Among the documents that pass through an accounting firm, the payslip looks like the least sensitive: numbers, deductions, a net figure at the bottom. It is in fact the only everyday one that almost always carries data the European regulation puts in a chapter of its own.
What is in there, besides the numbers
Sickness absence is health data. A union deduction reveals trade union membership. Leave taken under Italian disability legislation reveals a disability, the employee’s own or a family member’s. Parental leave, a salary assignment, a third party attachment order all describe personal situations nobody asked to describe.
The first three are special categories under Article 9 GDPRopens in a new tab. The last ones are not, technically, but they are exactly the sort of information that gets a firm an angry phone call when someone finds out where it went.
Why the regime is different, not just stricter
For ordinary data you reason about the legal basis: you choose between contract, legal obligation, legitimate interest, and you justify it. For special categories the starting point is a prohibition, and processing is possible only if one of the conditions in Article 9(2) applies.
The practical difference shows when you frame the question properly. Not “do I have a reason to send this payslip to an AI supplier”, but “which of the Article 9(2) conditions covers my sending this payslip to an AI supplier”. Put that way, the answer arrives quickly.
The client’s employee is not your client
There is a question that comes before all the others and that almost nobody asks: in what capacity are you processing the data of a client company’s employees? The people on that payslip signed nothing with you, never read your privacy notice and, in most cases, do not know their payslip is prepared by an outside firm at all.
The classification is contested and does not resolve in a paragraph: some hold that the professional is always an independent controller, because of duties the law places directly on them, and some that in payroll work they act as a processor appointed by the employer. The striking part is that for this article’s question both routes arrive at the same place.
If you are a processor, Article 28(2) is blunt: you may not engage another processor without the controller’s written authorisation, specific or general. Pasting that payslip into an AI service is precisely engaging another processor, and doing it without telling the client is a breach of contract before it is a breach of the regulation. If instead you are an independent controller, the legal basis and the notice to those employees are yours to carry, and for special categories you carry them in front of Article 9.
It is worth picking an answer and writing it down, because it is the same question that decides who signs the agreement with the supplier and who has to inform the people concerned. A relationship where neither side has written it is a relationship where, when something goes wrong, both will argue about it.
The person who answers is not the person who pressed enter
Whichever capacity it is, it is not the person who pasted the file. Whoever runs payroll in the office is a person authorised to process, acting under the authority of whoever directs the firm and on their instructions: that is Article 29, and the consequence is that the instruction has to have been given, and the firm has to be able to show it.
The two tiers of Article 83 reach 10 million euro or 2% of worldwide annual turnover for security obligations, and 20 million or 4% for the principles, the legal bases and the special categories. Those numbers are written for multinationals; for a firm what counts is the client who leaves and the report to the professional body, and neither has a ceiling.
What comes out of a payslip, and what stays in
Substitution has a wrinkle here that does not come up elsewhere, and understanding it is the difference between a useless document and one you can still work on. In a payslip the entries that identify and the entries that do the arithmetic are separate, and they sit in different parts of the sheet.
Out go: name and surname, tax code, payroll number, date of birth, address, the bank account it is paid into, and the company name when the question is not about the company. In stay: the job title, the grade, the collective agreement applied, ordinary and overtime hours, the pay items with their amounts, the rates, the taxable bases, the running totals.
And in stay (this is the counter-intuitive part) the very entries that make it an Article 9 document: the sickness hours, the carer’s leave, the union deduction. They stay because without them the arithmetic does not add up and the question loses its point; and they may stay because, detached from the person, they are about nobody. “Thirty hours of sickness in a month of a hundred and sixty-eight, at this rate” is an arithmetic problem. “Thirty hours of Mario Rossi’s sickness, payroll number 4471” is data about a person’s health. Same line, and the whole difference is in the field next to it.
The useful work that stays possible
Almost everything you wanted the model for: checking consistency between line items, explaining how a deduction was calculated, comparing two months, drafting an answer to an employee asking why the net figure changed.
None of those requests needs the name, the tax code or the payroll number. With names and identifiers replaced by stable placeholders the calculation still checks out, and when the answer comes back you read it onto the real payslip.
The condition is that the substitution happens before the file leaves, on the office computer. That is the work Omissia does, verifying tax codes, VAT numbers and IBANs against their check character and proposing the rest for you to confirm. What still identifies a document without the name is in the piece about accounts.