The Book-keepers Forum (BKF)

Post Info TOPIC: Payroll and GDPR


Veteran Member

Status: Offline
Posts: 54
Date:
Payroll and GDPR


Morning all, apologies first if this has been covered, but I have scoured the posts and didnt see anything.  I run a bookkeeping company, with payroll as an add-on for those running a small payroll.  I don't offer payroll as a stand-alone service.  So, GDPR is baffling me, as it probably is with a lot of people.  I understand I need to send the data securely, so that means potentially using a portal for payslips and reports, or sending payslips and reports by post, or password protecting the payslips and sending by email.  What I can't do is password protect the reports when emailing them to clients.  To subscribe to a portal is going to be around £40 per month (so I've found so far), which wipes out a lot of my payroll income as I am relatively small, so thought perhaps WinZip for zipping up the reports, which is much cheaper, but dont know if this is secure enough?

I wondered what other small bookkeepers/payrollers are doing?  I am currently posting all docs and payslips to my clients until I have worked out a cheap enough method of digitally sending the docs.  Thanks in advance!

Gill



__________________

 

 



Senior Member

Status: Offline
Posts: 421
Date:

I would have thought that a passworded winzip of a report pack including payslips would be perfectly adequate.

12Pay  Bureau Edition for example (I am no longer associated with that product) includes a function to create password protected zipped report packs so one zip file can be automatically made up as a single request that contains all of your client's reports, including payslips, for a period. It can also bundle a set of reports into a single password-protected PDF. I expect that rival products ought to have some similar functionality for their bureau clients.

Clearly sending paper by post is in reality far *less* safe even than emailing unprotected reports. Bizarre that GDPR might push people into less safe behaviour! The Law of Unintended Consequences....



__________________

Life's a reach, then you gybe

 



Master Book-keeper

Status: Offline
Posts: 8646
Date:

Hi Gill
You dont need a portal - just another pile of scaremongering. You dont say what payroll software you use so cant advise specifics.

You can password protect the payslips and email as a bulk for the employer to sort, or you can password protect individuals payslips and email them individually (via the good payroll software at least!). I dont favour the latter as you potnetially get mithered to death when employees forget their password.

You can also easily password protect a report via pdf and email it.

Not used WinZip for a while. This can be p/w protected. What you need to check - do they hold that data when its zipped? I dont think they do, but check their privacy pol and if its outwith the EU that they confirm they opt in/subscribe (whatever the word is) to the EU laws and the US Privacy Shield. (If not those two, then dont use!)

You can also password protect and share via a file sharing app.

It has been covered, in part, in the two lengthy GDPR posts from about 3-4 weeks ago and the rest will have been buried in other posts not specifically titled GDPR (one godo reason to come on the site daily).

__________________

 Joanne 

Winner of Bookkeeper of the Year 2015, 2016 & 2017 

Thoughts are my own/not to be regarded as official advice,which should be sought from a suitably qualified Accountant.

You should check out answers with reference to the legal position



Master Book-keeper

Status: Offline
Posts: 8646
Date:

Tom McClelland wrote:

 Bizarre that GDPR might push people into less safe behaviour! The Law of Unintended Consequences....


 Totally agree



__________________

 Joanne 

Winner of Bookkeeper of the Year 2015, 2016 & 2017 

Thoughts are my own/not to be regarded as official advice,which should be sought from a suitably qualified Accountant.

You should check out answers with reference to the legal position



Veteran Member

Status: Offline
Posts: 54
Date:

Thanks Tom - yes, I agree that post is, in reality, probably much less safe than unsecured emails, but there you go.  I use Moneysoft payroll manager, and their suggestion was to use a portal.  I just wasnt sure if Winzip was secure enough for the reports, but hopefully that might be a solution.

 

thanks

Gill



__________________

 

 



Senior Member

Status: Offline
Posts: 421
Date:

Cheshire wrote:

Hi Gill
You dont need a portal - just another pile of scaremongering. You dont say what payroll software you use so cant advise specifics.

