SESAY / People, payroll & governance
Offshore payroll data handling and client controls
Understand the access, confidentiality, review and continuity arrangements to agree before payroll delivery begins.
Published by SESAY · Updated 3 October 2026
This page describes controls to agree and verify for each engagement. It is not a claim that every control is already deployed across SESAY or every client. Actual systems, access locations, providers, safeguards and service commitments must be documented before live data is shared.
Access controls
Agree named accounts, least-privilege roles, multifactor authentication where supported, client-approved devices and restrictions on downloads or local copies. Record who grants access, who reviews it and when it is removed. Confirm the actual settings before live processing.
Confidentiality and data location
Document confidentiality obligations, authorised purposes, delivery locations, relevant providers and any onward access. Confirm approved transfer channels, storage locations, retention and deletion arrangements in the engagement. Australian oversight does not itself mean that all data remains in Australia.
Preparation, review and approval
Assign the dedicated specialist’s preparation tasks, the shared lead’s review responsibilities and the Australian governance lead’s escalation role. Define which changes need independent verification. The client’s authorised approver retains final payroll and payment authority.
Continuity and backup
Agree a backup person or capacity arrangement, a documented pay-run procedure and a tested handover. Define what happens during absence, system outage or interrupted connectivity, including escalation contacts and recovery priorities. Do not assume a shared team automatically provides a guaranteed recovery time.
Incidents and access removal
Agree how suspected unauthorised access or data loss is reported, who contains it, who assesses notification duties and who informs the client. Include access revocation and approved data return or deletion at the end of the engagement, subject to lawful retention requirements.
Cross-border privacy requires its own assessment
Where the Australian Privacy Principles apply, overseas access and disclosure require a facts-based assessment. OAIC guidance distinguishes use from disclosure and explains APP 8 responsibilities and exceptions. Do not assume an employee-records exemption or a confidentiality agreement settles every privacy obligation. Obtain appropriate advice for the actual arrangement.
What a client can ask SESAY to confirm
- Who can see employee data, from which countries and in which systems?
- Which technical restrictions are enabled and what evidence is available?
- Who reviews payroll, approves changes and releases payments?
- What backup capacity, incident contacts and response commitments are included?
- How is access removed and data handled when the engagement ends?