How to protect employees' personal data in payroll

What is it for?

Payroll holds data that not every colleague should see: how much each person earns, garnishments, sick leave, strikes and union dues. Health data and trade union membership are special categories under the General Data Protection Regulation (GDPR, RGPD in Portuguese, art. 9).

fiscaldoo protects them in three ways: each profile only opens what concerns it, the absence type has a neutral name for those who must not know the reason, and the sick leave certificate is kept in a restricted record. This article shows how to grant the right profile, where to store the certificate and where to check who did what.

When to use it?

• When you give a new person access to payroll or absences.
• When someone has to handle sick leave certificates.
• When you want to know who processed a payslip or who viewed a certificate.

Where to find it?

• Profiles: Settings › Users & Companies › Users, on the user form.
• Restricted sick leave record: Payroll › Prepare › Absences and attendance › Absences by incapacity. It only appears with the View medical absence profile. Someone with only that profile finds it straight away in Payroll › Prepare.
• Who did what: Audit › Records › Audit log and Audit › Auditor package › Payroll audit report.
• Portal audit trail and Worker file fields: they open from the Payroll › Prepare › What is there to do this month? panel. Each profile sees its own link: the first in the HR panel, the second in Other records and tables, in the Payroll Administrator's panel.

Before you start

• To assign profiles, log in as system administrator.
• The View medical absence profile is not assigned to anyone, not even the system administrator. Without it, the administrator gets “You have no access to “Record of absence by incapacity (PT)””.
• Decide who handles the certificates. This profile gives access to health data: the fewer people, the better.

What each profile sees today

Seen in the demo company, with one user of each profile. A “no” means the menu does not appear or access is refused.

What	HR	Payroll Processor	Payroll Administrator	Management	Auditor	View medical absence (alone)
Absences (whole-company list)	yes	yes	yes	no	no	no
Real name of the type of a health absence	no: neutral name	no: neutral name	no: neutral name	no	no	yes, in the restricted record
Absences by incapacity (restricted record)	no	no	no	no	no	yes
File of a health or family absence, or of a certificate	no	no	no	no	no	yes
Strike absences of other employees	no	yes	yes	no	no	no
Payslips	no	yes	yes	yes	no	no
Garnishments and Union dues to deliver	no	yes	yes	no	no	no
Payroll audit report	no	no	no	yes	yes	no

The Accountant profile does not have the Payroll or Audit menus, so the answer is “no” on every row. If it opens the restricted record through a link, it gets “You have no access to “Record of absence by incapacity (PT)””.

Each Worker sees in My space only their own absences and My payslip. The file of their own sick leave is closed to them too: if they ask for it, someone with the View medical absence profile can give it to them.

This table does not replace advice on the GDPR rules in the company, such as the legal basis and retention periods. Pending validation by a lawyer: lawful bases, retention periods and the employee's right of access to the file (GDPR, art. 15).

How to use it

Grant the profile to whoever handles certificates

1. Open Settings › Users & Companies › Users and open the user.
2. In the Profile tab, choose the profile for their day-to-day work. For someone who handles absences, choose HR manager.
3. Click Advanced settings. In Payroll PT — Medical absence, choose View medical absence. The other Payroll PT lines stay as they are.
4. Click Save. Choosing another Profile later does not remove this line: remove it by hand, choosing No, when the person stops handling certificates.
5. Ask the person to log in again and confirm they have the Absences by incapacity menu, in Payroll › Prepare.

The View medical absence profile on its own gives access to the restricted record, but not to absences: the Open the absence button does not appear for it. Also give HR manager if the same person records the absences, or has to attach the document to a family absence.

Record the absence without revealing the reason

1. In Payroll › Prepare › Absences and attendance › Absences, click New and choose the Worker.
2. In Time Type, choose the letter given by whoever has the View medical absence profile. Health types only have a neutral name (“Justified absence — impossibility to work…”, “Justified absence — protected by law…”) and a letter, and the screen explains why.
3. Leave Description empty. On a health or strike type, the program refuses any text when saving.
4. Click Save. Do not attach the certificate here, nor in a note: the program refuses.

The full steps for a sick leave, with the approval and the effect on the payslip, are in How to handle sick leave or a work accident.

Store the certificate in the restricted record

This procedure is done with the View medical absence profile.

1. Open Absences by incapacity, in Payroll › Prepare, and open the sick leave. The record appears as soon as the absence is saved, and the warning at the top says what may be written.
2. In the Certificates tab, click Add a line and fill in Certificate number, Issued on, Valid from and Valid until.
3. In File, attach the copy of the certificate and click Save.
4. Do not write the diagnosis: not in Note, not in the file name.

