Reviewing a payroll or HR outsourcing agreement

Outsourcing payroll or HR moves the work but not the legal duty: the employer remains responsible to HMRC, to the pension regulator and to its own staff for what the provider does. The provider's agreement decides how much responsibility the provider takes for its own errors. I review the agreement from the employer's side and return it marked up with a written explanation of the changes and which ones a provider will accept, for a fixed fee of £495 in three working days.

Who this is for

Employers in England and Wales engaging a payroll bureau, an outsourced HR provider, an employer of record or a combined HR and payroll platform, and want the agreement to reflect the responsibility the provider is taking on and to protect employee data. The employer and the provider are businesses; employment and data protection law governs what the employer still owes its staff.

What to look for in a payroll or HR outsourcing agreement

The duties that stay with the employer

The employer remains responsible for operating PAYE under the Income Tax (Pay As You Earn) Regulations 2003, for pension enrolment and contributions under the Pensions Act 2008, for itemised pay statements under section 8 of the Employment Rights Act 1996, and for paying at least the rates set under the National Minimum Wage Act 1998. The agreement should therefore say exactly which of those tasks the provider performs, on what information and by what deadlines, and which remain with the employer. The review checks that the provider's obligations are stated as obligations, with the filing deadlines it will meet, rather than described as assistance.

Errors, late filings and who pays the penalty

Payroll errors produce underpaid staff, incorrect deductions and HMRC penalties and interest, and a provider's standard terms may limit its liability to re-running the payroll or to the fees for the month. The review asks for the provider to bear the penalties, interest and reasonable costs caused by its own error or late filing, for a cap that reflects the annual fee rather than a month's, and for a correction procedure with timescales. Where an error causes an unlawful deduction from wages under section 13 of the Employment Rights Act 1996, the claim is against the employer, so the indemnity needs to cover the cost of putting employees right.

Employee data and the provider as processor

Payroll and HR data include bank details, national insurance numbers, sickness absence and other health information, which is special category data under Article 9 of the UK GDPR and the Data Protection Act 2018. The provider processes it as the employer's processor, so the agreement must contain the Article 28 terms, and the review checks the security commitments, the location of the data and any sub-processors, the transfer mechanism under Article 46 for offshore processing, breach notification periods short enough for the employer to meet its 72-hour obligation to the ICO, and deletion or return of the data on exit.

Service levels, cut-off dates and changes to the law

The agreement should set the payroll calendar, the cut-off for the employer's input, the date the provider delivers payslips and reports, and the deadline for BACS submission, with what happens when the employer is late and when the provider is. The review checks that the provider commits to keeping the service compliant with changes in tax, national insurance and employment law at no extra charge, that HR advice given under an outsourced HR service is stated to be advice the employer can rely on, and that the provider carries professional indemnity insurance for it.

Fees, term, termination and getting the data back

Fees are per payslip or per employee with a minimum, plus set-up and year-end charges, and the review checks that increases are capped and notified. On exit the employer needs its payroll history, year-to-date figures, deduction records, pension files and HR records in a format the next provider can load, within a stated period and at no further charge, and the provider's cooperation with HMRC agent authorisation being transferred. The Late Payment of Commercial Debts (Interest) Act 1998 applies to the fees, and the review checks that the provider cannot withhold data or the final payroll for a disputed invoice.

What it costs

Standard review, £495. Marked-up document and a written explanation of the changes. Three working days.

Buying online forms the engagement on payment. The scope is what the contract review page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• Your own contract returned with my amendments as tracked changes, plus a clean version with every change accepted, ready to send to the other side
• Comments in the document where a point needs explaining
• A written explanation of what I have changed and why, by email or as an attachment if it is lengthy, marking the points I would hold firm on and the ones that are negotiable
• A view on what is normal market practice and what is the other side pushing their luck
• One round of follow-up questions by email, included

What is not included

• Negotiating directly with the other side, which I quote separately once I know who is on the other side. Where the other side is willing to share a live document, I can work in that document directly
• Drafting a replacement contract from scratch
• Advice on the law of any jurisdiction other than England and Wales
• Tax, accounting or regulatory advice
• Disputes about a contract that is already signed

Questions I am often asked

The provider made an error and HMRC has charged us a penalty. Can we recover it?

Only if the agreement makes the provider liable for penalties caused by its own error, and standard bureau terms do not. The review asks for an indemnity for penalties, interest and correction costs caused by the provider's error or late filing, with a cap set by reference to the annual fee.

Is the payroll company a processor or a controller of our staff's data?

A payroll bureau processing on your instructions is your processor, and the agreement must contain the terms Article 28 of the UK GDPR requires. Some HR platforms also use the data for their own purposes, which makes them a controller for that use. The review identifies which role applies and checks that the agreement matches it.

Can we leave if the service is poor?

That depends on the term and the termination clause. The review asks for termination on notice after an initial period, for termination for repeated service failures, and for an obligation on the provider to hand over your payroll data and cooperate with the transfer to the next provider whatever the reason for leaving.

Related guidance and services

• Contract review, £495, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Reviewing an IT outsourcing agreement

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.