You can password protect the payslips and email as a bulk for the employer to sort, or you can password protect individuals payslips and email them individually (via the good payroll software at least!). I dont favour the latter as you potnetially get mithered to death when employees forget their password.

You can also easily password protect a report via pdf and email it.

Not used WinZip for a while. This can be p/w protected. What you need to check - do they hold that data when its zipped? I dont think they do, but check their privacy pol and if its outwith the EU that they confirm they opt in/subscribe (whatever the word is) to the EU laws and the US Privacy Shield. (If not those two, then dont use!)

You can also password protect and share via a file sharing app.

It has been covered, in part, in the two lengthy GDPR posts from about 3-4 weeks ago and the rest will have been buried in other posts not specifically titled GDPR (one godo reason to come on the site daily).


 Winzip is desktop software that runs entirely on your own PC. They never see your data.



__________________

Life's a reach, then you gybe

 



Master Book-keeper

Status: Offline
Posts: 8646
Date:

Ah, thanks for clarifying Tom.

__________________

 Joanne 

Winner of Bookkeeper of the Year 2015, 2016 & 2017 

Thoughts are my own/not to be regarded as official advice,which should be sought from a suitably qualified Accountant.

You should check out answers with reference to the legal position



Veteran Member

Status: Offline
Posts: 54
Date:

So presumably Winzip isnt suitable for sending docs externally to clients then?

Thanks

Gill



__________________

 

 



Master Book-keeper

Status: Offline
Posts: 8646
Date:

GillyP wrote:

So presumably Winzip isnt suitable for sending docs externally to clients then?

Thanks

Gill


 Yes its stuitable as the data is NOT held by Winzip. Its held by you and then by whoever you send it to and its p/w protected.



__________________

 Joanne 

Winner of Bookkeeper of the Year 2015, 2016 & 2017 

Thoughts are my own/not to be regarded as official advice,which should be sought from a suitably qualified Accountant.

You should check out answers with reference to the legal position



Veteran Member

Status: Offline
Posts: 54
Date:

Ah I see - thank you for that.  Will look into that then!

 

Gill



__________________

 

 



Senior Member

Status: Offline
Posts: 206
Date:

Hi Gill

I am in a similar situation and I am using
a portal called The Client Space, Which is
very reasonably priced and easy to use.

Have a look at it and see what you think.

Eunice

__________________

Eunice Cubbage



Veteran Member

Status: Offline
Posts: 54
Date:

Thanks Eunice

I have just bought and installed WinRar - I can password protect a Zip file, to include the payslips, reports etc, which can then be emailed to a client. £40 for a year isnt so bad.  Thanks all - I feel I've been totally bogged down with too much GDPR info out there, and hard to understand what I actually had to do!

Thanks

Gill



__________________

 

 



Master Book-keeper

Status: Offline
Posts: 3904
Date:

Wish I'd flipping thought of Winzip or Winrar, I used to use one or other of these products extensively until a few years ago.

I've spent the best part of 2 hours today sorting out a white label clients reports so I could send them as I wanted.  I tried messing about with a free portal but it wasn't really what I wanted as it was calling the other users (the client and their client) employees!  I then tried to set up a new generic domain of my own to test out a portal, but I'm changing hosting companies (I'm a reseller) because amongst other things the old host can't run the portal I want to use.  Of course dumbo here left everything til the last minute and I've got to wait until my reseller domain transfers over before I can add the new domain.

Ended up password protecting some docs in moneysoft and a separate document saved as a PDF using a PDF program that would password protect it.  The only problem with Moneysoft is that you have to email it to password protect it, it doesn't work if you just save as a PDF, so I had to email them to myself, save them back to my comp so I can then email them back to the client.  Could have done all that in 10 minutes using a zip program.  Also you can't send the payslips and the paye summary together via Moneysoft.   Arghhh, a FFS of my own making lol.  

Just one query, I assume microsoft's own unzipper will unpack the files at the other end?

 

Joanne, I received a document the other day and my date of birth was the password, which seemed to me to be a cracking idea.

