Employee Records
Part of HR software privacy and permissions
Restricting access to employee personal information
Map HR permissions by task and check reports, exports and role changes for unintended access.
Match each category of employee information to the work a person must do with it, then restrict access accordingly. Check every route through which that information can be viewed, changed or exported. A role named “manager” or “HR user” is too broad to be the access rule on its own.
Build a task-based access map
List the data categories the system holds, including contact and employment details, pay information, supporting documents and administrator settings. For each category, decide who may view, enter, approve, correct and export it, and who authorises that access.
| Task | Access decision |
|---|---|
| Manager approves a request | Which fields are needed for the decision, and can unrelated documents stay hidden? |
| Payroll processes an approved change | Can it receive the final value and effective date without broad HR-file access? |
| HR corrects a record | Who may change it, and how can an authorised reviewer explain the correction? |
| Employee views their information | Which items are available, and how can an error be raised? |
| Supplier provides support | When may support staff access live data, and how is that access authorised? |
These are configuration questions; they do not assume a product offers field-level permissions. If a role cannot be narrowed, determine whether another configuration or a controlled process meets the need before granting wider access.
Check indirect routes
Inspect reports, bulk exports, dashboards, notifications, attachments, integrations and downloaded files. A field hidden on one screen may still appear in a report or email. Check who can create a report as well as who can read a shared one.
A configuration check can use synthetic or suitably protected records and accounts representing an employee, direct manager, manager in another team, payroll reviewer and HR administrator. Try viewing, searching, exporting and correcting. Repeat after changing a person’s role. If the exercise is performed, record the configured role, expected access and observed result.
Keep access current
For administrator work, use attributable accounts. Identify tasks that need administrator privileges, grant only the access required, and review it when duties change or a person leaves. Check both local product accounts and central sign-in access.
Keep personal-information access limited to people whose work requires it. Where APP 11 applies, an APP entity must take reasonable steps to protect personal information it holds from misuse, interference and loss, as well as unauthorised access, modification or disclosure.
Give each role an owner and a review trigger, such as a team change, new integration or permission-setting change. The access map should explain every authorised route to employee information and expose routes with no clear work purpose.
Key Requirements Under APP 11 – Security of Personal Information
- Reasonable steps to protect data
- From misuse, interference, loss, unauthorised access
- Limit access to necessary roles
- Only those whose work requires it should have access
- Use attributable accounts for admins
- Track actions and review privileges regularly
- Assign ownership and review triggers
- Team changes, new integrations, permission updates
Further reading: Employee records exemption (oaic.gov.au).
