Payroll and GDPR - The Book-keepers Forum (UK)

GillyP · Veteran Member

Payroll and GDPR

Tom McClelland · Senior Member

I would have thought that a passworded winzip of a report pack including payslips would be perfectly adequate.

12Pay Bureau Edition for example (I am no longer associated with that product) includes a function to create password protected zipped report packs so one zip file can be automatically made up as a single request that contains all of your client's reports, including payslips, for a period. It can also bundle a set of reports into a single password-protected PDF. I expect that rival products ought to have some similar functionality for their bureau clients.

Clearly sending paper by post is in reality far *less* safe even than emailing unprotected reports. Bizarre that GDPR might push people into less safe behaviour! The Law of Unintended Consequences....

Cheshire · Master Book-keeper

Hi Gill
You dont need a portal - just another pile of scaremongering. You dont say what payroll software you use so cant advise specifics.

You can password protect the payslips and email as a bulk for the employer to sort, or you can password protect individuals payslips and email them individually (via the good payroll software at least!). I dont favour the latter as you potnetially get mithered to death when employees forget their password.

You can also easily password protect a report via pdf and email it.

Not used WinZip for a while. This can be p/w protected. What you need to check - do they hold that data when its zipped? I dont think they do, but check their privacy pol and if its outwith the EU that they confirm they opt in/subscribe (whatever the word is) to the EU laws and the US Privacy Shield. (If not those two, then dont use!)

You can also password protect and share via a file sharing app.

It has been covered, in part, in the two lengthy GDPR posts from about 3-4 weeks ago and the rest will have been buried in other posts not specifically titled GDPR (one godo reason to come on the site daily).

Cheshire · Master Book-keeper

Tom McClelland wrote:
Bizarre that GDPR might push people into less safe behaviour! The Law of Unintended Consequences....

Totally agree

GillyP · Veteran Member

Thanks Tom - yes, I agree that post is, in reality, probably much less safe than unsecured emails, but there you go. I use Moneysoft payroll manager, and their suggestion was to use a portal. I just wasnt sure if Winzip was secure enough for the reports, but hopefully that might be a solution.

thanks

Gill

Tom McClelland · Senior Member

Cheshire wrote:
Hi Gill
You dont need a portal - just another pile of scaremongering. You dont say what payroll software you use so cant advise specifics.

You can password protect the payslips and email as a bulk for the employer to sort, or you can password protect individuals payslips and email them individually (via the good payroll software at least!). I dont favour the latter as you potnetially get mithered to death when employees forget their password.

You can also easily password protect a report via pdf and email it.

Not used WinZip for a while. This can be p/w protected. What you need to check - do they hold that data when its zipped? I dont think they do, but check their privacy pol and if its outwith the EU that they confirm they opt in/subscribe (whatever the word is) to the EU laws and the US Privacy Shield. (If not those two, then dont use!)

You can also password protect and share via a file sharing app.

It has been covered, in part, in the two lengthy GDPR posts from about 3-4 weeks ago and the rest will have been buried in other posts not specifically titled GDPR (one godo reason to come on the site daily).

Winzip is desktop software that runs entirely on your own PC. They never see your data.

Cheshire · Master Book-keeper

Ah, thanks for clarifying Tom.

GillyP · Veteran Member

So presumably Winzip isnt suitable for sending docs externally to clients then?

Thanks

Gill

Cheshire · Master Book-keeper

GillyP wrote:
So presumably Winzip isnt suitable for sending docs externally to clients then?
Thanks
Gill

Yes its stuitable as the data is NOT held by Winzip. Its held by you and then by whoever you send it to and its p/w protected.

GillyP · Veteran Member

Ah I see - thank you for that. Will look into that then!

Gill

Bucks Bodger · Senior Member

Hi Gill

I am in a similar situation and I am using
a portal called The Client Space, Which is
very reasonably priced and easy to use.

Have a look at it and see what you think.

Eunice

GillyP · Veteran Member

Thanks Eunice

I have just bought and installed WinRar - I can password protect a Zip file, to include the payslips, reports etc, which can then be emailed to a client. £40 for a year isnt so bad. Thanks all - I feel I've been totally bogged down with too much GDPR info out there, and hard to understand what I actually had to do!

Thanks

Gill

Leger · Master Book-keeper

Wish I'd flipping thought of Winzip or Winrar, I used to use one or other of these products extensively until a few years ago.

