Keeping salary data confidential in the firm
How an accounting firm keeps clients' salary information confidential among its own staff: payroll roles, restricted clients, AI limits and safe exports.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Inside an accounting firm, almost everyone handles confidential information: trial balances, tax affairs, the occasional dispute. Salaries are different. A first-year trainee who would never gossip about a client's profit margin may find it hard not to mention what the client's managing director earns, especially if the managing director is a neighbour or a relative of a colleague.
Clients who hand over payroll know this. They are trusting the firm not only to pay their staff correctly, but to keep pay out of sight of everyone in the firm who does not need it. That is partly a matter of culture and partly a matter of how the firm sets up its systems.
Who needs to see pay
Start by deciding, in writing, who in the firm needs salary information and why. In most firms the list is short:
- the payroll staff who prepare and approve runs for that client;
- the partner responsible for the client relationship;
- the client's account manager, where that person deals with payroll queries;
- on an audit or review, the engagement team, to the extent the work requires it.
Everyone else, including colleagues who work on the same client's tax or bookkeeping, does not need to see individual pay. The firm's duty here is not only ethical. Salary and bank details are personal information, and in South Africa the Protection of Personal Information Act sets the conditions for processing personal information lawfully. Nigeria and Kenya have their own data protection laws, and a firm working across the three should apply the stricter habit everywhere.
Limiting payroll to the payroll team
On South African payroll, only users with the Partner, Admin, Payroll, PayrollAdmin or FinanceManager roles can change payroll. A firm can also allow or deny what each role may do, and check why a particular member may or may not act.
Use both. Give payroll roles only to the people on the list above, and review the role permissions so that general accounting and audit roles do not carry payroll rights they never use. When a staff member moves from the payroll team to audit, change their role on the day they move, not at the next review.
The check that explains why a member may or may not act is useful here in reverse: pick a trainee's name and confirm what that person can actually do. It is better to find an unexpected permission yourself than to have a client find it.
Restricting a sensitive client
Some payroll clients need more than role-based limits: a client whose owner is known to the firm's staff, a client whose executives' pay is commercially sensitive, or the firm's own partners.
Partners and administrators can restrict a client, or one engagement, to named people with a reason. A restriction is lifted rather than deleted, and who did what and when is recorded. The client's account manager and the engagement's partner and manager can always open it, so a restriction never locks out the people responsible.
Restriction works on the client record and its engagements; the payroll screens are governed by the payroll roles. Use the two together for a sensitive client: restrict the client to named people, and make sure those same people are the only ones with payroll roles on its payroll. Meetings follow the same logic: a meeting about a restricted client shows only as busy to people not on that client's access list, so even the calendar does not reveal who is discussing whose pay. The detail of how restriction works is in restricting access to a client.
AI does not get payroll data by default
Firms are rightly cautious about sending client data to AI services. Achekam's defaults help with payroll in particular.
Staff can upload receipts, invoices and statements to Document Intelligence for AI to read, but restricted data classes such as payroll and bank data are refused unless they are allowed for a specific purpose. By default, Achekam's AI engine also removes South African ID numbers before text is sent to an AI vendor, though an administrator can switch that removal off in AI settings. Leave it on unless there is a clear reason not to.
The general chat assistants, Payroll AI among them, are the same chat screen with a different topic instruction. They answer from the AI model's general knowledge and do not read the firm's records. That makes them safe for a question such as how a type of allowance is usually treated, but staff should be told plainly not to paste an employee's pay details into the chat to get a quicker answer.
Exports and e-mail
Most salary leaks do not happen inside a system. They happen when data leaves it: a payment schedule saved to a shared drive, a payroll report forwarded to the wrong person, a spreadsheet attached to an e-mail with an autocomplete address.
A short set of house rules covers most of the risk:
| Situation | House rule |
|---|---|
| Downloading a payment schedule or bank file | Save only to the client's restricted folder, delete local copies after use |
| Sending payroll reports | Only to the client contact named in writing, never a general mailbox |
| Sending payslips | One employee per message, to that employee's own address |
| Discussing pay internally | In the client's restricted channel or meeting, not in open office chat |
| A staff member leaves the payroll team | Payroll role removed the same day |
Write these down, include them in induction for every new staff member, and repeat them at the start of each busy season. Roles and permissions in general are covered in roles and permissions.
This week, list everyone in the firm who currently holds a payroll role, compare that list with the people who actually need one, and remove the difference.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
