GDPR checklist for hr & payroll tools.
HR and payroll tools hold some of the most sensitive data a company keeps: contracts, salaries, bank details, absences and sometimes health information. Compare 21 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 BambooHR | Usually a processor | Set per account or project | Published by the vendor |
 Personio | Usually a processor | Usually European Union | Published by the vendor |
 HiBob | Usually a processor | Set per account or project | Obtained through the vendor |
 Deel | Depends on the activity | Set per account or project | Published by the vendor |
 Remote | Depends on the activity | Set per account or project | Published by the vendor |
 Rippling | Usually a processor | Set per account or project | Obtained through the vendor |
 Lattice | Usually a processor | Set per account or project | Published by the vendor |
 Culture Amp | Usually a processor | Set per account or project | Published by the vendor |
 15Five | Usually a processor | Often United States, check your account | Published by the vendor |
 PayFit | Usually a processor | Often European Economic Area, check your account | Published by the vendor |
 Leapsome | Usually a processor | Set per account or project | Published by the vendor |
 Workleap Officevibe | Usually a processor | Set per account or project | Published by the vendor |
 Oyster | Depends on the activity | Usually Ireland | Published by the vendor |
 Paycor | Usually a processor | Set per account or project | Published by the vendor |
 ADP | Usually a processor | Set per account or project | Obtained through the vendor |
 Workday | Usually a processor | Set per account or project | Obtained through the vendor |
 CharlieHR | Usually a processor | Set per account or project | Published by the vendor |
 Kenjo | Usually a processor | Usually Germany | Obtained through the vendor |
 Sesame HR | Usually a processor | Often France and Germany, check your account | Published by the vendor |
 Humaans | Usually a processor | Often European Union, check your account | Published by the vendor |
 Sympa | Usually a processor | Often European Union (Netherlands and Ireland), check your account | Obtained through the vendor |
What to check for hr & payroll tools
- Limit access to HR and managers who need it, and review it when someone leaves.
- Set retention periods per record type: payroll and contracts often have legal minimums, candidates and former staff do not keep forever.
- Check where the data is hosted and any transfer outside the EEA.
- Tell employees which tool holds their data in your staff privacy notice.
All hr & payroll tools
- BambooHRHR & payroll
- PersonioHR & payroll
- HiBobHR & payroll
- DeelHR & payroll
- RemoteHR & payroll
- RipplingHR & payroll
- LatticeHR & payroll
- Culture AmpHR & payroll
- 15FiveHR & payroll
- PayFitHR & payroll
- LeapsomeHR & payroll
- Workleap OfficevibeHR & payroll
- OysterHR & payroll
- PaycorHR & payroll
- ADPHR & payroll
- WorkdayHR & payroll
- CharlieHRHR & payroll
- KenjoHR & payroll
- Sesame HRHR & payroll
- HumaansHR & payroll
- SympaHR & payroll
Go online for free. Grow when you need to.
Free puts you online. Pro adds requests, domains and your team; Business, your brand only.
Free
$0 forever
No card, no time limit
For getting compliant and going online on your own.
Start for freeKey features:
- Privacy and cookie policies
- Vendor and processing registers
- Requests and breaches tracked
- Impact assessment screening
- Privacy center on privacyboard.io
- Cookie banner on 1 domain
- 1 person
No card needed
ProRecommended
$32 per month
Billed $384 a year Save $84
For taking requests, covering all your sites and working as a team.
Start with ProEverything in Free, plus:
- DPA for your clients
- PDF and Excel exports
- Email reminders
- Request form and replies
- Your own domain
- Banner on 3 domains, every choice logged
- Weekly site scan
- Complete DPIAs and TIAs
- AI assistant connector
- Up to 5 people, with roles
Cancel any time
Business
$109 per month
Billed $1,308 a year Save $240
For proving it to customers and auditors, under your brand only.
Start with BusinessEverything in Pro, plus:
- No Privacyboard mention
- Security section and vendor alerts
- Evidence pack in one click
- Banner on 10 domains, daily scan
- Up to 50 people
- Two-step verification required
- Activity log kept 3 years
Bank transfer on request
Questions, answered.
What should I check before using a hr & payroll tool under the GDPR?
Limit access to HR and managers who need it, and review it when someone leaves. Set retention periods per record type: payroll and contracts often have legal minimums, candidates and former staff do not keep forever. Check where the data is hosted and any transfer outside the EEA. Tell employees which tool holds their data in your staff privacy notice.
Do I need a data processing agreement with a hr & payroll provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which hr & payroll tools does Privacyboard cover?
BambooHR, Personio, HiBob, Deel, Remote, Rippling, Lattice, Culture Amp, 15Five, PayFit, Leapsome, Workleap Officevibe, Oyster, Paycor, ADP, Workday, CharlieHR, Kenjo, Sesame HR, Humaans, Sympa. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.