I've spent the best part of 2 hours today sorting out a white label clients reports so I could send them as I wanted. I tried messing about with a free portal but it wasn't really what I wanted as it was calling the other users (the client and their client) employees! I then tried to set up a new generic domain of my own to test out a portal, but I'm changing hosting companies (I'm a reseller) because amongst other things the old host can't run the portal I want to use. Of course dumbo here left everything til the last minute and I've got to wait until my reseller domain transfers over before I can add the new domain.

Ended up password protecting some docs in moneysoft and a separate document saved as a PDF using a PDF program that would password protect it. The only problem with Moneysoft is that you have to email it to password protect it, it doesn't work if you just save as a PDF, so I had to email them to myself, save them back to my comp so I can then email them back to the client. Could have done all that in 10 minutes using a zip program. Also you can't send the payslips and the paye summary together via Moneysoft. Arghhh, a FFS of my own making lol.

Just one query, I assume microsoft's own unzipper will unpack the files at the other end?

Joanne, I received a document the other day and my date of birth was the password, which seemed to me to be a cracking idea.

Eunice, I very nearly opted for the client space, but later found I could manage quite adequately with the password features in moneysoft, apart from 2 clients. The portal I install on my own domain will, at least I hope, be very similar.

Bucks Bodger · Senior Member

Hi John

Yes, I only use The Client Space for 5 clients, so I have the basic (and therefore cheapest!) package, and password protect the rest.

Works for me so far!

Eunice

GillyP · Veteran Member

So I spent most of yesterday faffing around with IT stuff (which I am OK with but no expert) - I bought WinRAR (£40) to be told later in the day that you dont have to pay for it. I zipped up the files, sent to a client to test for me, and he cant open the file. It turns out the client needs to install WinRAR too, which doesn't sit well with me asking clients to download software just to get their payslips and reports. Also, if you just download it for free, you get a message after 30 days or so saying you need to pay, which you apparently just click out of, and dont pay, but again, not very professional to me. I then thought I would pdf the reports, and password protect the payslips through Moneysoft - as Leger said, the payslips and reports go separately, which isn't ideal again. Plus to password protect the pdf's I need to buy Adobe Acrobat at £13 a month or thereabouts. I have 16 payroll clients at the moment, so paying more for software/IT defeats the object slightly.

I am wondering if WinZip is the same as WinRAR, in that the client also needs to download it, or can they open docs with normal Windows?

I may trial The Client Space at £15 or so per month, to keep everything together and lose the necessity to password protect each report one by one... I would just like something straightforward, which costs me not very much, which comes across as professional.... is it too much to ask?? biggrin I realise I should have perhaps not left it so late in the day to sort, but as with every small business, I am busy doing all and sundry, all at the same time!! Arghhh!

Eunice - you said you password protect the rest - is that the payroll reports you mean? With The Client Space, I am imagining you load the payslips and reports for each client into the portal and they log in from their end and download - do I also have to password protect things there?

Thanks for all the replies and comments - I am going to have another think before I dissolve into a heap on the floor in this heat!

Gill

Tom McClelland · Senior Member

Winzip creates zip files. Windows treats such files as if they were folders so you can extract the data from them without needing a copy of winzip.

Winrar can create several types of compressed secure file, including zip files. You just have to select that functionality when you create the file in winrar. I'm not sure how intuitive this is, however.

Clearly, depending on number of clients and how long even the simplest manual process is going to take each pay run, it might end up being simpler to switch to a payroll package that creates the passworded zip file with all the reports in it with less work.

Cheshire · Master Book-keeper

I cant see that Client Space is signed up to US Privacy shield.

Not had a big dig around - can you confirm Eunice.

Safe Harbour?

GillyP · Veteran Member

I was just thinking the same thing - is there a UK site for it? Havent been able to find one yet.

VinceH · Expert

" I received a document the other day and my date of birth was the password, which seemed to me to be a cracking idea."

You appear to have misspelt crap there, John.

VinceH · Expert

"It turns out the client needs to install WinRAR too, which doesn't sit well with me asking clients to download software just to get their payslips and reports."

As Tom said, WinRAR can create Zip files - it's just a matter of choosing the right options (which can probably be set as a default). That aside, though, while Adobe Reader and Flash both (IIRC) tend to come installed by default with Windows computers, this wasn't always so - for a long time, if anyone received a PDF file in an email or visited a website that used Flash, they would be expected to download the software. (Indeed, I expect a lot of software that can automatically email PDFs also includes a link to download it in the text that accompanies the file).

