Visma Software works closely with the Swedish Tax Administration and other agencies to continuously update the payroll system Payroll in accordance with Norway's laws and regulations. We have our own companies and teams that specialize in relevant legislation and regulations. Among other things, privacy legislation.

GDPR rules in the Norwegian payroll system, Payroll

In short, the payroll system Payroll meets the GDPR's (The General Data Protection Regulation) requirements for:

• Access control that ensures that the information is only available to those who have the rights to read or modify it.
• Integrity control that ensures the secure storage of electronic records.
• Both were able to secure and restore the availability of data.
• Payroll also does not require more personal data than is necessary to perform a process. For example, it is not necessary to show an employee's Social Security number for a manager to be able to approve an outlay or timesheet.

So what lies in these points?

You can role control access to data in the payroll system

With the role management in Payroll, you can easily set up who has access to what. First, define who will have administrator access. This is a parent access, which in turn can control which users should have access to what.

Then you can give individual users access to each individual company. This may be, for example, the administrator of the company, manager or employee. The data these users access is predefined in the system and recorded in order to comply with the GDPR's rules.

Payroll's HR feature gives you more detail-driven opportunities

The HR function has even more detailed access management, because there is often a desire to be able to control who should have access to what, based on the company's preferences.

Here, as an administrator, you can, for example, define what information an employee should be able to see and change about themselves, and what information they should be able to see about their colleagues. All in line with GDPR rules. If you choose to make changes here, remember to take a conscious position on who gets access to what, and how the configurations are set up in terms of departmental structure. It is important to avoid unwanted visibility.

Payroll requires only the most necessary information

When entering information about employees in the payroll system, it is required to fill in only those fields that are absolutely necessary for the correct execution of wages, and in order to correctly report to the authorities. You'll find several fields that can be filled out if your company thinks it's appropriate, but these fields are not required.

If you have connected employees to a specific manager in the system, that manager will only see information about their employees. In addition, managers will only see data that is relevant to the task that they are going to solve. If you change the manager of an employee, the former manager loses access to information about them.

System Provider Security Responsibilities

Computer security is usually about three basic elements. Confidentiality, integrity and availability of data.

In an online payroll system like Payroll, most of this responsibility is left to us who are the system provider. In Visma Softwares security program, certified according to the ISO 27001 standard, we have systems, processes and tools that reduce the risk of breakage of the three elements.

This is part of the entire development and operation of Payroll. We use advanced data centers, and several automated tools to quality-assure program code, both during development and in operation. The cloud service is constantly monitored to catch discrepancies. Firewalls, antivirus, secure networks and protection against denial-of-service attacks are a matter of course. In addition, Payroll and underlying infrastructure are continuously updated with security updates.

Automated multi-level backup ensures that data and systems can be restored in a short period of time, if some kind of discrepancy occurs.

What are your responsibilities?

It is the company's own responsibility to provide management of user access, and ensure that the correct data is entered into the system. It is also the company's responsibility to keep track of what personal data you process in the system.

You can read more about our security program at Visma Trust Centre here, or contact us for a safety chat. Please feel free to contact our Head of Security, Stian Estil by email stian.estil@visma.com.