Payroll staff training

Employees working in payroll should receive training on what is required of them in handling personal data on computer and in paper form. The starting point is an internal disclosure policy, which may be a business-wide policy if the BS7799 Code of Practice has been fully implemented.

The training should include the following:

• provide familiarity with the Data Protection Principles and their relevance to payroll processing - a copy of the data controller's register entry is important
• ensure that staff know to whom they may disclose payroll information, how to respond to requests for disclosure, how to respond to pressure, and to whom they should refer requests that fall outside of the policy
• provide awareness that some people may use deception to try to obtain information, and show how to check the legitimacy of a request and the identity of the person making it
• stress that serious breaches of data protection rules by members of staff is a disciplinary offence, and that they could be criminally liable if they knowingly or recklessly disclose personal data outside of the employer's policies and procedures.