 

Eunice, I very nearly opted for the client space, but later found I could manage quite adequately with the password features in moneysoft, apart from 2 clients.  The portal I install on my own domain will, at least I hope, be very similar.



__________________

John 

 

 

 Any advice given is for general guidance and professional advice should be sought applicable to your circumstances.



Senior Member

Status: Offline
Posts: 206
Date:

Hi John

Yes, I only use The Client Space for 5 clients, so I have the basic (and therefore cheapest!) package, and password protect the rest.

Works for me so far!

Eunice

__________________

Eunice Cubbage



Veteran Member

Status: Offline
Posts: 54
Date:

So I spent most of yesterday faffing around with IT stuff (which I am OK with but no expert) - I bought WinRAR (£40) to be told later in the day that you dont have to pay for it.  I zipped up the files, sent to a client to test for me, and he cant open the file.  It turns out the client needs to install WinRAR too, which doesn't sit well with me asking clients to download software just to get their payslips and reports.  Also, if you just download it for free, you get a message after 30 days or so saying you need to pay, which you apparently just click out of, and dont pay, but again, not very professional to me.  I then thought I would pdf the reports, and password protect the payslips through Moneysoft - as Leger said, the payslips and reports go separately, which isn't ideal again.  Plus to password protect the pdf's I need to buy Adobe Acrobat at £13 a month or thereabouts.  I have 16 payroll clients at the moment, so paying more for software/IT defeats the object slightly. 

I am wondering if WinZip is the same as WinRAR, in that the client also needs to download it, or can they open docs with normal Windows?

I may trial The Client Space at £15 or so per month, to keep everything together and lose the necessity to password protect each report one by one... I would just like something straightforward, which costs me not very much, which comes across as professional.... is it too much to ask?? biggrin  I realise I should have perhaps not left it so late in the day to sort, but as with every small business, I am busy doing all and sundry, all at the same time!! Arghhh!  

Eunice - you said you password protect the rest - is that the payroll reports you mean?  With The Client Space, I am imagining you load the payslips and reports for each client into the portal and they log in from their end and download - do I also have to password protect things there?

Thanks for all the replies and comments - I am going to have another think before I dissolve into a heap on the floor in this heat!

Gill



__________________

 

 



Senior Member

Status: Offline
Posts: 421
Date:

Winzip creates zip files. Windows treats such files as if they were folders so you can extract the data from them without needing a copy of winzip.

Winrar can create several types of compressed secure file, including zip files. You just have to select that functionality when you create the file in winrar. I'm not sure how intuitive this is, however.

Clearly, depending on number of clients and how long even the simplest manual process is going to take each pay run, it might end up being simpler to switch to a payroll package that creates the passworded zip file with all the reports in it with less work.

__________________

Life's a reach, then you gybe

 



Master Book-keeper

Status: Offline
Posts: 8646
Date:

I cant see that Client Space is signed up to US Privacy shield.

Not had a big dig around - can you confirm Eunice.

Safe Harbour?

__________________

 Joanne 

Winner of Bookkeeper of the Year 2015, 2016 & 2017 

Thoughts are my own/not to be regarded as official advice,which should be sought from a suitably qualified Accountant.

You should check out answers with reference to the legal position



Veteran Member

Status: Offline
Posts: 54
Date:

I was just thinking the same thing - is there a UK site for it?  Havent been able to find one yet.



__________________

 

 



Expert

Status: Offline
Posts: 1811
Date:

" I received a document the other day and my date of birth was the password, which seemed to me to be a cracking idea."

You appear to have misspelt crap there, John.



__________________

Vince M Hudd - Soft Rock Software

(I only came here looking for fellow apiarists...)



Expert

Status: Offline
Posts: 1811
Date:

"It turns out the client needs to install WinRAR too, which doesn't sit well with me asking clients to download software just to get their payslips and reports."

