Payroll Pitfalls, Switching Risks and Official Sources
Employee data privacy in payroll and HR software: the employee records exemption and its limits
How the Privacy Act's employee records exemption works for payroll and HR software in Australia, where it stops, TFN rules, data breaches, offshore storage and security checks to demand from vendors.
Payroll and HR systems hold some of the most sensitive data a business keeps: tax file numbers, bank accounts, salaries, health information, leave for family and domestic violence, performance notes and identity documents. Many private sector employers assume the employee records exemption in the Privacy Act 1988 (s 7B(3)) means privacy law does not apply. It is narrower than that: it covers acts and practices directly related to a current or former employment relationship and an employee record held by the employer. It does not cover job applicants, contractors or volunteers, it does not cover what your software vendor does with the data, and the tax file number rules apply regardless. Separately, businesses with annual turnover of $3 million or less are generally exempt from the Privacy Act unless an exception applies. Whatever your legal position, a breach of payroll data can cause fraud and harm, so choose software with strong security and keep a breach response plan.
This guide is part of payroll software pitfalls and official sources. It is general information, not legal advice.
Who the Privacy Act covers
| Situation | Generally covered by the Australian Privacy Principles? |
|---|---|
| Business with annual turnover over $3 million | Yes |
| Business with turnover of $3 million or less | Generally no, unless an exception applies (for example health service providers, businesses trading in personal information, some contractors to the Commonwealth) |
| Payroll or HR software vendor with turnover over $3 million | Yes, for personal information it handles |
What the employee records exemption covers, and what it does not
| Data or activity | Exemption likely applies? | Notes |
|---|---|---|
| Current employee's salary, leave, performance records, held by the employer and used for employment purposes | Generally yes | Must be directly related to the employment relationship |
| Former employee's records used for an employment-related purpose | Generally yes | Same test |
| Job applicants' CVs and interview notes | No | Applicants are not employees |
| Contractors' and volunteers' details | No | Not an employment relationship |
| Employee data used for an unrelated purpose (e.g. marketing) | No | Not directly related to employment |
| Data held by your software vendor or payroll bureau | No | The vendor is not the employer |
| Tax file numbers | The TFN rules under the Privacy Act apply regardless | Collection, use and storage limits |
| Health information | Exemption may apply to the employer's employee record, but state health records laws (e.g. Victoria, NSW, ACT) may also apply | Check your state |
The Australian Government has agreed in principle to review the employee records exemption, but as at October 2026 it remains in place. The draft "tranche 2" privacy reforms published for consultation in 2026 do not appear to deal with it. Check the OAIC and the Attorney-General's Department for any change.
Tax file numbers
The Privacy (Tax File Number) Rule 2015 applies to TFN recipients, including employers, regardless of the small business and employee records exemptions. It limits collection and use of TFNs to tax and super purposes and requires reasonable security. In software terms: restrict who can see TFNs, mask them on screens and reports, and do not export them into spreadsheets or HR systems that do not need them.
Data breaches
If the Privacy Act applies to you, an eligible data breach (one likely to result in serious harm) must be notified to affected individuals and the OAIC. You must assess a suspected breach promptly, within 30 days. Payroll data breaches are high-risk because TFNs, bank details and identity documents can be used for fraud. Even if you are exempt, your vendor may not be, and employees will expect to be told.
Since 30 May 2025, businesses with annual turnover over $3 million (and certain critical infrastructure entities) must also report ransomware or cyber extortion payments to the Australian Signals Directorate within 72 hours under the Cyber Security Act 2024.
Offshore storage and vendors
Many HR platforms store data overseas or use overseas sub-processors. If you are covered by the Privacy Act, APP 8 generally requires reasonable steps to ensure an overseas recipient handles personal information consistently with the APPs, and you can remain accountable for its acts. Ask:
- In which countries is data stored and accessed (including support staff)?
- Which sub-processors are used?
- Is data encrypted at rest and in transit?
- What independent security certifications or audit reports are available?
- How quickly will the vendor notify you of a breach, and what help will it give?
Security features to demand
| Feature | Why it matters |
|---|---|
| Multi-factor authentication for administrators and employees | Stops most account takeovers |
| Role-based access (e.g. managers see their team only, TFNs hidden from most users) | Limits exposure |
| Alerts when bank details change, and approval for admin changes | Stops pay redirection fraud |
| Audit logs of who viewed or changed records | Investigation and accountability |
| Data export and deletion on exit | You control retention |
| Single sign-on for larger employers | Central access control |
Retention: keep what you must, delete what you don't
Fair Work rules require employee records to be kept for 7 years, and tax records generally for 5 years. Beyond those periods, keeping old identity documents, bank details or health information only increases breach exposure. Set retention rules in your HR system, and do not collect copies of identity documents unless you need them (for example for a right-to-work check), then delete them when no longer needed.
Paid family and domestic violence leave
Since February 2023, payslips must not state that a payment was for paid family and domestic violence leave, that this leave was taken, or the remaining balance (Fair Work Regulations reg 3.47); the payment is generally shown as ordinary hours or another payment for work (reg 3.48). Payroll software needs a leave code that records and pays this leave without it appearing on payslips, and access to the records should be tightly limited. Check how your product handles it.
Related: data location and breach terms belong in the contract, see contracts, exit terms and data export; migrations are a common moment for data to leak or be lost, see switching payroll software mid-year.
Frequently asked questions
Does the employee records exemption mean I can do anything with staff data?
No. It is limited to acts directly related to the employment relationship and employee records. Other laws still apply, including the TFN rule, state health records laws, surveillance laws and the Fair Work Act.
Are workplace surveillance and biometric time clocks covered?
Workplace surveillance laws in some states (for example NSW and the ACT) require notice for certain surveillance. Biometric templates are sensitive information under the Privacy Act if it applies to you. Get advice before using fingerprint or facial-recognition clocks.
Do I need consent to send payroll data to a software vendor?
Usually not for normal payroll processing, but you need to handle it in line with any privacy obligations that apply, and choose a vendor with adequate security.
What should I do first after a payroll data breach?
Contain it (reset access, stop pay changes), assess the harm, follow your response plan, get advice on notification and tell employees how to protect themselves. Report cybercrime to the Australian Cyber Security Centre.
Sources
- Office of the Australian Information Commissioner — employee records exemption, small business, TFN rule and notifiable data breaches
- Federal Register of Legislation — Privacy Act 1988 (s 7B(3), s 6D) and Privacy (Tax File Number) Rule 2015
- Australian Cyber Security Centre — ransomware payment reporting and incident reporting
- Attorney-General's Department — Privacy Act reform
