its routes
List records in the HR system and connected tools: employee details, employment changes, supporting documents, reports, exports, notifications, integrations, backups and supplier support access. For each route, identify its purpose, authorised audience and owner.
A manager may need to know that a request awaits a decision without seeing bank details or an unrelated document. Payroll may need an approved change and its effective date without access to every HR note. Check whether reports and exports respect those distinctions as well as the main profile.
| Decision | Question to answer |
|---|---|
| Collection | Which fields and documents serve the defined HR process? |
| Access | Who may view, change, approve, download or share each category? |
| History | Can an authorised reviewer explain a change? |
| Retention | Which records must remain retrievable, and when should other data be removed? |
| Supplier handling | When and where can the provider or its subcontractors access the information? |
Apply Australian obligations to the right activity
Where APP 11 applies, an entity must take reasonable steps to protect personal information. Subject to stated exceptions, it must also take reasonable steps to destroy or de-identify information no longer needed for a purpose permitted under the APPs. Separate retention duties still matter.
Use the Fair Work Ombudsman's record-keeping guidance to check applicable record-keeping requirements. Do not assume the HR system's retention schedule alone determines how long every record must remain available.
For APP 11, protection covers misuse, interference and loss, as well as unauthorised access, modification or disclosure. The OAIC says an APP entity must take active measures to protect personal information and actively consider whether it may retain it. Reasonable steps include technical and organisational measures.
APP 11 applies to personal information an entity holds. The OAIC describes holding information as having possession or control of a record, so an employer should consider its control over records in a provider-hosted service, not just where the records are stored.
APP 11’s destruction or de-identification requirement does not apply where the information is part of a Commonwealth record, or where an Australian law or a court or tribunal order requires retention. Identify any such constraints before setting an end action for a record category.
Key Compliance Metrics for Australian HR Software
- APP 11 Protection Requirement
- Reasonable steps to protect personal information
- Cloud Responsibility Model
- Shared between employer and provider
- Admin Privilege Restriction
- Recommended practice for small and medium businesses
Check the configured service
Separate routine HR permissions from administrator powers. Review access when duties change or someone leaves.
Ask the supplier to show role views, reports, exports and support access in the proposed configuration using synthetic or suitably protected records. Mark any unshown route as unverified.
Cloud security responsibilities depend on the service, so establish which access, configuration, backup and incident tasks belong to the employer and provider.
Keep a retention schedule by record category and system. Name the basis, owner, retrieval route and end action, including for connected copies. Ask how records can be returned at contract end and how the provider handles deletion and backups. Revisit the decisions when a module, integration or workforce process changes the data flow.
In this guide
- Restricting access to employee personal informationMap HR permissions by task and check reports, exports and role changes for unintended access.
- Reviewing data retention settings with current requirementsCompare HR system retention, archive and deletion settings with requirements for each Australian employee record category.
- Managing administrator access after an HR staff changeTransfer HR administration work, remove old privileges and verify access after an HR staff move or departure.
- Evaluating a vendor's data handling evidenceCheck the scope, limits and contract fit of an HR vendor’s access, security, incident and data-exit evidence.