As Tom said, WinRAR can create Zip files - it's just a matter of choosing the right options (which can probably be set as a default). That aside, though, while Adobe Reader and Flash both (IIRC) tend to come installed by default with Windows computers, this wasn't always so - for a long time, if anyone received a PDF file in an email or visited a website that used Flash, they would be expected to download the software. (Indeed, I expect a lot of software that can automatically email PDFs also includes a link to download it in the text that accompanies the file).

Yet if you're like most people, you wouldn't bat an eyelid and including a note about where Adobe Reader can be downloaded - and I can assure you, given Adobe's reputation for vulnerabilities with that (and probably moreso with Flash) that's very ironic.

"Also, if you just download it for free, you get a message after 30 days or so saying you need to pay, which you apparently just click out of, and dont pay, but again, not very professional to me."

"Not very professional" ? I don't use WinRAR (but I've long since known of it). It sounds like it's using a software distribution model that has been around since as long as I can remember - originally called Shareware, but also known by other names.

The logic is: We're nice people. We've written some useful software, and we're making it available for you - just download it. But hey, why not be nice in return and give us some money for it - to help pay us for the time we spent developing and supporting it, as well as the hosting costs? We'll pop up a message to remind you to do so after a certain time, and we reckon if we were selling this as commercial software, this would be a good asking price... but if you don't want to, that's okay as well.

Either that or it's being sold commercially with a trial period. In which case, if you can click past the message at the end of the trial period and carry on using it, that's what's known as a 'bug' - and speaking with my programmer hat on, the thing I'd say is "not very professional" is taking advantage of the bug to get something for nothing. (Though I note you have paid for it, so that doesn't apply to you.)



__________________

Vince M Hudd - Soft Rock Software

(I only came here looking for fellow apiarists...)



Veteran Member

Status: Offline
Posts: 54
Date:

Vince, you're missing my point.  By not very professional, I am referring to ME not looking very professional by asking my clients to download software which then gives them a message asking them to pay. 

I know Adobe Reader comes as default, but to password protect a pdf I apparently need Adobe Acrobat, which I need to pay for.  I know that WinRAR creates zip files, and I have done this with a couple of groups of files, however my clients cannot open this zip file when they receive it without downloading WinRAR, taking me back to my first point.

I am happy to pay for software when I need the software, and am not trying to work around paying for stuff - I am merely trying to fathom out the best option for me to comply with GDPR without bankrupting myself, or spending hours upon hours preparing reports and payslips for clients, when I cannot pass on the extended cost to them just because they currently pay the going rate.

 



__________________

 

 



Senior Member

Status: Offline
Posts: 421
Date:

GillyP wrote:

Vince, you're missing my point.  By not very professional, I am referring to ME not looking very professional by asking my clients to download software which then gives them a message asking them to pay. 

I know Adobe Reader comes as default, but to password protect a pdf I apparently need Adobe Acrobat, which I need to pay for.  I know that WinRAR creates zip files, and I have done this with a couple of groups of files, however my clients cannot open this zip file when they receive it without downloading WinRAR, taking me back to my first point.

I am happy to pay for software when I need the software, and am not trying to work around paying for stuff - I am merely trying to fathom out the best option for me to comply with GDPR without bankrupting myself, or spending hours upon hours preparing reports and payslips for clients, when I cannot pass on the extended cost to them just because they currently pay the going rate.

 


 If your clients can't open the file that winrar creates without winrar then probably you aren't selecting the option to create a zip file rather than eg a rar file.



__________________

Life's a reach, then you gybe

 



Expert

Status: Offline
Posts: 1811
Date:

Okay, fair enough - I misunderstood your point by that comment.

(As a software developer, I have a twitchy trigger finger at times in discussions that appear to be heading down those lines!)

__________________

Vince M Hudd - Soft Rock Software

(I only came here looking for fellow apiarists...)



Veteran Member

Status: Offline
Posts: 54
Date:

Tom - thank you.  Right, I will look at that and see what options there are.

thanks

Gill



__________________

 

 



Senior Member

Status: Offline
Posts: 206
Date:

No idea, they comply with EU GDPR regulations, is that not enough ?

