Payroll Mistakes, Switching Problems and Official Sources
Payroll record retention and employee privacy in Canada: what your HR software must keep and protect
How long to keep payroll records in Canada (ITA s. 230, ROEs, employment standards), which privacy law covers employee data, and vendor terms.
Canadian employers must generally keep payroll records for six years from the end of the last tax year to which they relate under section 230 of the Income Tax Act, and in an electronically readable format if kept electronically; Service Canada asks for ROE-related payroll records to be kept for six years after the year they relate to; and each province's employment standards law sets its own retention period for wage, hours and vacation records. Employee personal information in payroll and HR systems is protected by PIPEDA only for federally regulated employers; provincially regulated employees are covered by provincial private-sector laws in Alberta, British Columbia and Quebec, and elsewhere by a patchwork of other rules. Either way, a payroll or HR vendor is processing sensitive data on your behalf, so you remain accountable and should require security, breach notification and export terms in the contract.
This guide is part of common payroll mistakes and official sources. It is general information, not legal advice.
How long to keep what
| Record | Retention rule | Source |
|---|---|---|
| Payroll books and records supporting deductions and remittances | 6 years from the end of the last tax year they relate to | Income Tax Act s. 230(4)(b) |
| Electronic records | Kept in an electronically readable format for the same period | Income Tax Act s. 230(4.1) |
| Records supporting ROEs (insurable hours and earnings) | 6 years after the year to which the information relates | Service Canada ROE guide; Employment Insurance Act |
| CPP and EI records | Generally the same six-year approach | Canada Pension Plan and Employment Insurance Act |
| Wage, hours, vacation and other employment standards records | Varies by jurisdiction, often a few years after the work or after employment ends | Provincial employment standards laws; Canada Labour Code |
| Ontario job postings (employers with 25+ employees) | 3 years after the posting is taken down | Ontario ESA requirements in force from 2026 |
| Quebec payroll records | Revenu Québec's own rules | Revenu Québec |
The six-year period can be longer in some cases (for example when a return was filed late, or the CRA has asked you to keep records longer). Records cannot be destroyed early without CRA permission.
Illustrative example. Records for pay in the 2026 calendar year relate to the 2026 tax year, so under s. 230(4)(b) they should be kept until at least 31 December 2032. If your contract with a payroll vendor ends in 2028, you need your own copy of 2026–2028 records that you can still read in 2032.
What that means for software
- Export at exit: pay registers, YTD reports, T4 and ROE history, remittance reports and employee master data in readable formats (PDF for reports, CSV for data). Test an export before signing.
- Archive access: some vendors offer read-only access after cancellation, sometimes for a fee. Know the cost and how long it lasts.
- Format: if you keep electronic records, they must stay readable. A proprietary backup you cannot open in six years does not meet the purpose.
- Location: records generally must be kept at your place of business or residence in Canada unless the CRA allows otherwise; electronic records held outside Canada must be accessible from Canada and available to the CRA on request. Check the CRA's guidance on keeping records.
See contract renewal and exit terms for the clauses to request.
Which privacy law covers employee data?
| Employer | Law that covers employee personal information | Regulator |
|---|---|---|
| Federally regulated (banks, telecom, airlines, interprovincial transport, etc.) | PIPEDA | Office of the Privacy Commissioner of Canada |
| Provincially regulated, in Alberta | Personal Information Protection Act (PIPA) | Office of the Information and Privacy Commissioner of Alberta |
| Provincially regulated, in British Columbia | Personal Information Protection Act (PIPA) | Office of the Information and Privacy Commissioner for BC |
| Provincially regulated, in Quebec | Act respecting the protection of personal information in the private sector (as amended by Law 25) | Commission d'accès à l'information |
| Provincially regulated, elsewhere | PIPEDA generally does not cover employee information of provincially regulated employers; other laws (for example employment standards, health information laws, common law and, in Ontario, the ESA electronic monitoring policy requirement) apply | Varies |
Even where no privacy statute applies to employee data, good practice (and often contractual and insurance requirements) follows the same principles: collect only what you need, protect it, limit access, and dispose of it securely after retention ends.
What to require from a payroll or HR vendor
| Topic | Ask for |
|---|---|
| Security | Encryption, access controls, multi-factor authentication for admins, independent security audit report (for example SOC 2 Type II) |
| Location | Where data and backups are stored and from where support staff can access it |
| Sub-processors | List of sub-processors and notice of changes |
| Breach notification | Prompt notice to you of any breach affecting your data, with details you need for your own reporting |
| Access by your staff | Role-based permissions (payroll, managers, employees) and audit logs |
| Retention and deletion | Your control over retention, deletion at end of contract, export first |
| Employee rights | Ability to give an employee access to, or correction of, their information |
Under PIPEDA and the provincial laws, an organisation that transfers personal information to a service provider remains accountable and must use contractual or other means to provide comparable protection. Breaches creating a real risk of significant harm must be reported to the commissioner and affected individuals under PIPEDA (and similar rules apply in Alberta and Quebec). In Quebec, communicating personal information outside Quebec, including to a cloud vendor, requires a privacy impact assessment first; see Quebec payroll.
Practical steps for employers
- Give payroll admin rights only to people who run payroll; managers see only their teams.
- Turn on multi-factor authentication for admin and manager accounts.
- Require approval for employee banking changes.
- Record what you keep, where, and when it will be deleted.
- Before the contract ends, export everything you must keep for six years.
Setting up permissions and exports is part of implementation; see implementation failure patterns and switching payroll providers mid-year.
FAQ
Can I keep payroll records only in the cloud?
Yes, electronic records are allowed if they are complete, readable and accessible for the retention period, and available to the CRA on request. Make sure you will still have access after the vendor contract ends.
Do I need employee consent to use a payroll provider?
Generally, using a service provider to process payroll is a normal part of the employment relationship, and privacy laws focus on notice, purpose and safeguards rather than separate consent. Tell employees which provider holds their data, especially in Quebec. Get advice for your jurisdiction.
What about SINs?
Collect the SIN because you need it for payroll and tax reporting, and protect it closely. Do not use it as an employee ID or display it in HR screens where it is not needed.
Is Bill C-27 law?
No. Bill C-27, which would have replaced PIPEDA's private-sector rules, died when Parliament was prorogued in January 2025. Any successor bill should be checked on the Parliament of Canada website before you rely on it.
Sources
- Justice Laws Website — Income Tax Act s. 230; PIPEDA
- Canada Revenue Agency — keeping records, electronic records
- Employment and Social Development Canada — ROE record retention
- Office of the Privacy Commissioner of Canada — PIPEDA, breach reporting, service providers
- Office of the Information and Privacy Commissioner for British Columbia — BC PIPA
- Commission d'accès à l'information du Québec — Quebec private sector privacy law
