HR, payroll and staffing firms

HR, payroll and staffing firms handle some of the most sensitive personal information there is: social insurance numbers, home addresses, dates of birth, direct-deposit banking details, salaries, benefits enrolment, medical leave notes and background checks. Most of it belongs to your clients' employees, people who never chose you as a provider.

Under PIPEDA's Schedule 1 principles, safeguards must be appropriate to the sensitivity of the information, and an organization stays accountable for personal information it transfers to a third party for processing. That is why your clients' privacy officers care so much about how you operate.

Expect long questionnaires from larger clients and requests for evidence: policies, MFA screenshots, penetration test summaries, or a formal attestation. Many questionnaires are organized around ISO/IEC 27001:2022 Annex A control areas such as access control, supplier relationships, incident management and backup.

Answering 'yes' to everything is a liability if the answers are not true. A better approach is to close the real gaps first, document what you actually do, and keep a reusable evidence pack you can update each year.

• Written information security and privacy policies that match practice
• MFA on every system holding client employee data, with evidence
• Access reviews: who can see which client's data, reviewed quarterly
• Backup and recovery tested, with dates
• An incident response plan with client notification steps

The biggest practical risk is too much access: every coordinator able to see every client's payroll, shared admin logins on the payroll platform, former staff accounts still active. Role-based access by client, named accounts, MFA, and prompt offboarding cut most of that risk. Log exports and report downloads from the payroll system, and alert on bulk exports.

A common fraud against payroll providers is simple: an email, apparently from an employee or a client contact, asks to change direct-deposit details before the next pay run. Sometimes the request comes from a genuinely compromised mailbox. The Canadian Anti-Fraud Centre takes reports of this kind of fraud, but prevention is a process question.

1. 01

   No banking changes by email alone

   Require changes through the authenticated employee portal, or a callback to a number already on file.

2. 02

   Notify on change

   Automatically alert the employee's previous contact details when banking information changes.

3. 03

   Hold near pay day

   Changes received within a set window before a pay run get a second check.

4. 04

   Watch client-contact requests

   Bulk changes or new payees requested by a client contact get a phone confirmation.

When you process personal information on behalf of a client, the client generally remains the organization accountable under PIPEDA, and it is usually the client that must assess whether a breach creates a real risk of significant harm, report to the Office of the Privacy Commissioner of Canada and notify individuals as soon as feasible. Your contract almost certainly requires you to tell the client quickly, often within a fixed number of hours or days.

That makes your own detection and investigation capability part of your clients' compliance. You need to be able to say which clients and which employees were affected, and with what confidence. Logs that are not kept, or a laptop reimaged before anyone looked, make that impossible.

• Gap assessment against what your clients actually ask for, then a prioritized fix list
• Microsoft 365 and endpoint hardening, MFA and access reviews
• Help preparing honest, evidenced questionnaire answers
• Incident response and forensic investigation when something happens: 24/7 line (289) 582-9930
• Fees are quoted per engagement.
• $2M cyber liability insurance