Employee data & security

The decision you are making

EOR services process salary, identity, bank and employment records. Start with the data flows for the service you will actually buy, then test the controls and commitments around them.

Map who does what with the data

The EOR may act as an independent controller for employment activities and as a processor for other services. Ask for the current privacy notice, data-processing terms and recipient list. Separate employer integrations from the provider’s own subprocessors.

• Types of employee data and purposes.
• Countries, hosting locations and onward transfers.
• Controller and processor roles for each service.

Read the scope of assurance

A certificate or audit can be useful evidence, but its entity, service scope, period and exceptions matter. Check access controls, authentication, encryption and backup arrangements in the documents you receive. A trust-centre badge is a starting point for that review.

• Legal entity and systems included in the report.
• Report date, validity and access conditions.
• Security controls available to your administrators.

Agree the incident and exit process

Ask when you would be notified of an incident and which information would be shared. Check how subprocessor changes can be challenged. Finally, establish which records are returned, retained or deleted when the service ends and why.

• Notification trigger and deadline.
• Investigation, cooperation and remedy responsibilities.
• Retention schedule and usable exports.

From the research: Deel

May2026 DPA Appendix1 treats EOR/Consulting employment data as Deel-controller processing, separate from the customer controller; it treats payroll, mobility and several other services as processor activities. Customer-directed integrations are not automatically Deel subprocessors and require customer arrangements. EOR data include employment, performance/grievance, equity and legally needed health/protected-characteristic data. Controller retention is service/legal need rather than a fixed universal period. Processor return/deletion obligations contain legal/impracticability exceptions and protection/blocking duties; do not apply all processor promises to every EOR-controller activity.

Read the full provider review →

From the research: Oyster

The current DPA is revised 4 February 2026. Oyster and customer are independent controllers of EOR worker and customer-account data. Oyster is processor for payroll-only, Intelligence and People Partner data; employees processing the customer own third-party data on customer systems do not make Oyster its processor. Product-specific roles should not be collapsed into a single EOR processor claim.

Read the full provider review →

From the research: Employment Hero

The live trust centre now advertises ISO27001:2022, ISO27701:2025, ISO27017/27018 and SOC2. A7August2026 provider announcement claims centrally managed ISMS/PIMS recertification/certification across product design/development/implementation/support as controller and processor. Catalogue lists August2025 SOC2Type2, professional indemnity/IT insurance certificates and2026 HR,Payroll,EHWork penetration tests. Certificate downloads expressly require an NDA; gated underlying reports were not obtained. Current public claims supplement dated older help articles but do not verify independent audit scope, exceptions, insurance limits or recovery commitments.

Read the full provider review →

Take this into your provider call

Who controls employee data for this service, where does it go, and how are incidents handled?

Give each shortlisted provider the same scenario and ask for the answer in the documents you will sign. Record the owner, any extra cost and what remains to be agreed. That makes the final comparison practical for HR, finance and the employee.