When the sick leave becomes Approved, the screen says “This record is already closed (validated, approved, paid or sent), so it can no longer be changed.” and Add a line disappears. Attach the certificate before the absence reaches that state.

Attach the document of a family absence

The types for assisting a family member or the person cared for, informal carer, accompanying a pregnant woman, travel for childbirth, breastfeeding and blood donation also require a document: “A document justifying this type of absence must be attached.” That document can reveal health data, so it is closed like a sick leave document. Only someone with View medical absence attaches and opens it, and that person also needs a profile that opens absences, such as HR manager.

1. In Payroll › Prepare › Absences and attendance › Absences, open the absence.
2. In the Portuguese law: communication, proof and effect tab, in Proof document, click Attach file and choose the document.
3. Click Save.

For the other profiles, Proof document stays empty: they do not see that there is a file and cannot open it.

Check who did what

1. For payroll, open Audit › Auditor package › Payroll audit report. It shows who created, calculated, validated, paid, corrected or submitted each payslip and return, and when. The list is grouped by User. To take the list out of the program you need the export permission: the Auditor profile has no Actions when ticking lines.
2. For health data, open Audit › Records › Audit log. The list is grouped by event type: open the Medical absence data read group. Each time someone opens a sick leave a line is added, with or without a certificate: certificates read on opening count as part of the opening. Reading only the certificates leaves a line of its own. Each line says who and when, but not whose it was nor what type of absence: Record (at the time of the event) shows [restrito]. That is how it looks to anyone without the View medical absence profile, including Auditor, Management and the system administrator.
3. For the portal, open the Portal audit trail (HR profile or system administrator). It shows, for example, “Payslip downloaded”, with the employee and the time.

Review the data the employee record holds

With the Payroll Administrator profile (or system administrator), open Worker file fields. There are 27 data items, each with its Classification (for example Fiscal (IRS), Social Security or Optional (internal management)), the Legal basis and validity dates.

This list documents what each data item is for. It does not decide who sees it: what each person sees depends only on the profile. For a data item already in use, the screen does not let you change the line: close it in Valid until and record a new one.

Expected result

• Whoever records the absence sees a neutral name and cannot write the reason or attach the file.
• The certificate and the file only open for someone with the View medical absence profile. For other profiles, the direct link to the file replies that the page does not exist.
• The system administrator does not see health data without the profile, not even in the audit log, but is the one who assigns it: choose carefully who is an administrator.
• In the absence list, the Actions menu of the HR profile only has Delete: there is no export from there.
• None of this generates journal entries.

What these protections do not cover

• Type name in family absences. Types such as Assistance to a household member (art. 252.º) have their name visible to whoever opens absences. Only the file is closed. So do not write a family member's health data in Description.
• Lists of the restricted record. The audit log records the opening of a record, not viewing the list.

Important notes

Before granting the profile to someone

The View medical absence profile opens the health data of all employees of the chosen company. Do not grant it for convenience or to solve a “no access” message. Pending validation by a lawyer: who, in each company, may have this profile.

• Each company sees only its own data. A user created in another company does not see this one's sick leave, even with the profile: check the company on the user form.
• The report and the audit log say what the program recorded. They do not see what someone read on paper, in a screenshot or in a copy outside the program.

Common problems

“This absence type cannot have free text”

• Symptom: when saving, the Invalid Operation window says “This absence type cannot have free text. What happened: the “Reasons” and the “Description” of an absence are read by colleagues and managers and, on an absence for health reasons or a strike, would reveal a special category of data (GDPR art. 9).”
• What to do: delete the Description and save. Whatever needs recording goes in the restricted record, without a diagnosis.

“Files cannot be attached to this absence”

• Symptom: when attaching the file to a health or family absence, in Proof document or in a note, you get “Files cannot be attached to this absence. What happened: a file of this absence is health data (GDPR, art. 9) and colleagues and managers read the absence. How to fix it: ask the “View medical absence” profile to attach it (on a family member's absence, that person also needs a profile that opens absences, such as “HR”).”
• What to do: hand the file to someone with the View medical absence profile. On a sick leave, they attach it in Certificates. On a family absence, in Proof document.

The Absences by incapacity menu is empty

• Symptom: the person has the profile, but the list says “The sickness leaves of the workers appear here”.
• What to do: check on the user form whether the company is the right one. In the demo, a user created in another company saw the list empty, with sick leave recorded.

An export by another route is refused

• Symptom: an export request from outside the screen (for example from an integration), with the HR, Payroll Processor, Payroll Administrator or Management profiles, replies “Your profile is not allowed to export data this way. To get a file, use the report exports (XLSX or PDF) or ask the system administrator.”
• What to do: use the exports of the reports your profile has access to. Do not ask for a broader profile just to export.