# Data Protection Impact Assessment (DPIA) — Payroll Processing

**Conducted by:** Data Protection Officer, AdvocatesConnect (U) Limited  
**Date:** 5 November 2026  
**Version:** 1.0  
**Legal basis:** Data Protection and Privacy Regulations, 2021 (SI 61 of 2021), Regulation 7  
**Related RoPA:** `RoPA-v1.md` (Processing Activity: Payroll)

---

## 1. Description of the processing

The HR Module of Suites by AdvocatesConnect enables subscribing law firms to compute employee salaries, statutory deductions (PAYE, NSSF, Local Service Tax), generate payslips, and maintain employment and payroll records. The firm is the Data Controller (as employer); AdvocatesConnect is the Data Processor.

Data processed: employee full name, National Identification Number (NIN), TIN, NSSF number, bank account or mobile money number, salary, allowances, deductions, next of kin, emergency contacts, leave records, and performance reviews.

## 2. Necessity and proportionality

Payroll processing is necessary for the performance of the employment contract and to satisfy statutory obligations under the Income Tax Act (PAYE), the National Social Security Fund Act, and the Local Governments Act (LST). The data collected is the minimum required to compute statutory deductions and produce compliant payslips. No additional data is collected beyond what is required for these purposes.

## 3. Assessment of risks to data subjects

| Risk | Likelihood | Severity | Risk level |
|---|---|---|---|
| Unauthorised access to employee financial data | Low | High | Medium |
| Loss of payroll records before statutory retention expires | Low | High | Medium |
| Incorrect statutory deductions causing financial harm | Medium | Medium | Medium |
| Re-identification of anonymised payroll reports | Low | Medium | Low |
| Cross-border transfer of employee data to hosting region | Medium | Medium | Medium |

## 4. Mitigation measures

- **Access control:** Role-based access; only authorised HR users and the firm administrator can view payroll records. MFA is available for administrator accounts.
- **Encryption:** TLS 1.2+ in transit; AES-256 at rest.
- **Multi-tenant isolation:** Payroll records are isolated per firm account through row-level security; one firm cannot access another firm's payroll.
- **Audit logging:** All payroll record views and modifications are logged.
- **Retention enforcement:** Payroll records are retained for duration of employment plus 10 years, then deleted or anonymised via the scheduled retention job (see `RetentionRunLog`).
- **Cross-border safeguards:** Hosting regions and processors are disclosed in the sub-processor list; transfers rely on Regulation 19 contractual safeguards (see `DPIA-CrossBorder-v1.md`).
- **Data minimisation:** Payslips expose only the fields required for statutory compliance.

## 5. Residual risk

After mitigation, residual risk is assessed as **low**. The remaining risk is the cross-border hosting of employee financial data, which is addressed by contractual clauses, encryption, and the safeguards described in the cross-border DPIA.

## 6. Conclusion

The payroll processing activity does not require consultation with the PDPO beyond this assessment. The controls in place are proportionate to the risk. This DPIA will be reviewed if the payroll processing scope changes materially or a new sub-processor is introduced.

*End of DPIA.*