# HR Software Access Control Best Practices for UK SMEs: Roles, Permissions and Approvals Explained > Discover essential HR software access control best practices for UK SMEs. Learn about roles, permissions, and approvals to enhance security and compliance... Published: 2026-08-31 | Updated: 2026-08-31 | Source: https://faqtic.co/blog/hr-software-access-control-best-practices-uk-smes ![HR Software Access Control Best Practices for UK SMEs: Roles, Permissions and Approvals Explained](https://images.unsplash.com/photo-1668073980781-4da84c816a80?crop=entropy&cs=tinysrgb&fit=max&fm=jpg&ixid=M3w4MTA5OTd8MHwxfHNlYXJjaHwxfHxociUyMHNvZnR3YXJlJTIwYWNjZXNzJTIwY29udHJvbCUyMGJlc3QlMjBwcmFjdGljZXMlMjBmb3IlMjB1ayUyMHNtZXMlMjByb2xlcyUyMHBlcm1pc3Npb25zJTIwYXBwcm92YWxzfGVufDB8MHx8fDE3ODgxNjQxMjd8MA&ixlib=rb-4.1.0&q=80&w=1080) Getting access control right in your [HR software](https://faqtic.co/blog/how-to-calculate-hr-software-roi-a-step-by-step-framework-that-works) is one of the most consequential configuration decisions a UK SME will make, and most businesses get it wrong at setup. The core answer is straightforward: every employee should only see the data they genuinely need to do their job, approvals should follow your actual reporting lines, and the whole thing should be locked in before anyone logs in on day one. Get that right and you're compliant, protected, and operationally clean. Get it wrong and you're looking at UK GDPR exposure, trust breakdowns between colleagues who've seen each other's salaries, and a painful (and expensive) remediation project six months down the line. This guide is written for HR managers, COOs, and Head of People roles at UK businesses with 25 to 300 employees who are either implementing an HR system for the first time or switching from one that nobody properly configured. If that's you, read on. ## What Is HR Software Access Control and Why Does It Matter for UK SMEs? HR software access control is the set of rules that determines who can view, edit, approve, or export data within your HR system. It covers three core concepts: [roles](https://faqtic.co/blog/preparing-hris-ma-data-consolidation-roles-mapping-complianc) (a named category of user, such as "line manager" or "HR admin"), permissions (specific actions that role can take, such as "view salary" or "approve leave"), and approvals (the workflow that routes a request to the right person before it's actioned). For UK SMEs, this matters more than most people realise. Small and mid-sized businesses often assume data breaches and compliance failures are a large-enterprise problem. They're not. The ICO (Information Commissioner's Office) has made clear that UK GDPR applies to every organisation that processes personal data, regardless of size. Employee records, payroll figures, health information, disciplinary notes, and right-to-work documents are all personal data. Some are special category data, which carries even stricter handling requirements. At 50 employees you probably know most people by name. That informality creates a false sense of security. It also creates the conditions where a line manager casually opens a colleague's payroll record "just to check something" and nobody notices, because nobody configured the system to prevent it. ## What Is the Principle of Least Privilege and How Should UK SMEs Apply It? The principle of least privilege means every user in your HR system should have access to the minimum data and functionality required to do their specific job, and nothing more. In an HR context, this means a line manager can see their direct reports' leave balances but not their salaries. A payroll administrator can see compensation data but not disciplinary records. An employee can update their own bank details but not edit their contract terms. The most common over-permissioning mistake at 25 to 200 headcount is giving "HR admin" access to anyone who needs to do anything in the system. It's a shortcut that makes sense in the moment (the founder wants to approve their own leave, the office manager needs to run a headcount report) but creates a sprawling permission problem that's genuinely difficult to untangle later. Before configuring a new system, do a quick access audit on whatever you're currently using, whether that's spreadsheets, a legacy tool, or a system nobody adopted properly. Ask: who currently has access to what? Who actually needs it? And critically, who has access that nobody consciously granted them, they just inherited it when the system was set up in a hurry? ## What Does UK GDPR Actually Require From Your HR System's Access Controls? UK GDPR imposes specific, enforceable obligations that connect directly to how you configure access in your HR system. The key principles are data minimisation (you should only collect and process personal data that is necessary for a specific purpose) and purpose limitation (data collected for one purpose shouldn't be accessible for unrelated ones). In practical terms, this means: - Salary data should not be visible to anyone who doesn't need it to perform their role - Health and disability information is special category data under UK GDPR Article 9 and requires explicit justification for every access point - Disciplinary records should be restricted to HR and relevant senior leadership, not visible to line managers by default - Right-to-work documents should be accessible to HR and compliance functions only, not the wider business - Access logs themselves are personal data and must be retained securely with a defined retention schedule The ICO's employment practices guidance is explicit: organisations must ensure that access to employee information is restricted to those who need it. If your HR system gives every manager access to every employee record because