 

Eunice



__________________

Eunice Cubbage



Senior Member

Status: Offline
Posts: 206
Date:

Hi Gill

 

I thought not, the data is sent over a secure connection so I assume it doesn't need to be password protected.

 

With my other clients I mentioned, I download payslips and reports from Payroll Manager, save them to a file

on my PC (which I would do anyway to keep a copy), and send them as PDFs attached to an email.

 

Eunice



__________________

Eunice Cubbage



Veteran Member

Status: Offline
Posts: 54
Date:

Hi Eunice

I was doing the same - saving all docs and payslips to my computer and emailing to clients, but my understanding is that payslips and docs with sensitive info now needs to be password protected, and therein lies the issue! 

Anyway, I have had my IT guy out today for another matter, and we have found a solution!  7-Zip is free, you save all the docs and payslips into a zip file, put a password on it, and email to your client.  they click to open it, enter the password, and can then access all the docs without entering the password again.  Job done!  So a lot of faffing on my part yesterday, but now resolved, which I am very happy about!

There are probably a million people out there who are saying they have been doing it for months, but there we go!!  Happy bunny! biggrinbiggrinbiggrin

Thanks for all the help!

Gill



__________________

 

 



Senior Member

Status: Offline
Posts: 206
Date:

Gill

I password protect the files from within Payroll Manager.

Glad you have found a satisfactory solution.

Eunice

__________________

Eunice Cubbage



Master Book-keeper

Status: Offline
Posts: 3904
Date:


Hi Gilly

Once you've added the files to winrar and zipped them up, do they have a .zip extension? eg  companyxpayroll.zip  If so, it should work.  If it's got a .rar extension, then you will need to set the default to zip

 

An alternative method would be to put all the files into one folder, highlight the files and right click.  Select send to, and click on compressed (zipped) folder.  This is windows own zipping program, and that should definitely work at the other end..

 



__________________

John 

 

 

 Any advice given is for general guidance and professional advice should be sought applicable to your circumstances.



Master Book-keeper

Status: Offline
Posts: 8646
Date:

Leger wrote:

 

 

Joanne, I received a document the other day and my date of birth was the password, which seemed to me to be a cracking idea.

 

Eunice, I very nearly opted for the client space, but later found I could manage quite adequately with the password features in moneysoft, apart from 2 clients.  The portal I install on my own domain will, at least I hope, be very similar.


John - Only problem with dob as a password is its a bit like leaving a car key on the spare wheel or under a plant pot in the garden - everyone knows how/where to look.

Eunice  - Client Space is a US company?    Note the can also refer to  some software that you may use have domains in the UK as well as US where they state in their privacy policy that they can transfer data outside the country, generally back to the US. 

GDPR has specific requirements for businesses handling data in ANY country, but under GDPR data transfer may only occur to countries deemed by data protection authorities as having adequate data protection laws.   NOTE WELL - US is not listed as one of those countries have adequate data protection laws.   

This is where Privacy Sheild helps.  Its a  newish agreement between the EU and the US (who lets face it love to share data and snoop), allowing transfer of the data from the EU to the US. But the new agreement helps companies on both sides of the pond a mechanism to comply with the stricter EU requirements.   So I would always suggest you work with privacy shield certified (shows they are committed to DP) and not any others.



__________________

 Joanne 

Winner of Bookkeeper of the Year 2015, 2016 & 2017 

Thoughts are my own/not to be regarded as official advice,which should be sought from a suitably qualified Accountant.

You should check out answers with reference to the legal position



Master Book-keeper

Status: Offline
Posts: 3904
Date:

Cheshire wrote:
Leger wrote:

 Joanne, I received a document the other day and my date of birth was the password, which seemed to me to be a cracking idea.


John - Only problem with dob as a password is its a bit like leaving a car key on the spare wheel or under a plant pot in the garden - everyone knows how/where to look.


 Yes, sorry, I'm quite naive, and never thought of the security implications,  Thanks also to Vince who also pointed it out.

