A manager uploads a passport copy for a new starter, payroll imports bank details and an employee submits a medical certificate for sick leave. These are routine HR tasks, but they raise the same question: which HR data needs encryption? The short answer is that almost all personal data in an HR system deserves protection, while certain categories require a higher standard of care because the harm from exposure is greater.
For a growing business, encryption should not be treated as a technical box for IT to tick. It is part of how HR protects employee trust, limits the impact of an incident and demonstrates responsible data handling under GDPR. The practical challenge is deciding where encryption is needed, how strong it should be and what questions to ask your software providers.
Which HR data needs encryption most urgently?
Encryption converts readable information into a format that cannot be understood without the correct key. It should protect data both while it travels between systems and while it is stored in databases, documents, backups and devices.
As a baseline, encrypt personal data held in HR systems in transit and at rest. GDPR does not state that every item of personal data must always be encrypted. It does, however, requires organisations to apply appropriate technical and organisational measures based on the risk. In HR, that risk is often significant because records are detailed, long-lived and concentrated in one place.
The following data should be treated as a priority.
- Identity and contact data: names, home addresses, personal email addresses, telephone numbers, dates of birth, employee IDs, national insurance or social security numbers and passport or identity document details.
- Payroll and financial data: salary, bonuses, tax details, bank account numbers, expense claims, pension contributions and payslips.
- Special category personal data: health information, sickness records, disability adjustments, trade union membership, racial or ethnic origin, religious beliefs and biometric data where used for attendance or access.
- Employment and performance records: contracts, disciplinary notes, grievances, performance reviews, compensation decisions, right-to-work evidence and termination documentation.
Credentials also deserve separate attention. Passwords should never be stored in readable form. They should be securely hashed using an appropriate password-hashing method, while API tokens, recovery codes and encryption keys require tightly controlled encrypted storage.
Risk is not the same for every field
Not every HR data field needs the same controls. A public work telephone number and a medical report are both personal data in context, but the consequences of disclosure are clearly different. This is where a risk-based approach helps small HR teams avoid either under-protecting sensitive records or making everyday work unnecessarily difficult.
The key considerations are sensitivity, volume, accessibility and potential harm. A spreadsheet containing one former employee’s work email is not equivalent to a database holding payroll records for 300 people. Likewise, a medical certificate may affect an employee’s privacy, employment prospects and relationship with their manager if mishandled.
Field-level encryption can be justified for particularly sensitive values, such as national identity numbers, bank details or health data. It adds protection if an application account or database export is compromised. However, it can also make reporting, search and integrations more complex. For many organisations, strong database encryption, encrypted document storage, role-based access and clear retention rules will be the right foundation, with field-level encryption applied where the risk warrants it.
Encryption must cover the full HR data journey
A common mistake is to confirm that an HR platform encrypts its database, then overlook the places data goes next. HR information regularly moves through payroll integrations, recruitment tools, expense systems, e-signature services, email attachments and spreadsheet exports.
Encryption in transit means using modern secure connections whenever data is accessed or transferred. This matters when an employee logs in from home, when a manager approves leave or when data passes through an integration. Encryption at rest protects information stored in production systems, file storage, audit logs and backups.
Backups deserve particular scrutiny. They often contain the same high-risk HR data as the live system but may be retained longer and accessed less frequently. Ask how they are encrypted, who can restore them, where they are stored and how long they remain available.
Exports are another weak point. A carefully protected HRIS can be undermined by an unencrypted CSV file saved to a shared drive or sent to the wrong recipient. Limit who can export sensitive information, record export activity and set a clear process for deleting files once their purpose is complete.
Encryption does not replace access control
Encryption is essential, but it does not stop an authorised user from viewing information they should not need for their role. If every line manager can open all salary data or absence notes, the problem is access design, not encryption.
HR teams should use role-based permissions that reflect real responsibilities. A payroll administrator may need bank and tax details. A line manager may need to approve leave but should only see enough information to manage their team. A recruiter might need candidate information but not compensation records for current employees.
Multi-factor authentication, audit logs and regular access reviews make encryption more effective. They help prevent unauthorised entry and provide evidence of who viewed, changed or exported data. This matters particularly during organisational changes, when people move roles or leave the business.
There is also a human dimension. Encryption cannot prevent an HR colleague from downloading a sensitive report to a personal device, nor can it correct an email sent to the wrong address. Training, documented processes and a culture of asking before sharing sensitive information remain necessary safeguards.
What to ask an HR software provider
When evaluating an HRIS, avoid accepting a broad statement that data is ‘secure’. Ask focused questions and expect clear answers in plain language.
Start with where data is hosted and whether the provider can meet your data residency requirements. For European SMEs, keeping HR data in an EU-based environment may support internal policy, customer expectations and cross-border compliance planning. Then ask whether each customer has a logically or physically isolated environment, how data is encrypted in transit and at rest, and how encryption keys are managed.
It is equally useful to ask about permissions, audit trails, backup encryption, incident response and deletion processes. A provider should be able to explain how it protects data throughout its lifecycle, not only in the primary application database.
Cognitis.cloud, for example, operates as a single-tenant PaaS with EU data residency, which can give organisations clearer isolation than a shared environment. Even then, your internal configuration matters: a well-designed platform still needs sensible roles, approved workflows and regular reviews from the customer side.
A practical encryption checklist for HR teams
Begin with a simple data map. Identify the HR data you collect, where it is held, which systems receive it, who can access it and how long it is retained. Do not forget folders, inboxes, legacy tools and locally saved reports.
Next, classify information by sensitivity. Health records, identity documents, payroll data and employee relations files should be marked as high-risk. Confirm that they are encrypted both in transit and at rest, including in backups and document storage.
Then review access. Remove former employees and outdated administrator accounts, minimise broad permissions and ensure that managers can see only the records needed to perform their role. Finally, test your processes. Can you identify a sensitive export? Can you revoke access quickly? Do you know what your provider would do if an incident occurred?
The goal is not to turn HR into a security department. It is to make the safe choice the normal choice, with one clear system of record rather than sensitive information scattered across inboxes, spreadsheets and disconnected tools.
Encryption works best when it is designed into everyday HR operations rather than added after a concern is raised. Start with the records that could cause the greatest harm if exposed, then make sure your people, processes and HR platform protect them consistently.