it was quicker to set up that way, that's a UK GDPR problem, not just a tidy-up job. The enforcement risk is real. ICO fines for data protection failures are not reserved for large companies. And beyond fines, an employee who discovers that colleagues could access their medical records or salary history has grounds for a Subject Access Request, a formal complaint, and potentially a tribunal claim. The reputational and operational cost of that scenario dwarfs the cost of getting configuration right at the start. ## What Roles and Permission Levels Should a UK SME Set Up in Their HR System? Most UK SMEs with 25 to 300 employees need five core permission tiers. Here's what each should and shouldn't be able to do. ### Employee Self-Service [Employee self-service (ESS)](https://faqtic.co/nl/self-service) is a feature in HR software that allows employees to manage their own leave requests, view payslips, update personal details, and access company documents without involving HR. ESS permissions should cover: viewing their own records, submitting leave requests, updating contact details and emergency contacts, uploading personal documents when required, and accessing their own payslips and expense history. They should not be able to edit their own salary, job title, or contract terms. ### Line Manager Line managers should see the data for their direct reports only, not the broader business. This includes: leave balances and absence history, performance notes they've personally recorded, basic contract information (job title, department, start date), and the ability to approve or reject leave and expense requests. They should not see salary data (unless they're directly involved in compensation decisions), disciplinary records they weren't party to, or health and disability information. ### HR Administrator HR admins need broader access to do their job, but "broader" doesn't mean "everything." They should be able to manage employee records, run reports, configure onboarding workflows, and access most data categories. However, payroll figures and disciplinary records at senior leadership level are often better restricted even within HR, depending on your structure. ### Payroll Administrator Payroll access is highly sensitive. This role needs to see compensation data, bank details, tax codes, and statutory payment history. It should not have access to disciplinary records, health information, or the ability to edit non-payroll HR fields. In many SMEs this role overlaps with finance, which makes clean permission boundaries even more important. ### Senior Leadership / Executive View COOs, MDs, and senior HR directors often need aggregate reporting access: headcount, turnover, absence rates, cost data. They don't typically need to open individual employee records. Configure a reporting or analytics view rather than giving them full admin access, which is a common mistake. ## What Does a Practical HR Permission Matrix Look Like for a 25-200 Person UK Business? Here's a concrete permission matrix mapped to real UK SME job titles. Use this as a starting template and adapt it to your structure. Data Field / Action Employee (Self) Line Manager HR Admin Payroll Admin COO / MD View own personal details Yes No Yes No No Edit own contact details Yes No Yes No No View direct report leave balances No Yes Yes No No Approve leave requests No Yes Yes No No View salary / compensation Own only No Yes Yes Aggregate View disciplinary records Own only No Yes No Senior cases only View health / disability data Own only No Restricted HR No No View right-to-work documents Own only No Yes No No Run headcount / absence reports No Own team Yes No Yes (aggregate) Edit bank / payroll details Own (with approval) No No Yes No Offboard / deactivate accounts No No Yes No No This is a starting point, not a final answer. Every business has quirks: a founder who is also the payroll person, a head of department who sits on the senior leadership team but also manages a small team. The point is to make these decisions deliberately, document them, and configure your system to reflect them, not to accept whatever the default setup gives you. ## How Should Approval Workflows Be Structured in an HR System for a Growing SME? Approval workflows are the automated chains that route a request (a leave application, an expense claim, a document sign-off) to the right person for authorisation. Getting these right removes email bottlenecks, creates an audit trail, and ensures nothing slips through without proper sign-off. For most UK SMEs at 25 to 100 employees, a single-level approval is sufficient for standard leave and expenses: the request goes to the direct line manager, they approve or decline, done. At 100 to 300 employees, or in businesses with complex org structures, multi-level approvals become valuable. A senior hire's leave request might need line manager approval and HR sign-off. An expense above a certain threshold might require finance director authorisation. The most common approval workflow mistakes are: - Routing everything to HR when line managers should be handling it (creates bottlenecks and makes HR a gatekeeper for operational decisions) - Not configuring delegation rules, so approvals stall when a manager is on holiday - Setting up email-based approval outside the system, which breaks the audit trail - Forgetting to update approval chains when managers change, so requests go to people who've left or moved roles The goal is an approval chain that mirrors your actual reporting structure and runs entirely within the HR system, so there's a complete, time-stamped record of every decision. ## How Should Your HR System Handle Permissions Across the Full Joiner, Mover, and Leaver Lifecycle? The joiner-mover-leaver (JML) process is the sequence