 

Regarding The Client Space, they have a GDPR policy but there's no mention of the US privacy shield

https://www.theclientspace.com/gdpr/

 



__________________

John 

 

 

 Any advice given is for general guidance and professional advice should be sought applicable to your circumstances.



Expert

Status: Offline
Posts: 1811
Date:

Hasn't Schrems already started a process that could see the Privacy Fig-leaf agreement go the same way as Unsafe Harbor? Or am I mis-remembering?

Ref the DoB for password thing, I've encountered a few systems where the default is people's DoB until they change it - it's incredibly stupid, and whatever numpty is (or numpties are) responsible for coming up with that idea should be lined up against the wall and shot. Ditto any outfit that uses it as back-up security info.

The logic is: It's a piece of information that the end user knows - so it won't be any trouble for them to remember it the first time they log-in, and then they can change it to something more secure. However as Joanne said, because my own comment was very short and to the point ;) it's a piece of information that for most people is known (and if not, it can often be found out without too much hardship). This means there is a window between their log-in being set up, and them logging in for the first time and changing it*, that a dodgy geezer could do the same.

* And let's be honest here. Average Joe is a lazy bugger when it comes to passwords. 99% of the time, it won't get changed, so will remain their DoB.


__________________

Vince M Hudd - Soft Rock Software

(I only came here looking for fellow apiarists...)



Master Book-keeper

Status: Offline
Posts: 3904
Date:

Fair points Vince.  I'm going to spill the beans though and tell you who it was. Mobile phone company that starts with V and ends with e.

 

I've no idea on the unsafe harbour thingy

 



__________________

John 

 

 

 Any advice given is for general guidance and professional advice should be sought applicable to your circumstances.



Master Book-keeper

Status: Offline
Posts: 3904
Date:

Bucks Bodger wrote:

I password protect the files from within Payroll Manager.


 

Bucks Bodger wrote:

With my other clients I mentioned, I download payslips and reports from Payroll Manager, save them to a file

on my PC (which I would do anyway to keep a copy), and send them as PDFs attached to an email.


 Hi Eunice 

Can you tell me how you do that? I find that they are only password protected if you send direct by email.



__________________

John 

 

 

 Any advice given is for general guidance and professional advice should be sought applicable to your circumstances.



Expert

Status: Offline
Posts: 1811
Date:

"I've no idea on the unsafe harbour thingy"

I was sort of right - Privacy Fig-leaf is under scrutiny, and doesn't appear to be standing up to it. Just nowt directly to do with Max Schrems. (I could have sworn he'd started something, but there's no mention of him in this article).

https://www.theregister.co.uk/2018/07/05/privacy_shield_under_pressure_meps_vote/

 

 



__________________

Vince M Hudd - Soft Rock Software

(I only came here looking for fellow apiarists...)

Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us
Members Login
Username 
 
Password 
    Remember Me  
©2007-2024 The Book-keepers Forum (BKF). All Rights Reserved. The Book-keepers Forum (BKF) is a trading division of Bookcert Ltd. Registered in England Company Number 05782923. 2 Laurel House, 1 Station Rd, Worle, Weston-super-Mare, North Somerset, BS22 6AR, United Kingdom. The Book-keepers Forum and BKF are trademarks of Bookcert Ltd. This forum is a discussion forum only. There will usually be more than one opinion to any question and any posting should not be viewed as a definitive solution. No responsibility for loss occasioned to any person acting or refraining from action as a result of any posting on this site is accepted by the contributors or The Book-keepers Forum. In all cases, appropriate professional advice should be sought before making a decision. We reserve the right to remove any postings which are offensive, libellous, self-promoting or engaged in covert marketing. We will not notify users of removals. The views expressed in the forum posts are those of the individual and do not necessary reflect or agree with those of The Book-keepers Forum. Any offensive or unsuitable posts will be removed by the moderators. Any reader of this forum can request for a post to be looked into by sending an email to: bookcertltd@gmail.com.

Privacy & Cookie Policy  About