When you’re running a remote team across countries, payroll data privacy isn’t something you can hand off and forget. Even when a global payroll provider or employer of record processes everything, the legal responsibility still sits with you. Most frameworks — GDPR, Brazil’s LGPD, Canada’s PIPEDA — treat the employer as the data controller, meaning any privacy failure by the provider stays your liability. That’s a uncomfortable reality if you’ve been treating cross-border payroll as a purely operational task.
Cross-border payroll
Data privacy compliance
Employer of record
What a Single Payroll Run Actually Reveals About an Employee
A typical cross-border payroll file contains far more than a salary figure. The data categories that providers handle include identification data like name, home address, date of birth, and national ID numbers; financial data such as bank account details and bonus amounts; tax withholding records; benefits enrollment; employment contract terms; and in some cases special category data — health records tied to benefits deductions, religious affiliation linked to tax-exempt contributions, or trade union membership.
Most of what’s documented here about data categories and the employer’s ongoing liability comes from the guidance published by Employ Borderless, which lays out the full scope of what a multi-country payroll contains and why each category carries different protection levels. Financial data, for example, is classified as standard personal data under most frameworks but carries high fraud risk because it’s the most valuable target for identity theft. Special category data gets heightened protection under GDPR Article 9, meaning any provider handling it needs explicit justification and stronger safeguards.
The employer’s role as data controller doesn’t change when you outsource. Under GDPR and most comparable laws, the provider becomes a data processor, but you remain ultimately accountable for what happens to that information. That means your vendor selection process needs to treat data privacy as a core criterion, not a checkbox at the bottom of the contract.
The Regulatory Patchwork That Applies to One Employee’s File
Payroll data isn’t covered by a single global privacy rule. A company with employees in the United Kingdom, Brazil, and India could be dealing with GDPR, LGPD, and the new DPDPA all at once — and the provider’s infrastructure has to satisfy each simultaneously. The table below outlines the key frameworks you’re most likely to encounter, based on the regulatory summaries from Employ Borderless and CXC Global.
Lawful basis required (legitimate interest usually applies for payroll). Data minimization, purpose limitation, storage limitation. Employee rights include access, rectification, portability, erasure. Cross-border transfers need Standard Contractual Clauses, adequacy decisions, or binding corporate rules. Penalties up to 4% global annual turnover or €20 million.
Right to know, right to delete, right to opt out of data sales. The CPRA removed the employee data exemption, so payroll data is now fully covered. No explicit cross-border transfer mechanism, but requires disclosure of third-party sharing. Penalties up to $7,500 per intentional violation.
Separate consent required for cross-border transfers. Government security assessments may be needed for large data volumes. Data localization requirements — some payroll data must stay inside China. Penalties up to 50 million yuan or 5% of previous year’s revenue.
Lawful basis required (legitimate interest applicable to payroll). Data subject rights mirror GDPR. Transfers allowed to countries with adequate protection or under SCCs. Penalties up to 2% of revenue in Brazil, capped at 50 million reais per violation.
India’s DPDPA passed in 2023 with operational rules released in January 2025, and those rules are still being finalized — so if you have employees in India, treat the transfer requirements as a moving target. Canada’s PIPEDA applies nationally, but Quebec’s Law 25, in full effect since 2024, adds mandatory privacy impact assessments and stricter breach notification, creating dual compliance for companies with Quebec employees.
The United States has no single federal privacy law equivalent to GDPR; obligations come from a patchwork of federal rules like HIPAA and growing state laws, with CPRA being the most consequential for payroll. That means a provider handling U.S. employee data needs to navigate multiple state-level regimes even before crossing a border.
How Payroll Data Actually Moves Across Borders
Every time salary information travels between a subsidiary and headquarters, or from an employer to a cloud-hosted payroll system in another country, it’s a cross-border transfer. Each transfer triggers legal requirements that vary by the employee’s country. A U.S. company with employees in Germany sending payroll data to a U.S.-based provider makes a cross-border transfer under GDPR. A UK company consolidating payroll reporting at a Singapore headquarters makes another.
The legal mechanisms that allow these transfers include adequacy decisions (the EU recognizes a limited number of countries as having adequate data protection), Standard Contractual Clauses (contractual terms between data exporter and importer), binding corporate rules (internal policies approved by regulators), and the EU-US Data Privacy Framework (which U.S. companies can self-certify under instead of relying solely on SCCs).
Friction points cluster around specific jurisdictions. China’s PIPL requires a government security assessment for certain transfers. Some countries impose data localization requirements that restrict where payroll data can be stored. Companies that haven’t mapped their payroll data flows often discover — after an audit or a breach — that they moved data without the required legal mechanism. According to guidance from PayDD, every payroll disbursement in a compliant infrastructure passes through a multi-layer sanctions screening engine before funds leave the clearing network — beneficiary accounts are cross-referenced in real time against OFAC, UN, and EU sanctions lists across 150+ jurisdictions, with each screening logged and timestamped. That’s the kind of operational detail worth asking a provider about directly.
