Introduction
An HR Information System (HRIS) can give an organisation one reliable source of employee information. It can improve payroll control, automate approvals, support self-service and make workforce reporting faster.
It also concentrates valuable personal data in one environment.
Depending on the modules used, an HRIS may contain identity numbers, contact details, bank information, compensation, tax records, medical information, family details, performance ratings, disciplinary records, location data and employee biometrics.
The question is therefore not only whether the system can store employee data. It is whether the employer can demonstrate that the data is collected for a lawful purpose, limited to what is necessary, accessed only by authorised people, retained for an appropriate period and protected throughout its lifecycle.
For employers in Kenya, HRIS implementation must be considered alongside the Data Protection Act, 2019, its regulations and guidance from the Office of the Data Protection Commissioner (ODPC).
Why Employee Data Requires Particular Care
An employee cannot simply avoid the organisation’s HR processes. They must provide certain information to receive pay, benefits, statutory registration and other employment services. This creates a significant responsibility for the employer.
Some HR data is also classified as sensitive personal data. Kenya’s Data Protection Act includes health status, biometric data, marital status and family details among sensitive categories. Unauthorised disclosure could expose an employee to discrimination, identity theft, financial loss, embarrassment or other harm.
Digital systems can improve protection by reducing uncontrolled files and providing access logs. However, digitisation also introduces risks such as excessive access, compromised accounts, insecure integrations, unsuitable vendors, cyber incidents and cross-border transfers.
The answer is not to avoid HR technology. It is to implement privacy and security deliberately.
Understand the Employer’s Role as Data Controller
In most HRIS arrangements, the employer determines why and how employee information is processed. The employer is therefore ordinarily the data controller. A cloud HRIS provider that processes the information on the employer’s instructions will ordinarily act as a data processor.
Outsourcing the technology does not outsource accountability. The Data Protection Act, 2019 requires a controller using a processor to select one that provides sufficient organisational guarantees and to enter into a written contract governing the processor’s instructions and obligations.
The contract should address:
A standard software subscription agreement should not be accepted without checking whether it deals adequately with employee data.
10 Employee Data-Protection Requirements for an HRIS
1. Map the Employee Data You Hold
An organisation cannot protect information it has not identified.
Prepare a data inventory showing the categories collected, their sources, purposes, system locations, users, recipients, retention periods and whether they leave Kenya. Include recruitment records, employee files, attendance devices, payroll applications, performance tools, medical-benefit records, shared drives and archived data.
This exercise often reveals duplicate data, unnecessary copies and informal tools that sit outside the official HRIS.
2. Establish a Lawful Purpose and Basis for Processing
Do not treat employee consent as a universal answer. Employment creates an imbalance of power, and consent must still be specific, informed and freely given.
Depending on the activity, processing may instead be necessary to perform the employment contract, meet a legal obligation, protect vital interests or pursue a legitimate interest that does not unjustifiably override the employee’s rights.
Document the applicable purpose and lawful basis for each important processing activity. A general statement that “HR needs the data” is insufficient.
3. Provide a Clear Employee Privacy Notice
Employees should understand:
The notice should use clear language and be provided at an appropriate point, such as recruitment, onboarding or before introducing a new monitoring or biometric process. It should be updated when processing changes materially.
Transparency does not mean revealing confidential security configurations. It means giving employees enough information to understand the use of their data.
4. Collect Only What Is Necessary
An HRIS with many available fields can tempt an employer to collect information “in case it becomes useful.” This conflicts with data minimisation.
For every field, ask:
Do not copy every document from an old personnel file into the new system without reviewing its relevance, accuracy and retention requirement.
5. Apply Role-Based Access and Segregation of Duties
Being a manager should not provide unrestricted access to employee records. Users should see only the data required for their responsibilities.
For example, a line manager may need access to team leave, attendance and performance information but not bank accounts or another employee’s disciplinary documents. Payroll staff may need salary and deduction data but not unrestricted access to medical information.
Access controls should cover viewing, editing, downloading, approving and deleting. Privileged administrator accounts require particular oversight. Access should be reviewed periodically and removed promptly when a user changes role or leaves the organisation.
6. Build Security Into the Implementation
Security is broader than a password. The organisation and provider should consider:
The appropriate controls depend on the sensitivity, volume and risk of the data. The Act requires data protection by design and by default, meaning safeguards should be considered when the processing is designed—not added only after an incident.
7. Treat Biometric Attendance as High-Risk Processing
Fingerprints, facial images and other biometric identifiers are not ordinary attendance data. Biometrics are sensitive personal data and cannot simply be replaced if compromised.
Before introducing biometric attendance or access control, assess whether it is necessary and proportionate, what alternative methods exist, which biometric elements will be stored and how inaccurate matches will be challenged.
The ODPC’s Guidance Note on Biometric Data identifies biometric processing as high risk and calls for a Data Protection Impact Assessment (DPIA) before processing. It also emphasises accuracy because an attendance error could lead to an incorrect salary deduction or employment decision.
Kenya’s Act requires a DPIA where processing is likely to result in high risk to individuals’ rights and freedoms. The assessment should examine necessity, proportionality, risks and planned safeguards. Relevant DPIA reports are submitted to the ODPC 60 days before processing.
8. Set and Enforce Retention Periods
“Keep everything forever” is not a defensible retention policy.
Different HR records may have different legal and operational retention requirements. Create a schedule covering applicants, active employees, former employees, payroll, leave, attendance, performance, disciplinary, medical and biometric records.
The HRIS should support deletion, anonymisation, archiving or restriction when the authorised period ends. The organisation must also understand whether information remains in backups, exports or vendor environments after deletion from the main interface.
