Why is salary data sensitive?
Pay is one of the most personal facts an employer holds. When it leaks, trust falls fast. Staff compare themselves with colleagues. A small gap that has a good reason looks unfair without context. In some places, a leaked salary can also put a person at risk, for example when staff pay is far above local norms.
Salary data also sits close to other private facts, such as bank details, family allowances and health benefits. A rule for who may see it is a basic data protection step.
Who needs to see salary data?
Ask one question for every person: “Can they do their job without it?” Here is a table most NGOs can adapt.
| Role | What they can see | Why |
|---|---|---|
| Staff member | Their own salary and benefits | It is their data |
| Line manager | Grade range of each team member’s role | To propose reviews, not to set pay |
| HR lead | All individual salary records | Runs the pay process |
| Head of finance | Totals by project, grant and grade | Budgeting and donor reports |
| Executive director | Individual records, on request | Final approval of pay decisions |
| Board treasurer | Totals and the scale, not names | Oversight |
| Auditor | The records in scope, for a set period | Audit work |
Change the table to fit your organization. The point is that each line has a reason.
What is the difference between totals and individual records?
Finance often needs the cost of a post in a budget. That is not the same as needing to know that one named person earns a particular amount.
Where you can, share totals instead of individual figures. A report of “labour cost by project this quarter” answers most finance questions. When a group is very small, even a total can reveal one person’s pay. If a cohort has only one or two people, do not show a figure for it. A common safeguard is to hide any group below a minimum size, such as five people.
How do you write the access rule?
- List the data. Salary, grade, allowances, benefits, bonus, loans and bank details. Each may need its own rule.
- Name the roles, not the people. “HR lead” stays valid when the person changes.
- State the reason for each role. If you cannot, remove that access.
- Name the owner. One person approves requests for access.
- Set a review date. Twice a year is a good rhythm, and also after any restructure.
- Say what happens on a breach. Who is told, and in how long.
Keep the document short enough that managers read it.
How do you keep access under control over time?
Access grows quietly. A person changes jobs and keeps the old permission. An assistant covers for a manager and the cover is never taken back.
Three habits stop this:
- Remove access on the day a role changes, as part of the move checklist. Our article on the offboarding checklist covers the exit side.
- Keep a log of who opened salary records, and read it from time to time.
- When someone covers for a colleague, give a time limit and a named end date.
What about pay equity reports?
Leaders and boards often want to know if pay is fair between women and men, or between offices. You can answer this without showing names. Use grade, gender and length of service in a summary table, and hide any group too small to stay anonymous. If a gap appears, look at role and grade first, then at where people sit within their range. For how grades work, see how to set up pay grades and a salary scale.
What should you tell staff?
Secrecy about the rule makes people suspicious. Tell staff how the rule works, even though individual figures stay private: who can see pay, why, and how to ask if they think their own record is wrong. Share the grade ranges so people can see where they sit. Staff who understand the rule are less likely to guess, gossip or take offence.
Where EMPOBase fits
In EMPOBase, pay grades and salary records sit behind a dedicated compensation permission. A person without that permission cannot open them, even if they can open other HR records. Equity summaries hide any group of fewer than five people. Staff profiles also have per-section access, so a manager sees only the sections their role allows. EMPOBase does not log every read of every record, so keep your own rule for reviewing who holds the compensation permission. You can read more on the security page and in the documentation.