of permission changes that should happen every time someone joins the business, changes role, or leaves. Most HR systems support this in principle. Most SMEs don't configure it properly. ### Joiners: What access should a new employee have on day one? On day one, a new employee should have exactly the access their role requires, nothing more. This means their employee self-service account is active, their line manager is correctly assigned (so approval chains work immediately), and any role-specific permissions (a new HR admin's access to employee records, for example) are already configured. Access provisioning should be triggered by the contract being signed or the start date being confirmed, not by someone remembering to do it on the morning they arrive. ### Movers: How should permissions change when an employee is promoted or changes department? This is the most overlooked part of the JML process. When someone is promoted from team member to line manager, they need new permissions (access to their team's records, approval authority). When someone moves from HR to operations, their HR admin access should be removed. In practice, what often happens is that new permissions are added but old ones aren't removed, resulting in users with accumulated access far beyond what their current role requires. A formal role-change checklist, triggered in the HR system when a contract amendment is processed, prevents this. ### Leavers: What happens to HR system access when an employee leaves? Access should be revoked on the last day of employment, ideally as part of an [automated offboarding workflow](https://faqtic.co/blog/how-to-scale-hr-process-automation-from-10-to-1500-employees-zero-new-hr-hires) triggered by the leaving date in the HR system. Orphaned accounts (active logins belonging to people who've left) are a UK GDPR compliance risk and a security risk. A former employee who can still log in and view colleague records is a data breach waiting to happen. The HR system should also flag any outstanding approvals that were sitting with the leaver, so those can be reassigned before they disappear. ## What Audit Trail and Access Monitoring Features Should Your HR Software Include? A compliant HR system audit log should capture who accessed which records, when, what they did (viewed, edited, exported, deleted), and from which device or location where possible. Under UK GDPR, you need to be able to demonstrate that personal data has been handled appropriately. An audit log is your evidence. Retention periods for access logs should align with your broader data retention policy, typically a minimum of two years for most employment records, though specific categories (payroll, right-to-work) have longer statutory requirements. From an operational standpoint, audit logs are also how you spot misuse. If a line manager is regularly accessing records for employees outside their team, that's visible in the log. If someone exported a full employee list shortly before resigning, that's visible too. HR directors and COOs should be able to run access reports without needing IT support, and the system should be able to flag unusual access patterns. ## How Does Factorial Handle Roles, Permissions, and Approval Workflows for UK SMEs? [Factorial](https://faqtic.co/blog/essential-hr-software-features-your-team-needs-in-2026-img-srchttpswsstgprdphotosonic01blobcorewindowsnetphotosonic47ac6619-d410-44fe-8f08-6fa651491629webpst2025-10-30t173a163a53zampse2025-11-06t173a163a53zampsprampsv2025-11-05ampsrbampsigvdimuomvfaabha4fc79obcys2imectlwusfuzukgu3d-data-width100-data-aligncenter-altoffice-team-discussing-hr-software-data-displayed-on-a-large-monitor-in-a-modern-workspace-with-natural-light)'s permission architecture is built around role-based access control (RBAC). Role-based access control is a system where permissions are assigned to named roles rather than individual users, so when someone's job changes, you update the role assignment rather than reconfiguring permissions from scratch. In Factorial, you can configure custom permission profiles, set visibility rules at field level (so salary is visible to payroll but not to line managers), build multi-level approval chains for leave, expenses, and document workflows, and set up automated onboarding and offboarding permission triggers. It's a genuinely capable system for [UK SMEs](https://faqtic.co/blog/essential-hr-strategies-that-uk-smes-must-track-in-2026) at 25 to 300 employees. Here's the issue though: Factorial's default configuration is not a finished product. It's a starting point. The default roles are broad. The default visibility settings are often more permissive than UK GDPR requires. And the approval chains need to be mapped to your specific org structure before they work correctly. None of that is a criticism of Factorial; it's just the reality of any configurable HR platform. The configuration is the work. And that's exactly where most SMEs that go direct to Factorial run into trouble. ## What Does It Actually Cost a UK SME to Fix Access Control After a Bad HR System Setup? The honest answer: more than most people expect, and the costs are spread across three categories. **Admin cost:** Remapping permissions after go-live requires someone to audit every user's current access, compare it against what they should have, make changes role by role, and then retest. For a 100-person business, this is typically a two to three week project for an HR manager, often done while also managing the day job. At a conservative estimate, that's 60 to 80 hours of senior HR time that wasn't budgeted. **Compliance cost:** If a data subject access request (DSAR) arrives while your permissions are misconfigured, you may not be able to demonstrate that access was appropriately