A temporary bookkeeper should receive the payroll information and system permissions needed for the agreed assignment, with a clear owner, secure access and a planned end date. Giving them an entire HR drive because it is easier can expose records unrelated to payroll. Begin with the work to be completed and identify the data that supports it.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
The PDPC’s protection obligation requires reasonable security arrangements for personal data. The practical controls should reflect the sensitivity of payroll information and the way the bookkeeper will actually work.
Define the assignment in concrete terms
Is the bookkeeper preparing a payroll calculation, reconciling an existing payment run, correcting an accounting entry or assembling documents for review? Each task can require different records. Write down the deliverable, the relevant period and who will approve the output before providing access.
For example, reconciling salary payments may require an approved payroll summary and bank-payment evidence. It does not automatically require access to interview notes, medical information or every employee’s identity documents. Assess the actual task rather than handing over a standard bundle without review.
Separate the payroll working file from other HR material
Create an authorised working area containing the records needed for the assignment. Keep source material traceable so a number can be reconciled without exposing unrelated documents. If the bookkeeper needs clarification, arrange a contact who can provide an appropriate answer rather than unrestricted access to all staff files.
- Use named access where the system supports it.
- Limit permissions to the necessary records and functions.
- Check whether downloading or onward sharing is permitted.
- Keep payment approval separate from preparation and reconciliation.
- Record who authorised access and when it should end.
Do not use another employee’s account as a shortcut. It can obscure responsibility and make later access withdrawal difficult.
Agree instructions before the files move
Identify the permitted purpose, the secure delivery method, the approved systems and whether any other person may assist. Check the provider’s arrangements for subcontracting and overseas processing where relevant. Tell the bookkeeper where to report an unexpected disclosure, a wrong attachment or access to material outside the assignment.
Review these matters with the engagement and data-handling terms. A statement that the provider is “confidential” is not a substitute for knowing where payroll files will be stored and who can use them.
Example: two payroll months, not a complete personnel archive
A company engages a temporary bookkeeper to reconcile two months of payroll against its accounts. The finance lead supplies the relevant approved summaries, payment evidence and a controlled list of adjustments. The bookkeeper identifies a difference and asks the finance lead for the supporting explanation. This is more controlled than copying a complete HR folder containing records unrelated to the reconciliation.
Check the work before approving payments or entries
Keep a record of the assumptions, changes and unresolved differences. The responsible company officer should review the output against the source information and the agreed scope. Do not treat a temporary provider’s spreadsheet as an approval to change salaries, payment details or employment terms.
If employee bank details have changed, follow the company’s verification process. An instruction embedded in a working spreadsheet should not bypass the established approval route.
Close access when the assignment ends
Retrieve the agreed work product and supporting explanations, confirm where any permitted retained copies sit and withdraw unnecessary access. Preserve the records the company needs for its own business and legal purposes. Check the actual access change rather than relying solely on an email saying the assignment has ended.
If the same bookkeeper returns later, review the new assignment and permissions again. A previous engagement is not an indefinite authorisation to access future staff records.
Can we simply send payroll over an ordinary messaging app?
Review the security, authorised recipients, storage and onward-sharing risks of the chosen channel. Use the company’s approved process for sensitive files.
Does the provider take over the employer’s responsibilities?
The assignment should define the provider’s work, but the company still needs to manage approvals, record accuracy and its own applicable obligations.
Related guidance
- Mapping the personal data your company holds
- Organising a data protection management programme
- Background on company data protection obligations
Help with company compliance and privacy matters
If you would like assistance organising your company’s compliance procedures or obtaining advice on a privacy issue, email [email protected] or WhatsApp +65 8501 7133. Our team can assist with corporate secretarial, accounting and tax matters. Where legal advice is needed, advisers from our associated law firms can assist. This is general information; legal advice should address the facts of the particular request or dispute.