An HR system holds more sensitive personal data than almost anything else a company runs: salary, bank accounts, PAN, Aadhaar, addresses, family details, medical claims, disciplinary records. A breach here is materially worse than a leak of business documents.
Questions to put to any vendor
Where is the data, and who can reach it?
- Which country and region is data stored in? Data residency may matter for your obligations and your customers' contracts.
- Is it a shared or dedicated database, and how is tenant separation enforced?
- Which vendor staff can access production data, under what approval, and is that access logged?
- Do subcontractors or subprocessors have access, and who are they?
Encryption
- Encrypted in transit — TLS 1.2 or above, with no fallback
- Encrypted at rest, and how are keys managed
- Are especially sensitive fields such as bank details encrypted at field level
Access control
- Role-based permissions granular enough that an HR executive need not see executive compensation
- Multi-factor authentication available, and enforceable for admin roles
- Single sign-on support, so you control account lifecycle centrally
- Session timeout and device policy options
Audit and monitoring
- A complete, immutable audit log of who viewed and changed what
- Can you export the audit log, and for what retention period
- Alerting on anomalous access — bulk exports, out-of-hours admin activity
Resilience
- Backup frequency, retention, and whether restores are actually tested
- Stated recovery objectives, and evidence they have been met
- Uptime history, not just an SLA number
Assurance and exit
- Independent certification such as ISO 27001 or SOC 2 — ask for the report, not the logo
- Penetration testing frequency, and whether a summary is shareable
- Breach notification commitment, with a timeframe, in the contract
- On termination: can you export everything, and will they delete it on confirmation
⚠️ A certification logo is not evidence
Ask for the certificate with its scope statement, and check the scope covers the product you are buying and the data centre it runs in. Certifications scoped to a corporate head office tell you nothing about the application.
India DPDP considerations
Under India's Digital Personal Data Protection Act framework, employers processing employee personal data carry obligations as data fiduciaries. Practically, this means:
- Purpose limitation — collect what you need for a stated purpose, not everything you might one day want
- Notice — tell employees what you collect and why
- Retention limits — do not keep personal data indefinitely after employment ends, beyond statutory retention requirements
- Security safeguards — reasonable technical and organisational measures
- Breach notification — to the regulator and affected individuals
- Processor obligations — your vendor is processing on your behalf, so the contract must bind them appropriately
Biometric attendance data and health information from insurance claims warrant particular care, as does Aadhaar, which has its own usage restrictions.
Internal controls you own
Vendor security does not help if your own practices are weak:
- Review access quarterly. People change roles and leave; permissions rarely follow. This is the most commonly neglected control.
- Enforce MFA on every account with access to salary data, without exception for senior staff.
- Stop emailing payroll files. Salary registers as email attachments are the most common real-world leak. Use the system's reporting instead.
- Verify bank detail changes through an independent channel. This is fraud prevention as much as security.
- Revoke access on the last working day, not when someone remembers.
- Limit export rights. Few people need the ability to download the full employee database.
- Review the audit log periodically — a log nobody reads provides evidence after the fact but prevents nothing.
💡 The likeliest breach
Not a sophisticated attack on your vendor. A salary spreadsheet emailed to the wrong recipient, or a former employee whose access was never revoked. Internal controls address both, and cost nothing.
✅ Minimum contractual terms
Data residency stated, breach notification within a defined period, audit log access and export, data return and deletion on termination, subprocessor disclosure with notice of changes, and the right to request the latest assurance report annually.
📝 Final note
Run an access review this quarter if you have not. Most organisations find at least one account belonging to someone who left, which is both a security finding and a useful argument for doing it regularly.