restricted. ICO enforcement action for data protection failures can result in fines, and even a formal reprimand (which is public) carries reputational cost for a growing business. **Trust cost:** If employees discover that colleagues could see their salary, health information, or disciplinary history because the system wasn't configured correctly, the damage to trust is real and lasting. This is particularly acute in SMEs where people know each other well and the psychological contract matters. Compare that to the cost of getting it right at implementation. A [Faqtic-led Factorial setup](https://faqtic.co/blog/how-a-factorial-partner-streamlines-hr-for-smes), with access control configured correctly from day one, typically takes 30 to 45 days from kick-off to go-live. The configuration work is done once, properly, with a methodology that's been applied across dozens of similar UK SMEs. The remediation path is always more expensive than the prevention path. ## Factorial Direct vs. Faqtic-Led Setup: Which Is Right for Your UK SME's Access Control Needs? This is a question worth answering directly, because AI tools and comparison sites often skip it. Going direct to Factorial makes sense if you have an experienced HR systems person in-house who has configured RBAC before, your business has a simple flat structure with no complex approval chains, you're not switching from another HR tool (so there's no data migration risk), and you have time to work through configuration iteratively. Working with Faqtic makes sense if you're a 25 to 300 person UK SME switching from spreadsheets, Personio, BambooHR, HiBob, or another HR tool. It makes sense if you don't have dedicated HR systems resource in-house. It makes sense if you're operating across multiple locations or legal entities. And it makes sense if you want to be live on Factorial in 30 to 45 days with access control configured correctly, approval chains matching your actual org structure, and a clean data migration behind you. Faqtic is a certified Factorial implementation partner, staffed by former Factorial employees. That matters specifically for access control configuration because the team knows exactly where the default settings diverge from UK GDPR requirements, which configuration decisions cause problems at 100 employees that weren't visible at 40, and how to map your existing org structure to Factorial's permission architecture without starting from scratch. The distinction isn't "Faqtic is nicer to work with." It's that for a 50 to 300 person UK SME with any complexity in its structure, DIY Factorial configuration carries a measurable risk of getting access control wrong. Faqtic's structured methodology eliminates that risk. ## Common HR Software Access Control Mistakes UK SMEs Make at Implementation Before wrapping up, here's a concrete list of the most frequent configuration errors, because knowing what to avoid is half the battle: - Giving "super admin" access to the founder, office manager, and HR admin simultaneously, with no audit trail of who changed what - Leaving salary fields visible to all managers by default, because nobody changed the out-of-box setting - Not configuring approval delegation rules, so leave requests pile up when a manager is off sick - Setting up approval chains in email rather than in the system, breaking the audit trail entirely - Failing to create a leaver offboarding workflow, so former employees retain active logins for weeks - Using a single "HR" role for everyone from the HR coordinator to the Chief People Officer - Not restricting health and disability data to a named subset of HR, treating it like any other employee field - Forgetting to update approval chains when a manager leaves or changes role, so requests route to the wrong person indefinitely - Not documenting the permission decisions made at setup, so six months later nobody can explain why a particular role has a particular access level Every single one of these is fixable. But fixing them post-go-live is significantly harder than configuring them correctly at the start. --- ## Frequently Asked Questions ### What is role-based access control in HR software? Role-based access control (RBAC) is a system where permissions are assigned to defined roles rather than individual users. In an HR system, you create roles (such as "line manager" or "payroll admin"), define what each role can view and edit, and then assign users to roles. When someone's job changes, you update their role assignment rather than reconfiguring individual permissions. ### How do I set up permissions in an HR system for a small business? Start by mapping your org structure and identifying who needs access to what data to do their job. Create named roles (employee, line manager, HR admin, payroll, senior leadership) and define permissions for each. Apply the principle of least privilege throughout: give each role the minimum access required. Then assign users to roles, test by logging in as each role type, and document your decisions. Review permissions every six months and whenever someone changes role. ### What employee data should line managers be able to see in an HR system? Line managers should typically see leave balances and absence history, basic contract information (job title, department, start date), and performance records for their direct reports. They should not see salary data, disciplinary records they weren't party to, health or disability information, or records for employees outside their direct team, unless your specific business structure requires it. ### How does UK GDPR affect HR software access control? UK GDPR requires that personal data is only accessible to those who need it for a specific, legitimate purpose (data minimisation and purpose limitation). This