What employee data enterprise HR must keep accurate and controlled

The employee data that carries the most risk

Enterprise HR must keep accurate the data that drives pay, statutory submissions, legal employment status and reporting lines, and must tightly control the data that can harm an employee if it leaks: identity numbers, bank details, salary, health and disciplinary information. Some fields fall into both groups, and those deserve the strictest handling.

Sorting fields by these two tests beats treating all employee data alike. A misspelt hobby field hurts nobody. A wrong bank account number delays someone's salary, and a leaked medical certificate can damage a person's standing with colleagues.

Testing each field for accuracy risk and exposure risk

Run every field through two questions. If this value is wrong, what breaks? If this value reaches the wrong person, who is harmed? The answers place each field on a simple grid.

High accuracy risk with low exposure covers job title, department, cost centre, manager and start date. Errors here distort org charts, approval routes and headcount reports, but the values are not secret inside the company.

Low accuracy risk with high exposure covers emergency contacts, home address, religion where recorded, and personal notes. These need access limits more than verification workflows.

High on both counts are identity numbers, statutory references, bank details, salary and allowances, and disciplinary outcomes. These need verified entry, approval on change and narrow access.

Do the exercise with payroll and IT in the room. HR tends to underrate the accuracy risk of cost centre codes, which finance relies on, while IT can point out which fields feed system access and the email directory.

Controls to apply to each class of employee data

Once the grid exists, match controls to it. The list below covers the controls most enterprises end up needing somewhere on the grid.

• Verify on entry against a source document, such as an IC copy, offer letter or bank statement header, and record who checked it
• Require approval for changes to pay, legal entity, grade and reporting line, always with an effective date
• Mask identity and bank numbers on screens and in exports for users who do not need the full value
• Restrict health and disciplinary records to named HR roles rather than the whole HR department
• Log every view and export of sensitive fields, not only edits
• Prompt employees to confirm their own contact and emergency details on a regular cycle
• Archive or remove fields that no process uses

Where accuracy usually breaks down in large organisations

Accuracy problems cluster at handoffs: details typed from a paper form during onboarding, facts passed from recruitment in a chat message, and transfers between subsidiaries where the receiving HR team re-keys the record from scratch. Each re-entry is a chance for a transposed digit.

Stale data is the other source. Employees move house, switch banks, renew passports and add dependants without telling HR. A self-service confirmation prompted by the system catches most of this without HR chasing individuals one by one.

Watch, too, for fields that two departments both believe they own. If payroll and HR can each edit bank details in separate systems, one of them will eventually hold the wrong account.

A practical test is to sample a handful of records each quarter and check them against source documents. Note the fields that fail most often and trace each failure back to the handoff where it entered. The fix usually belongs at that handoff, not in the record.

Retention and disclosure questions to put to your adviser

The Personal Data Protection Act applies to how employers process employee personal data, including purpose, disclosure, security and retention. Employment and payroll records may also carry keeping requirements under employment law and the rules of EPF, SOCSO and the tax authority.

Rather than guess, take your list of data classes to your adviser and ask three questions about each one: why do we keep it, how long should we keep it, and who may see it. Write the answers into your data policy and configure the system to match them.

Making the controls stick inside an HR system

Controls written only in a policy document fade within a year. They hold when the system enforces them: approval steps that cannot be skipped, masked fields that stay masked, and a change history nobody can edit. Before choosing or building a system, map your grid of fields against the roles that need each one.

BukuHR, Fasttrade's product for HR teams, is built around people records, requests and approvals, onboarding and exit, and team visibility. Fasttrade can walk through how your data classes and access rules would map onto it and confirm what is available today.

Frequently asked questions