HR Data Security: How to Protect Employee Data in HR Systems

To protect employee data in HR systems, you need to know what sensitive data you hold, limit who can see it, require multi-factor authentication, encrypt it, check your vendors, delete what you no longer need and have a breach plan ready. Those seven controls cover most of the risk in an HRIS, a payroll platform and an applicant tracking system (ATS). A checklist follows at the end.

This article is general information, not legal advice.

Key takeaways

• Start with an inventory: you cannot protect employee data you have not mapped across your HRIS, payroll, ATS and spreadsheets.
• Apply least privilege, meaning each person gets only the access their job requires, and remove access the day someone leaves or changes roles.
• Require MFA on every HR, payroll and ATS account, and move admins to phishing-resistant methods first.
• Hold vendors to written security terms, and set retention schedules so old records are deleted on purpose rather than kept by default.
• Write the breach plan before you need it, including who decides on notifications and how fast.

What employee data in HR systems is sensitive?

Almost everything in an HR system is personal data, but some fields carry much higher risk if exposed. Treat identity numbers, bank details, health information and background check results as your highest tier.

A useful working definition: sensitive employee data is any information that could be used to steal someone's identity or money, or that could cause harm or discrimination if disclosed. Under the EU General Data Protection Regulation (GDPR), certain types such as health data, biometric data and trade union membership are "special categories" that need extra justification to process at all.

Data type	Where it usually lives	Risk tier	Main harm if exposed
Social Security or national ID numbers	HRIS, payroll	Highest	Identity theft, tax fraud
Bank account and routing numbers	Payroll	Highest	Direct deposit fraud
Medical, leave and accommodation records	HRIS, benefits platform	Highest	Discrimination, privacy harm
Background checks and immigration documents	ATS, HRIS	High	Discrimination, identity theft
Salary, bonus and performance ratings	HRIS, compensation tools	High	Internal conflict, legal claims
Candidate resumes and contact details	ATS	Moderate	Phishing, privacy complaints
Work email, title, department	HRIS, directory	Lower	Targeted phishing

The Federal Trade Commission's guide Protecting Personal Information: A Guide for Business tells businesses to "take stock" first: know what personal data you have, where it is stored and who can reach it. It also advises using Social Security numbers only for required, lawful purposes such as employee tax reporting, not as general ID numbers. If you are unclear on which system is the source of truth for each field, review how an HRIS works and who owns the data before you start mapping.

Include shadow copies such as payroll exports in shared drives and old audit spreadsheets.

How should you set access controls and least privilege?

Give each user the minimum access their role needs, grant it through roles rather than one-off permissions, and review it on a fixed schedule. This is the principle of least privilege, and the FTC names it directly as a core safeguard.

Role-based access control (RBAC) means you define roles such as "payroll processor," "HR business partner" or "people manager," attach permissions to each role, and then assign people to roles. A manager might see a report's job and time data, but not bank details or medical notes.

• Separate duties in payroll so the person who adds a new employee or changes bank details is not the same person who approves the pay run.
• Restrict IT staff from reading HR content even when they manage the platform. Our guide on protecting confidential HR files from IT admin access covers how to split those duties.
• Remove access the same day someone leaves, and adjust it the same day someone changes roles. The FTC advises promptly revoking passwords, keys and IDs in both cases.
• Run access reviews at least quarterly for high-risk roles, and require each manager to confirm or remove what their team holds.

Many organizations now frame this under zero trust architecture, which means no user or device is trusted by default, even inside the network.

Why does MFA matter for HR and payroll accounts?

Multi-factor authentication (MFA) stops most account takeovers that start with a stolen password, which is the most common way attackers reach payroll systems. It should be mandatory for every HR, payroll and ATS user, not optional.

MFA means a login requires two or more different proofs, such as a password plus a code from an app or a hardware key. The Cybersecurity and Infrastructure Security Agency explains on its MFA guidance page that users who enable MFA are significantly less likely to be hacked, because a stolen password alone is no longer enough.

Not all MFA is equal. CISA calls phishing-resistant MFA, such as FIDO security keys or passkeys, the standard to aim for, because it blocks logins on fake websites. As an interim step, CISA suggests number matching on push prompts.

Prioritize in this order: system administrators, payroll processors, anyone who can change bank details, HR staff with access to medical or immigration records, then all managers and employees using self-service. For rollout sequencing and method choices, see our guide to MFA types and rollout steps.

How should HR data be encrypted?

Encrypt sensitive HR data both in transit (moving across networks) and at rest (stored on servers, laptops and backups). Encryption turns data into unreadable text without the right key, so a stolen file or drive is far less useful to an attacker.

The FTC guide recommends encrypting sensitive data sent to third parties over public networks, data stored on your network or on laptops, and data on portable drives. GDPR Article 32 lists encryption and pseudonymisation (replacing direct identifiers with a code) among appropriate security measures.

• All HR and payroll applications use TLS (the standard for encrypted web connections) for every page and API call.
• Your vendor encrypts databases and backups at rest, and can tell you who controls the keys.
• Integration files sent between your HRIS, payroll and benefits carriers travel over secure file transfer, not email.
• HR and payroll laptops use full disk encryption.

What should you ask HR vendors about security?

