Compliance and data security

Compliance built around clear responsibilities

Payroll involves tax reporting, employment records, pension information and personal data. Our service is structured so that the employer's responsibilities and our administrative responsibilities are documented rather than blurred.

A person signing a printed agreement with a pen

No payroll provider can remove an employer's legal duties. We support the process by applying authorised information, maintaining records and escalating issues that require a client decision.

PAYE and RTI

PAYE and Real Time Information

Where included in scope, we calculate payroll deductions and prepare or make authorised RTI submissions using the client's PAYE scheme information.

The client remains responsible for:

  • the legal basis for engaging and paying each person;
  • accurate payroll source data;
  • employment-status and tax-treatment decisions;
  • approval of payroll and submissions;
  • responding to matters requiring employer judgement; and
  • paying HMRC in full and on time.

Workplace pensions

We can process pension deductions, contributions and files as part of payroll. The employer retains responsibility for automatic-enrolment compliance, worker assessment, communications, scheme decisions, declarations and payment to the pension provider unless a separate service expressly allocates a task elsewhere.

Employment and worker status

We do not determine whether a person is an employee, worker, self-employed contractor or within off-payroll working rules. We process the engagement and tax treatment confirmed by the client or its adviser.

Where the position is unclear, we may pause processing until the client provides a documented decision or obtains appropriate advice.

National Minimum Wage and pay decisions

The client sets contractual pay, hours, deductions and working arrangements and remains responsible for National Minimum Wage and employment-law compliance. Our payroll checks may identify an apparent issue, but they do not replace a full legal assessment.

Data protection roles

Data protection roles

For payroll services, the client will normally act as controller of employee and worker data and Clipper Contractor Group Ltd will normally act as processor. The contract and data-processing terms set out the instructions, confidentiality duties, security responsibilities, use of suppliers, assistance obligations and arrangements at the end of the service.

For our own business administration, legal obligations and website enquiries, we act as controller of the relevant personal data.

A member of staff walking through a secure server room
Security

How we handle payroll data

We apply appropriate technical and organisational measures to protect personal data, taking account of the nature of the information, the processing involved and the risks to individuals. Our operating controls include:

Data minimisation

limiting data collection to what is reasonably required;

Role-based access

granting access according to role and business need;

Agreed channels

using agreed channels for payroll information;

Authorised contacts

confirming authorised client contacts;

Records of approvals

maintaining records of material instructions and approvals;

Supplier review

reviewing suppliers that process data for the service;

Retention and deletion

managing retention and deletion according to contractual and legal requirements; and

Incident escalation

responding to suspected security incidents through a defined escalation process.

Specific security information is shared during due diligence where appropriate and where disclosure would not weaken the protection of our systems or other clients.

Client security responsibilities

Clients must:

  • use the agreed data-transfer method;
  • restrict payroll access to authorised personnel;
  • keep contact and authority records current;
  • verify bank-detail and payment changes independently;
  • avoid sending special-category or financial data through the general enquiry form;
  • notify us promptly when a user should lose access; and
  • report suspected data loss, misdirection or unauthorised access without delay.

Due diligence and service acceptance

We conduct proportionate checks on prospective clients and instructions before starting work. We may request evidence of legal identity, authority, PAYE arrangements and the purpose of the payroll service.

We reserve the right to refuse, suspend or terminate work where adequate information is not provided, authority cannot be established, instructions appear unlawful or the arrangement falls outside our service model.

No advice claim

Our payroll administration and factual guidance do not constitute legal, tax, accounting, investment, pension or employment advice. Clients should obtain advice from an appropriately qualified professional where a decision requires interpretation of law or individual circumstances.

Questions

Ask a compliance or security question

Use the contact form for a question about responsibilities, data handling or our controlled payroll process.