Protecting employees' personal data in payroll
How the principles in Kenya's Data Protection Act apply to payroll and staff records, what employment law says you must keep, and who sees what.
By Achekam · · 4 min read · For Running a business businesses in Kenya
Payroll holds more personal information than almost anything else in a business. ID numbers, KRA PINs, bank accounts, salaries, next of kin, sick notes, warning letters. It is also handled by a small number of people, often under time pressure at month-end, and frequently shared by e-mail with an accountant or payroll bureau.
Kenya's Data Protection Act applies to all of it. Employees are data subjects like anyone else, and the business is the data controller for their records. At the same time, employment law requires some of those records to be kept for years. This article shows how the two fit together, and how to set up payroll so that personal data is handled with care without slowing the pay run down.
The law behind it
The Office of the Data Protection Commissioner (ODPC) describes the Data Protection Act, 2019 as giving effect to Article 31(c) and (d) of the Constitution. The Act establishes the ODPC and sets the obligations of data controllers and data processors.
The core of those obligations is in section 25. You can read the full text of the Data Protection Act on Kenya Law, where section 25 sets out the principles of data protection.
Purpose and data minimisation
Section 25 requires personal data to be collected for explicit, specified and legitimate purposes and limited to what is necessary for them. In payroll terms, every field on the employee form should have a reason.
Ask of each item: which purpose does this serve? A KRA PIN serves PAYE. A bank account serves paying wages. NSSF and SHIF numbers serve statutory deductions. A copy of the employee's ID serves identification at onboarding. But a photograph of a spouse's ID, or a medical history collected "in case", is harder to justify.
A practical test: if nobody can name the purpose, stop collecting it, and decide what to do with what you already hold.
Accuracy and how long to keep records
The same section requires personal data to be kept accurate and kept no longer than necessary. In payroll, inaccuracy has a direct cost: wrong bank details pay the wrong account, and a wrong PIN puts tax against the wrong person.
"No longer than necessary" does not mean delete when someone leaves. Other laws set the minimum. The question is what happens after that minimum has passed: a retention rule, applied consistently, is what shows you took the principle seriously.
Employment law records you must keep anyway
The Employment Act sets out records an employer cannot choose to discard.
- The section 74 record. An employer must keep a written record for each employee, including leave taken and due, maternity and sick leave, rest days and warning letters, and let an authorised officer inspect records for the preceding thirty-six months.
- Written particulars. Under section 10, the written particulars of employment must be given no later than two months after employment begins, and kept for five years after the employment ends. If the employer cannot produce them in legal proceedings, the burden of proving the terms falls on the employer.
These are lawful purposes for keeping the data, so retaining them is consistent with data protection. Keeping them beyond what is needed, or using them for something unrelated, is where problems start. For preparing these records for a labour officer, see employee records a labour officer can ask for.
Bank details changed with two people in Achekam
One of the commonest frauds in payroll is a forged request to change an employee's bank account. Achekam treats bank details as a two-person matter: an employee's bank account entered or changed by one person must be verified by another before it is paid in the payment schedule or bank file.
Pay runs follow the same idea. A run is approved by someone other than the person who prepared it, and nobody can approve a run that pays themselves. A business therefore needs at least two people in payroll roles, which also means no single person can quietly change both who is paid and how much.
Self-service so staff see their own data
Accuracy is easier when employees can see and correct their own records. A staff member whose login is linked to their payroll record can download their own payslips, apply for leave, and submit expense claims, detail changes or a new bank account for payroll to decide. An approved bank change still needs a second person to verify it, so self-service does not open a back door around the two-person rule.
Self-service also cuts down on payslips sent around by e-mail, one of the easier ways for salary information to end up in the wrong inbox.
If you use AI to read documents, note that Achekam's Document Intelligence refuses restricted classes of data, such as payroll and bank data, unless they have been allowed for a particular purpose. Decide deliberately whether payroll documents should ever go through it.
Who in the business may see payroll
The law does not name job titles, but the minimisation principle points to a short list. A sensible starting position:
| Person | Needs to see |
|---|---|
| Payroll preparer | Full employee records and pay inputs |
| Payroll approver | Runs, totals and exceptions |
| Line manager | Their own team's leave, not salaries |
| Employee | Their own payslips and details |
| Outside accountant or bureau | What the engagement requires, under a written agreement |
| Everyone else | Nothing |
Write the list down, check who actually has access, and remove anyone who does not need it. If a payroll file does go astray, the steps are in a personal data breach: the first 72 hours. Bigger changes, such as biometric clocking, may call for a data protection impact assessment first.
Start with the employee form: go through each field and write its purpose next to it. The ones you cannot explain are your first clean-up.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
