Can AI see my employees' payroll data, and should it?
Short answer
It can, but to keep the books it rarely needs to. A month of payroll books from six totals (gross pay, PAYE, employee and employer NI, pension, net pay) with no name in them. Staff names, NI numbers and bank details are personal data, and sick pay or union subscriptions can reveal health or trade union membership, which UK GDPR Article 9 treats as special category data. Give the AI the totals, keep the people in the payroll system.
What in payroll is sensitive
| Field | Personal data? | Special category? | Does the AI need it to book the month? |
|---|---|---|---|
| Total gross pay, PAYE, NI, pension | No, unless only one person is on payroll | No | Yes |
| Name, NI number, home address, bank details | Yes | No | No |
| Tax code | Yes | No | No |
| Statutory Sick Pay for a named person | Yes | Can reveal health | No |
| Trade union subscription deducted from pay | Yes | Reveals trade union membership | No |
Article 9 lets an employer process special category data for its duties in employment and social security law, and the Data Protection Act 2018, Schedule 1, paragraph 1 adds that you need an appropriate policy document for it. Both read on legislation.gov.uk, 5 November 2026. That covers running payroll; sending the same data to an AI for convenience is a new step you would have to justify. Note the first row: with one employee, even a total is that person's salary.
Worked example: the October payroll journal, no names
Priya's Ltd in Bristol has three staff. The payroll bureau's October summary shows these totals, and that is all her AI gets:
| Account | Debit | Credit |
|---|---|---|
| Wages and salaries | £7,500 | |
| Employer's NI | £690 | |
| Employer's pension contributions | £225 | |
| PAYE and NI owed to HMRC (£820 PAYE + £310 employee NI + £690 employer NI) | £1,820 | |
| Pension owed to the provider (£300 employee + £225 employer) | £525 | |
| Net wages owed to staff | £6,070 | |
| Total | £8,415 | £8,415 |
Net pay checks: £7,500 − £820 − £310 − £300 = £6,070. When the bank shows £6,070 to staff and £1,820 to HMRC, the AI matches them to the two liability lines. Figures are made up for the example; your bureau's summary gives the real ones. The AI never saw a name, a tax code or who was off sick.
If the AI does see staff data
- Plan: use a business plan whose terms include a data processing agreement; on Claude, the Commercial Terms incorporate Anthropic's DPA (seen 5 November 2026), consumer plans do not. More: do I need a DPA?
- Tell your staff: your privacy notice to employees should name the AI service as a recipient.
- Keep it short: payroll records are kept 3 years from the end of the tax year (GOV.UK); a chat history is not where they should live. See how long must I keep accounting records?
How Octobooks handles payroll and your AI
In Settings, Your AI, you choose what your own AI sees, and it holds for every tool of the connector:
| Setting | Payroll |
|---|---|
| Standard | your AI reads payroll like the rest of the books |
| Careful | staff appear as pseudonyms; NI numbers and bank details are left out; the figures stay |
| Private | payroll is closed to your AI; you run it in the web app |
Under the setting, Per kind of data, you can also set payroll alone to Ask each time or Never. Octobooks itself sends your books to no AI provider. Step by step: Data protection and your AI. A general summary, not legal advice.
More questions
- Is it safe and GDPR compliant to put my invoices and bank statements into ChatGPT or Claude?
- How long must I keep accounting records in the UK, and when can I delete them under GDPR?
- Do I need a data processing agreement (DPA) with my accounting software?
- Does my accounting software use my data to train AI? How to check in ten minutes
- What does UK GDPR mean for a small company's accounting data? Fee, record and the one trap