Yet if you're like most people, you wouldn't bat an eyelid and including a note about where Adobe Reader can be downloaded - and I can assure you, given Adobe's reputation for vulnerabilities with that (and probably moreso with Flash) that's very ironic.

"Also, if you just download it for free, you get a message after 30 days or so saying you need to pay, which you apparently just click out of, and dont pay, but again, not very professional to me."

"Not very professional" ? I don't use WinRAR (but I've long since known of it). It sounds like it's using a software distribution model that has been around since as long as I can remember - originally called Shareware, but also known by other names.

The logic is: We're nice people. We've written some useful software, and we're making it available for you - just download it. But hey, why not be nice in return and give us some money for it - to help pay us for the time we spent developing and supporting it, as well as the hosting costs? We'll pop up a message to remind you to do so after a certain time, and we reckon if we were selling this as commercial software, this would be a good asking price... but if you don't want to, that's okay as well.

Either that or it's being sold commercially with a trial period. In which case, if you can click past the message at the end of the trial period and carry on using it, that's what's known as a 'bug' - and speaking with my programmer hat on, the thing I'd say is "not very professional" is taking advantage of the bug to get something for nothing. (Though I note you have paid for it, so that doesn't apply to you.)

GillyP · Veteran Member

Vince, you're missing my point. By not very professional, I am referring to ME not looking very professional by asking my clients to download software which then gives them a message asking them to pay.

I know Adobe Reader comes as default, but to password protect a pdf I apparently need Adobe Acrobat, which I need to pay for. I know that WinRAR creates zip files, and I have done this with a couple of groups of files, however my clients cannot open this zip file when they receive it without downloading WinRAR, taking me back to my first point.

I am happy to pay for software when I need the software, and am not trying to work around paying for stuff - I am merely trying to fathom out the best option for me to comply with GDPR without bankrupting myself, or spending hours upon hours preparing reports and payslips for clients, when I cannot pass on the extended cost to them just because they currently pay the going rate.

Tom McClelland · Senior Member

GillyP wrote:
Vince, you're missing my point. By not very professional, I am referring to ME not looking very professional by asking my clients to download software which then gives them a message asking them to pay.
I know Adobe Reader comes as default, but to password protect a pdf I apparently need Adobe Acrobat, which I need to pay for. I know that WinRAR creates zip files, and I have done this with a couple of groups of files, however my clients cannot open this zip file when they receive it without downloading WinRAR, taking me back to my first point.
I am happy to pay for software when I need the software, and am not trying to work around paying for stuff - I am merely trying to fathom out the best option for me to comply with GDPR without bankrupting myself, or spending hours upon hours preparing reports and payslips for clients, when I cannot pass on the extended cost to them just because they currently pay the going rate.

If your clients can't open the file that winrar creates without winrar then probably you aren't selecting the option to create a zip file rather than eg a rar file.

VinceH · Expert

Okay, fair enough - I misunderstood your point by that comment.

(As a software developer, I have a twitchy trigger finger at times in discussions that appear to be heading down those lines!)

GillyP · Veteran Member

Tom - thank you. Right, I will look at that and see what options there are.

thanks

Gill

Bucks Bodger · Senior Member

No idea, they comply with EU GDPR regulations, is that not enough ?

Eunice

Bucks Bodger · Senior Member

Hi Gill

I thought not, the data is sent over a secure connection so I assume it doesn't need to be password protected.

With my other clients I mentioned, I download payslips and reports from Payroll Manager, save them to a file

on my PC (which I would do anyway to keep a copy), and send them as PDFs attached to an email.

Eunice

GillyP · Veteran Member

Hi Eunice

I was doing the same - saving all docs and payslips to my computer and emailing to clients, but my understanding is that payslips and docs with sensitive info now needs to be password protected, and therein lies the issue!

Anyway, I have had my IT guy out today for another matter, and we have found a solution! 7-Zip is free, you save all the docs and payslips into a zip file, put a password on it, and email to your client. they click to open it, enter the password, and can then access all the docs without entering the password again. Job done! So a lot of faffing on my part yesterday, but now resolved, which I am very happy about!

