In this guide · 7 sections
Short answer
Limit payroll access to one or two named people, turn on MFA for payroll, email and bank logins, and send payslips via self-service, not emailed files with NRIC passwords. A leak of names with salaries or bank accounts must be reported to PDPC within three calendar days of assessing it.
Why payroll data needs extra protection
Most personal data a small business holds is low risk on its own: names, work emails, phone numbers. Payroll combines several high-risk items for every employee. PDPC's Advisory Guidelines on Key Concepts (revised 29 April 2026) list the classes of data whose loss is deemed to cause significant harm. Payroll hits several of them.
| Payroll data | Why it matters |
|---|---|
| Full name with salary, bonus or allowance | Listed as prescribed financial information: deemed significant harm |
| Full name with bank account number | Listed: loss by any organisation, not just a bank, counts |
| NRIC or FIN number | Permanent identifier; combined with financial data it is prescribed |
| CPF, tax and medical claim details | Sensitive in their own right; often in the same exports |
Employers are allowed to collect NRIC numbers for employment. PDPC's NRIC advisory guidelines note that section 95 of the Employment Act requires employers to keep employment records that include the NRIC number. The duty is to protect it well, not to avoid holding it. Our guide to employee personal data under the PDPA covers the wider HR rules.
Who should have access to payroll
In many small companies, payroll access spreads over time: the owner, an admin, the external bookkeeper, a former finance staff member whose login was never removed. Each extra login is another way in.
- Run payroll: one named person, plus one backup who can step in during leave.
- Approve payroll: a director, who sees totals and approves, ideally without needing to edit employee records.
- External accountant or bookkeeper: their own named login with the narrowest role the payroll app offers, never a shared password.
- Employees: see only their own payslips and leave through self-service.
- Nobody else: sales, operations and IT helpers do not need payroll access to do their jobs.
Review the user list every quarter and the same day anyone leaves. PDPC's own example of a payroll provider describes an unauthorised disclosure of salary and bank records to one of its own employees as a possible breach of the Protection Obligation, so internal over-sharing matters too.
Security settings for payroll, email and banking
Payroll data does not only live in the payroll app. It flows into email, spreadsheets, the accounting system and the bank's bulk payment upload. Protect each step.
Payroll security checklist
Our step-by-step guide to setting up MFA for business accounts covers Microsoft 365 and Google Workspace.
Sending payslips safely
Emailing payslips as attachments is still common, often protected with the employee's NRIC number or date of birth as the password. On 26 June 2025, MDDI announced a PDPC and CSA advisory telling private organisations to stop using NRIC numbers to authenticate people, specifically including NRIC numbers as default passwords on password-protected files sent by email. Anyone who knows the NRIC can open the file.
Safer ways to deliver payslips
- Employee self-service portal in your payroll app, with MFA
- Shared folder per employee with access limited to that person
- Password-protected file with a password the employee chose and received separately
Practices to stop
- NRIC or date of birth as the PDF password
- One spreadsheet of all salaries emailed to the director
- Payslips sent to personal email addresses typed by hand
- Printed payslips left in a shared tray
If you send anything by email, double-check the recipient. An autocomplete error that sends one person's payslip to another employee is still a disclosure, even within the company.
If payroll data leaks: the PDPA breach steps
Under PDPC's guidelines, once you have credible grounds to believe a data breach occurred, you must assess quickly whether it is notifiable, generally within 30 calendar days, and document the steps you took.
Contain the breach
Reset passwords, remove access, recall or ask recipients to delete misdirected emails, and preserve logs.
Work out what data and whose
List the employees affected and which data items were exposed: names, NRIC, salary, bank accounts.
Decide if it is notifiable
It is notifiable if it involves prescribed data such as names with salaries or bank account numbers, or affects 500 or more people.
Notify PDPC within 3 calendar days
Once you determine the breach is notifiable, notify PDPC no later than three calendar days, then the affected staff at the same time or after.
Fix the cause and record it
Remove the weakness that allowed the breach and keep a record of the assessment and actions.
Encryption can change the outcome. PDPC's example of a lost encrypted drive holding employees' financial details says the company did not need to tell the employees, because the data was unintelligible, but still had to notify PDPC. Our guide to PDPA data breach notification walks through the assessment in more detail.
Do it yourself or get help?
Most of this is housekeeping you can do in a day: tidy the user list, turn on MFA, move payslips to self-service and delete old spreadsheets.
If you are still running payroll on spreadsheets, our Payroll Software Setup (S$390) helps you choose a Singapore payroll app and sets up the company, up to 20 employees, CPF and SDL settings, leave and staff self-service. Our Microsoft 365 / Google Security Lockdown (S$590) enforces MFA, cleans up admin roles and adds a leaver checklist. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing and follow progress on your order page. This guide is general information, not legal advice.
Frequently asked questions
Yes. Salary linked to an identifiable employee is personal data. PDPC's breach notification rules go further: a breach of an employee's full name or national ID number together with the amount of wages, salary, bonus or other remuneration is deemed likely to cause significant harm, so it must be notified to PDPC and the affected employees.
Yes. PDPC's NRIC advisory guidelines give the example of a new employee and note that section 95 of the Employment Act requires employers to keep employment records including the NRIC number. You should not ask for NRIC numbers at the job application stage, and you must protect the numbers you hold.
It is not advisable. In June 2025, PDPC and CSA issued an advisory, announced by MDDI, telling private organisations to stop using NRIC numbers to authenticate people, including as default passwords for password-protected files sent by email. Use a payroll self-service portal or a password the employee sets.
First assess quickly whether the breach is notifiable, generally within 30 calendar days of credible grounds to believe it happened. Once you determine it is notifiable, notify PDPC as soon as practicable and no later than three calendar days, and notify affected employees at the same time or after.
PDPC's guidelines say a breach contained within the organisation, such as HR mistakenly sending personal data to another department, is not a notifiable data breach. You should still contain it, ask the recipient to delete it and fix the cause. A disclosure to anyone outside the company is assessed normally.