What Happens When Security Fails
The threats to payroll data aren’t hypothetical. Seven recurring security issues show up repeatedly: phishing attacks, insider threats, weak passwords, outdated software, ransomware, 1099 attacks, and payroll diversions. Each can expose wages, bank details, and personal data. The underlying weakness is often unpatched systems combined with human error — attackers use public sources like LinkedIn to identify payroll staff and pay schedules before launching phishing or diversion attempts.
A well-documented example comes from the Hamburg Data Protection Authority, which fined H&M €35.3 million in 2020 after managers at a service center collected and stored employee health details, family situations, and religious beliefs — accessible to up to 50 managers — and used that information in employment decisions. That case, cited in employborderless’s analysis, illustrates how even a large, established company can mishandle the special category data that payroll systems often contain.
On the prevention side, cloud-based payroll platforms typically apply encryption at rest and in transit, multi-factor authentication, automated backups, and regular security audits by default. But employers shouldn’t assume these controls exist — they should ask providers to document them directly. The security strategies outlined in the employborderless material include role-based access limits (full access for payroll administrators, view-only for others), employee training to recognize phishing, and incident response plans that account for multiple jurisdictions at once — because GDPR requires notification within 72 hours of discovering a breach, while other regulations run different timelines.
What to Ask a Provider Before You Sign
Data privacy should be a core evaluation criterion when choosing a payroll provider, PEO, or employer of record. The provider becomes a data processor handling sensitive employee information across jurisdictions, and any privacy failure by the provider stays the employer’s legal liability. Outsourcing work does not outsource accountability.
Based on the evaluation frameworks from employborderless and Pio, here are the questions worth asking:
- Server location: Where does the provider store payroll data, and does that location align with data localization rules in your operating countries?
- Certifications: ISO 27001 and SOC 2 are the most widely recognized security certifications — ask for proof, not promises.
- Cross-border transfer mechanism: Does the provider rely on SCCs, an adequacy decision, or the EU-US Data Privacy Framework? Does the mechanism match the countries where your employees are based?
- Data processing agreement: Does the provider offer a DPA that meets GDPR requirements and clearly defines each party’s responsibilities?
- Employee data access requests: How does the provider handle requests from employees to access, correct, or delete their own payroll data?
- Sanctions screening: For providers handling cross-border payments, ask whether every transaction is screened against sanctions lists in real time — and whether those screens are logged.
An employer of record or global payroll provider can be a practical route for handling these obligations at scale, putting local compliance expertise inside the transfer rather than leaving your team to interpret six regulations at once. But that only works if you’ve vetted the provider’s infrastructure thoroughly before signing.
Your Own Data Hygiene Still Matters
Even with a strong provider, your internal practices determine how much risk you carry. Data minimization is the simplest safeguard: collect only the payroll data a specific purpose requires, and don’t keep old bank details or passport copies once verification is complete. Less data stored means less exposed in a breach.
Retention schedules need to account for the longest requirement across all your operating countries. Tax records generally need to be kept six to seven years; basic payroll information like hours worked and pay rates is usually retained three to five years. When you dispose of data, use certified destruction methods — deleting files isn’t enough if backups exist elsewhere.
Incident response planning should be payroll-specific, covering detection, containment, notification, and recovery across multiple jurisdictions simultaneously. Assign a specific person or team to track regulatory changes — India’s DPDPA rules are still being finalized, new U.S. state privacy laws keep appearing, and GDPR guidance gets updated regularly. Compliance is a continuous task, not a one-time project.
Fraud prevention also depends on your own procedures. Verify any direct deposit change request through a second channel before processing. Restrict who can approve 1099 or contractor payments. Train staff to recognize impersonation and lookalike-domain tactics behind payroll diversions.
If all of this feels like a lot, that’s because it is. Cross-border payroll touches data protection law, tax law, employment law, and security operations all at once. But the alternative — assuming a provider will handle everything and finding out otherwise during a breach investigation — is far worse.
There’s a genuine open question about how long the current patchwork of privacy frameworks will persist. The EU and U.S. are moving toward more structured data transfer agreements, but China’s PIPL and India’s DPDPA are going in their own directions. A provider that can demonstrate compliance today may not be able to tomorrow without active monitoring and adaptation.
You don’t need to become a data privacy expert to run a remote team. But you do need to know which questions to ask, which documents to demand, and which internal habits to keep. The provider handles the processing; you still own the responsibility. Treating that distinction as a real one — not a technicality — is what separates a compliant payroll from a ticking liability.