There are probably a million people out there who are saying they have been doing it for months, but there we go!! Happy bunny! biggrin biggrin biggrin

Thanks for all the help!

Gill

Bucks Bodger · Senior Member

Gill

I password protect the files from within Payroll Manager.

Glad you have found a satisfactory solution.

Eunice

Leger · Master Book-keeper

Hi Gilly
Once you've added the files to winrar and zipped them up, do they have a .zip extension? eg companyxpayroll.zip If so, it should work. If it's got a .rar extension, then you will need to set the default to zip

An alternative method would be to put all the files into one folder, highlight the files and right click. Select send to, and click on compressed (zipped) folder. This is windows own zipping program, and that should definitely work at the other end..

Cheshire · Master Book-keeper

Leger wrote:

Joanne, I received a document the other day and my date of birth was the password, which seemed to me to be a cracking idea.

Eunice, I very nearly opted for the client space, but later found I could manage quite adequately with the password features in moneysoft, apart from 2 clients. The portal I install on my own domain will, at least I hope, be very similar.

John - Only problem with dob as a password is its a bit like leaving a car key on the spare wheel or under a plant pot in the garden - everyone knows how/where to look.

Eunice - Client Space is a US company? Note the can also refer to some software that you may use have domains in the UK as well as US where they state in their privacy policy that they can transfer data outside the country, generally back to the US.

GDPR has specific requirements for businesses handling data in ANY country, but under GDPR data transfer may only occur to countries deemed by data protection authorities as having adequate data protection laws. NOTE WELL - US is not listed as one of those countries have adequate data protection laws.

This is where Privacy Sheild helps. Its a newish agreement between the EU and the US (who lets face it love to share data and snoop), allowing transfer of the data from the EU to the US. But the new agreement helps companies on both sides of the pond a mechanism to comply with the stricter EU requirements. So I would always suggest you work with privacy shield certified (shows they are committed to DP) and not any others.

Leger · Master Book-keeper

Cheshire wrote:
Leger wrote:
Joanne, I received a document the other day and my date of birth was the password, which seemed to me to be a cracking idea.
John - Only problem with dob as a password is its a bit like leaving a car key on the spare wheel or under a plant pot in the garden - everyone knows how/where to look.

Yes, sorry, I'm quite naive, and never thought of the security implications, Thanks also to Vince who also pointed it out.

Regarding The Client Space, they have a GDPR policy but there's no mention of the US privacy shield

https://www.theclientspace.com/gdpr/

VinceH · Expert

Hasn't Schrems already started a process that could see the Privacy Fig-leaf agreement go the same way as Unsafe Harbor? Or am I mis-remembering?

Ref the DoB for password thing, I've encountered a few systems where the default is people's DoB until they change it - it's incredibly stupid, and whatever numpty is (or numpties are) responsible for coming up with that idea should be lined up against the wall and shot. Ditto any outfit that uses it as back-up security info.

The logic is: It's a piece of information that the end user knows - so it won't be any trouble for them to remember it the first time they log-in, and then they can change it to something more secure. However as Joanne said, because my own comment was very short and to the point ;) it's a piece of information that for most people is known (and if not, it can often be found out without too much hardship). This means there is a window between their log-in being set up, and them logging in for the first time and changing it*, that a dodgy geezer could do the same.

* And let's be honest here. Average Joe is a lazy bugger when it comes to passwords. 99% of the time, it won't get changed, so will remain their DoB.

Leger · Master Book-keeper

Fair points Vince. I'm going to spill the beans though and tell you who it was. Mobile phone company that starts with V and ends with e.

I've no idea on the unsafe harbour thingy

Leger · Master Book-keeper

Bucks Bodger wrote:
I password protect the files from within Payroll Manager.

Bucks Bodger wrote:
With my other clients I mentioned, I download payslips and reports from Payroll Manager, save them to a file
on my PC (which I would do anyway to keep a copy), and send them as PDFs attached to an email.

Hi Eunice

Can you tell me how you do that? I find that they are only password protected if you send direct by email.

VinceH · Expert

"I've no idea on the unsafe harbour thingy"

I was sort of right - Privacy Fig-leaf is under scrutiny, and doesn't appear to be standing up to it. Just nowt directly to do with Max Schrems. (I could have sworn he'd started something, but there's no mention of him in this article).

https://www.theregister.co.uk/2018/07/05/privacy_shield_under_pressure_meps_vote/