Ask for evidence, not promises: independent audit reports, a clear list of subprocessors, written breach notification timelines and confirmation of how data is returned and deleted when the contract ends. Your HR data is only as safe as the weakest vendor that holds a copy.

Vendor due diligence means checking a provider's security and privacy practices before you sign and at regular intervals after. The FTC guide lists oversight of contractors and service providers as part of locking data down. Under GDPR, your vendor is usually a processor, and you remain responsible as the controller.

Questions to ask:

• Which independent security audits or certifications do you hold, and can we see the latest report?
• Where is our data stored, and which subprocessors can access it?
• Do you support single sign-on, enforced MFA and role-based permissions?
• How quickly will you notify us of a breach that affects our data, in writing?
• How do you return and delete our data at contract end, and can you confirm deletion?

If a vendor uses AI features on employee data, add questions about training data and model access. Our AI vendor due diligence questionnaire for HR tech has a ready-made set.

How long should you keep employee data, and how do you delete it?

Keep each record type only as long as a legal or clear business need requires, then delete it securely. A written retention schedule turns that rule into a process people can follow.

A retention schedule lists each record type, how long you keep it, why, and who approves deletion. Minimum periods come from tax, wage and hour, immigration and benefits rules in each country or state where you employ people, so have counsel confirm them. GDPR adds a ceiling: its storage limitation principle says personal data should be kept in identifiable form no longer than necessary. Our article on GDPR and HRMS employee data privacy explains how that applies to HR records.

ATS data is a common gap: rejected candidate files pile up for years. Set a period and automate purges.

Deletion must be real. The FTC notes that ordinary file deletion can leave data recoverable, and recommends wipe utilities for old computers and drives and shredding for paper. NIST's Guidelines for Media Sanitization (SP 800-88 Rev. 2) describe how to make data on retired media infeasible to recover.

What should you do if HR data is breached?

Contain the incident, investigate what was exposed, decide on notifications with legal counsel, and fix the root cause.

The FTC advises designating a senior person to coordinate the response, disconnecting compromised machines immediately, closing the vulnerability and consulting an attorney on state and federal notice requirements. If you handle data of people in the EU, GDPR requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach that poses a risk to individuals.

1. Confirm the incident and assign an incident lead from IT security, with HR and legal as named partners.
2. Contain it: disable affected accounts, reset credentials, and pause any pending bank detail changes.
3. Identify which records and which people were affected, using system access logs.
4. Work with counsel to decide which regulators, employees and partners must be told, and by when.
5. Notify affected employees with practical next steps.
6. Fix the cause, document what happened, and update controls and training.

The NIST Cybersecurity Framework (CSF) 2.0 organizes this work under six functions: Govern, Identify, Protect, Detect, Respond and Recover. For a full template with roles and phases, see our guide on how to write an incident response plan.

HR data security checklist

Any item you cannot answer "yes" to becomes a task with an owner and a date.

1. We have a current inventory of employee and candidate data across the HRIS, payroll, ATS, benefits tools and file shares.
2. High-risk fields (ID numbers, bank details, medical records) are restricted to named roles.
3. Access is granted through roles, and reviewed at least quarterly for high-risk roles.
4. Leavers lose access on their last day, and role changes trigger access updates.
5. MFA is enforced for every HR, payroll and ATS user, with phishing-resistant methods for admins.
6. Bank detail changes require out-of-band verification before the next pay run.
7. Data is encrypted in transit and at rest, including integration files and backups.
8. Every HR vendor has signed security and breach notification terms, and we hold their latest audit report.
9. A retention schedule exists for each record type, and purges actually run.
10. Our incident response plan names HR, legal and IT roles, and we have tested it in the last year.

Common mistakes in HR data security

• Trusting the vendor to handle everything. The vendor secures the platform, but you configure roles, MFA and exports.
• Leaving offboarding to manual tickets. If access removal depends on someone remembering, former staff and contractors keep logins for months.
• Allowing broad exports. A full employee report downloaded to a laptop escapes every control in the system.
• Keeping candidate data forever. Old ATS records add risk and privacy obligations with no business value.

Frequently asked questions

Who is responsible for HR data security, HR or IT?

Both. IT or security usually owns the technical controls, such as MFA, encryption and monitoring. HR owns decisions about who should see what, retention rules and employee communication. Name one executive owner.

Is a cloud HRIS less secure than an on-premises one?

Not by default. The risk shifts to configuration, identity and vendor oversight, so your access settings and due diligence matter more than where the servers sit.

How often should HR system access be reviewed?

Review high-risk roles such as payroll and system administrators at least quarterly, and all other roles at least twice a year.

Do small businesses need all of these controls?

Yes, scaled to size. A small business still holds Social Security numbers and bank details, so MFA, least privilege, encrypted devices, secure disposal and a short written breach plan are all achievable with modest effort.

What to do next

Pick one week to run the checklist above with your HR, payroll and IT leads in the same room. Mark every gap, assign an owner, and set dates. Then start with the two changes that cut the most risk fastest: enforce MFA on all payroll and admin accounts, and audit who can see Social Security numbers and bank details today.

Sources

• Federal Trade Commission: Protecting Personal Information, A Guide for Business
• Cybersecurity and Infrastructure Security Agency: More Than a Password (MFA)
• NIST: Cybersecurity Framework
• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization
• EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)

Last reviewed: November 2026.