Employee Records
Part of HR software privacy and permissions
Managing administrator access after an HR staff change
Transfer HR administration work, remove old privileges and verify access after an HR staff move or departure.
When an HR administrator changes duties or leaves, remove privileges they no longer need and transfer their work to an authorised owner. Check the HR platform and connected services: disabling one sign-in route may leave a local account, supplier portal or usable credential.
Identify access and work to transfer
List the person’s administrator accounts and responsibilities: user provisioning, permission changes, workflow rules, scheduled reports, integrations and supplier contact. Identify pending approvals or corrections that need a new owner. A handover task must not keep unnecessary privileged access active.
| Handover item | Check |
|---|---|
| Administrator account | Which named identity holds each privilege, and who can remove it? |
| Pending work | Who will own requests and exceptions awaiting action? |
| Scheduled output | Which reports or exports run under the person’s account? |
| Integrations and secrets | Are tokens, service accounts or recovery methods tied to the person? |
| Supplier contact | Who can request support or approve supplier access after the change? |
The Australian Cyber Security Centre advises identifying tasks that need administrator privileges, using separate attributable accounts with only the required privileges, and revalidating privileged access when duties change or someone leaves.
Remove each route
Have the identity and HR system owners follow the organisation’s change process. Review central sign-in, local HR accounts, administrator groups, delegated approvals, report sharing, export permissions, connected applications and supplier portals. Reassign work and revoke access promptly. Replace credentials that remain usable through the person’s access, using an accountable process rather than ordinary handover notes.
Check ordinary access separately. A person moving out of HR may still need employee self-service, but that does not justify access to other employees’ records. For a leaver, provide a way to retrieve business records without relying on their active identity.
Verify the result
Ask an authorised reviewer to inspect the account and permission lists. Check that the successor can do the assigned work and the former administrator cannot use the relevant routes. Where the purchased configuration provides session, token and audit controls, establish what they cover and record any route that remains unverified.
The OAIC’s security guidance addresses reviewing or revoking access when staff move or leave and linking administrator activity to individuals in audit records. Review available logs for material activity around the transition, such as unusual exports or permission changes. A log review cannot establish that no information was previously downloaded.
If there is evidence of unauthorised access, use the organisation’s incident process and assess the privacy implications. The Notifiable Data Breaches scheme applies to covered entities and eligible breaches; a staff change alone does not establish a notification duty.
Record the date, old and new owners, access removed, work transferred, checks completed and open routes. Remove any temporary successor privileges when the handover need ends.
Key Compliance and Security Metrics