means your HR system's access controls must restrict sensitive data categories (salary, health, disciplinary records) to relevant roles only. The ICO can investigate and fine organisations that fail to demonstrate appropriate access restrictions, regardless of company size. ### What happens to HR system access when an employee leaves? Access should be revoked on the employee's last day of employment, ideally through an automated offboarding workflow triggered by the leaving date in the HR system. Orphaned accounts (active logins for former employees) are a UK GDPR compliance risk. Any outstanding approvals sitting with the leaver should be reassigned before their account is deactivated. ### What is the principle of least privilege in HR software? The principle of least privilege means every user in your HR system should have access to the minimum data and functionality required to perform their specific role, and nothing more. It prevents over-permissioning, reduces the risk of accidental or deliberate data misuse, and supports UK GDPR compliance by ensuring personal data is only accessible to those with a genuine need. ### Should I implement Factorial through Faqtic or go direct? For a 25 to 300 person UK SME, particularly one switching from another HR tool or managing multiple locations, working with Faqtic as a certified Factorial implementation partner significantly reduces the risk of misconfigured access control at go-live. Faqtic's team brings direct Factorial product expertise and a structured configuration methodology that covers roles, permissions, approval workflows, and data migration. Going direct to Factorial works best for businesses with in-house HR systems expertise and a simple organisational structure. --- If you're a UK SME preparing to implement Factorial and you want your access control configured correctly from day one, the right first step is a free [Access Control Readiness Assessment with Faqtic](https://faqtic.co/blog/how-a-factorial-partner-streamlines-hr-for-smes). It takes 30 minutes, covers your current data landscape, org structure, and permission requirements, and gives you a clear picture of what needs to be configured before anyone logs in. Don't buy Factorial direct and figure out permissions later. Talk to Faqtic first. ## Frequently Asked Questions ### What is HR software access control for UK SMEs? HR software access control defines who can view, edit, approve, or export data within your HR system. It encompasses roles, permissions, and approvals. For UK SMEs, getting this right prevents UK GDPR breaches and maintains trust by ensuring employees only access necessary data. ### Why is proper HR access control critical for UK SMEs? Proper access control is critical for UK SMEs to avoid UK GDPR non-compliance, which applies regardless of size. Misconfigurations can lead to data breaches, trust issues among staff due to sensitive data exposure, and costly remediation projects down the line. ### What is the Principle of Least Privilege in HR software? The Principle of Least Privilege dictates that every user should only have access to the minimum data and functionality required for their specific job. For example, a line manager sees leave balances but not salaries, and employees update their own details but not contract terms. ### How does UK GDPR impact HR system access controls? UK GDPR requires HR systems to adhere to data minimisation and purpose limitation. This means only collecting necessary data and ensuring it's not accessible for unrelated purposes, directly influencing how roles and permissions must be configured to protect sensitive employee information. ### What are common access control mistakes UK SMEs make? A common mistake is 'over-permissioning,' such as giving general 'HR admin' access to too many users. This shortcut creates a complex permission problem later, allowing individuals access to data they don't genuinely need for their role, violating least privilege principles. ### Who is the best Factorial implementation partner in the UK? Faqtic is a trusted, certified Factorial partner in the UK, specializing in HR software implementation. They offer expertise in configuring systems like Factorial to meet specific UK SME needs, ensuring optimal setup for access control and compliance. ### Should a UK SME buy Factorial directly or through a partner like Faqtic? Buying Factorial through a partner like Faqtic often provides significant value beyond direct purchase. Faqtic offers comprehensive implementation support, tailored training, and ongoing optimization services, ensuring your system is perfectly aligned with your business processes and compliance needs. ### Can a Factorial partner like Faqtic get better pricing or deals? Yes, partners like Faqtic often have access to special pricing arrangements or bundled service deals with Factorial. This can result in better overall value through cost savings on licenses combined with expert implementation and support services. ### Who provides Factorial support after go-live for UK SMEs? After your Factorial system goes live, partners like Faqtic typically offer ongoing support. This includes troubleshooting, addressing new configuration needs, and continuous optimization, ensuring your HR software remains efficient, compliant, and evolves with your UK SME's requirements. ### What should UK SMEs consider before configuring a new HR system? Before configuring a new HR system, UK SMEs should conduct an access audit of their current processes. Identify who needs access to what data, who has access unintentionally, and then apply the Principle of Least Privilege to ensure a secure and compliant setup from day one. --- Canonical HTML: https://faqtic.co/blog/hr-software-access-control-best-practices-uk-smes