Retention decisions should account for employment, tax, statutory, audit and possible legal-claim requirements. Specific periods should be confirmed against the laws and circumstances applicable to the record.
9. Review Hosting and Cross-Border Transfers
Cloud systems may store, back up or support data outside Kenya even when the provider is locally based. Ask where the production environment, disaster-recovery copies and support access are located.
The Data Protection Act places conditions on transfers outside Kenya, including appropriate safeguards. Sensitive personal data transferred outside Kenya attracts additional requirements. Employers should document the transfer mechanism, recipient, purpose, country, safeguards and employee information provided.
Do not accept “hosted in the cloud” as a complete answer. Cloud is a delivery model, not a location or a data-protection guarantee.
10. Prepare for Employee Rights and Data Breaches
Employees have rights under the Act, including rights to be informed, access personal data, object to certain processing and seek correction or deletion of false or misleading information.
The organisation needs a documented process for receiving, verifying, assessing and responding to requests. HR, IT, legal or the data-protection lead should know who coordinates the response and which exceptions or record-preservation duties may apply.
The organisation also needs a tested incident-response plan. Where unauthorised access or acquisition creates a real risk of harm, the controller must notify the ODPC without delay and within 72 hours of becoming aware.
A processor must notify the controller without delay and, where reasonably practicable, within 48 hours. The ODPC provides an official data-breach reporting process.
An incident plan should identify who investigates, contains the breach, preserves evidence, assesses harm, communicates with affected people and makes regulatory notifications.
Registration and Data-Protection Governance
Employers should assess whether they must register with the ODPC as data controllers, while HRIS and payroll providers should assess their processor obligations.
The ODPC’s current registration guidance and FAQs explain the applicable thresholds and non-exempt categories. The general exemption refers to entities with annual turnover or revenue below KES 5 million and fewer than 10 employees, but listed processing categories may remain subject to mandatory registration regardless of size.
Registration is not the same as full compliance. Organisations still need lawful processing, privacy notices, access controls, retention rules, vendor governance, incident management and employee-rights procedures.
Organisations whose core activities involve regular and systematic monitoring or sensitive personal data should also assess whether to designate a data-protection officer. Responsibility should be visible even where a full-time role is not required.
HRIS Data-Protection Due-Diligence Checklist
Before contracting a provider, ask:
Due-diligence area | Evidence to request |
Roles | Controller, processor and subprocessor responsibilities |
Data location | Hosting, backup and support-access locations |
Access | Role permissions, privileged access and audit logs |
Security | Encryption, authentication, monitoring and testing practices |
Continuity | Backup frequency, restoration tests and recovery commitments |
Incidents | Breach escalation, notification timelines and contact points |
Retention | Deletion, backup expiry and post-termination treatment |
Employee rights | Support for access, correction, restriction and export requests |
Biometrics | Necessity assessment, templates, accuracy, DPIA and deletion controls |
Exit | Data export, return, verified deletion and transition support |
Where the answers affect material risk, request contractual commitments rather than relying only on sales statements.
Where ACCUREX and PiPO HRIS Fit
PiPO HRIS is the proprietary workforce technology platform of ACCUREX Human Capital Hub Limited, supporting interconnected workforce processes through Hire, Manage, Payroll, Performance, Engage and Tickets.
PiPO HRIS should be assessed against the same data-protection questions set out in this guide. A responsible implementation begins by defining the employer’s purposes, data categories, access roles, retention rules, workflows and risk controls before configuration.
ACCUREX can support organisations with HR data mapping, readiness assessments, process design, access-role definition, employee-record clean-up and implementation governance. Where specialist legal or cybersecurity interpretation is required, those advisers should be incorporated into the project.
This keeps compliance from becoming a final-stage checklist and builds it into the HR operating model from the beginning.
Employee Trust Is Part of HRIS Success
Employees are more likely to use an HRIS when they understand what information is held, why it is required and how it is protected. Transparency and proportionate controls therefore support adoption as well as compliance.
The strongest HR technology strategy does not choose between accessibility and protection. It gives authorised users the information they need while preventing unnecessary collection, access, retention and disclosure.
To discuss an HRIS readiness assessment or tailored PiPO HRIS demonstration, visit ACCUREX or PiPO HRIS, email hello@pipohris.io, or call +254 715 767 676.
This article provides general information and is not a substitute for legal advice on a specific organisation, processing activity or incident.
Frequently Asked Questions
Is an Employer a Data Controller When Using an HRIS?
Ordinarily, yes. The employer normally determines why and how employee data is processed, while the HRIS provider may process the information on the employer’s instructions.
The contract and actual conduct should confirm the roles.
Does an Employee Have to Consent to All HR Data Processing?
No. Consent is one possible lawful basis, but employment-related processing may also rely on contractual necessity, legal obligations or other grounds recognised by law.
The appropriate basis should be identified for each purpose.
Is Biometric Attendance Legal in Kenya?
Biometric attendance is not automatically prohibited, but it involves sensitive, high-risk processing.
The employer should establish necessity and proportionality, provide transparency, complete the required DPIA and implement heightened accuracy, security, access and retention controls.
Must Employee Data Be Stored in Kenya?
Not every category is automatically restricted to Kenya. However, cross-border transfers must meet legal conditions, and certain processing may be subject to localisation or additional safeguards.
Employers should verify where all copies are stored and obtain advice for sensitive or complex transfers.
Is ODPC Registration Enough to Make an Employer Compliant?
No. Registration is one obligation.
Compliance also requires lawful and transparent processing, data minimisation, security, retention controls, employee-rights procedures, suitable processor contracts and breach readiness.
With over 10 years in the HR arena, I'm not just seasoned; I'm practically marinated in success, specializing in turning chaos into controlled creativity. Change management, employee engagement, and training and development are my playground, and I play to win.
