Payroll software checks in England: PAYE, pensions and UK GDPR

For an employer in England, assess payroll software against UK PAYE and data-protection checks, alongside automatic-enrolment duties. The Income Tax (Pay As You Earn) Regulations 2003 is the named PAYE instrument. Workers in scope for automatic enrolment ordinarily work in Great Britain and satisfy the age and earnings criteria.

Check FPS, EPS and correction workflows

Use payroll software to send a Full Payment Submission (FPS) to HM Revenue and Customs (HMRC), reporting employee payments and deductions. Send it on or before payday, even if you pay HMRC quarterly instead of monthly. Test the submission workflow against the actual payday.

If you find errors in an FPS, send a corrected FPS as soon as possible. An Employer Payment Summary (EPS) can claim a reduction in the amount owed to HMRC, for example statutory pay, and must be sent by the 19th. Keep correction and reduction tests separate.

Tax months run from the 6th of one month to the 5th of the next. If no employees have been paid in a tax month, an EPS must be sent to HMRC. Build that unpaid-month case into the payroll operating workflow, rather than testing only routine paid periods.

Verify HMRC recognition against the named product

HMRC-recognised software can be used to report PAYE information online. The HMRC recognition page also makes clear that HMRC cannot recommend one product or service over another and is not responsible for problems with software you buy.

Free payroll software is recognised by HMRC for businesses with fewer than 10 employees. The free-software list includes Enrolpay Ltd and Enrolpay Small Payroll. Verify the exact product name against the list, match it to the proposed product and keep the result in your vendor due diligence record.

Test pension assessment, enrolment and payments

Check assessment and recurring payments separately. Staff aged between 22 and state pension age who earn over £10,000 per year, £833 per month or £192 per week must be put into a pension scheme, with both employer and worker paying into it.

Staff must be put into a pension scheme and written to within six weeks of meeting the age and earnings criteria, under ongoing employer duties. Continue making the payments due into the scheme every time you run payroll. Ask the supplier to demonstrate both the enrolment workflow and payment handling.

For 2025/26, the annual automatic-enrolment trigger is £10,000 and the qualifying-earnings band is £6,240 to £50,270. The minimum for a qualifying pension scheme is 8 per cent total contributions, including tax relief, on relevant earnings, with at least 3 per cent from the employer. Keep the year and contribution basis explicit.

Ask for a written schedule for pension payment processing, and check it against the scheme's requirements. Record who prepares, approves and completes each transfer. Request evidence for the completed payment rather than accepting a displayed contribution calculation as the end of the test. Keep unresolved steps attached to a named owner.

Track declarations and re-enrolment

Employers with at least one worker must declare compliance to The Pensions Regulator, regardless of workers' ages or earnings. An employer with one or more workers must complete the declaration no later than five months after the duties start date. Record that deadline separately from enrolment.

Every three years, employers must re-enrol certain staff who have left their pension scheme. A re-declaration of compliance must be completed whether or not there are staff to put back into the scheme. Ask the supplier to demonstrate reminders and distinguish those reminders from the completed employer declaration.

Under the Pensions Act 2008, the Secretary of State must review the automatic-enrolment earnings trigger and lower and upper qualifying-earnings limits within each tax year. Record the year used by the product, and apply the same dated checks when considering auto enrolment options. Do not treat stored thresholds as permanent settings.

Identify UK GDPR controller and processor roles

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA) are information-protection legislation. For a payroll buying decision, identify the controller and processor roles before judging access controls or service promises. Record who determines the processing purpose and who carries it out.

A controller determines the purposes and means of processing personal information, alone or jointly with others. A data processor processes personal information on behalf of the controller. In the ICO payroll example, another company processes the ICO's payroll details as processor, while the ICO remains controller because it determines the purpose and means.

Translate those roles into questions for the supplier and the commercial contracts. Ask who decides each processing purpose, who can change access, and how records can be returned or deleted. Treat the answers as matters to verify, not as proof created by a product label or an outsourced service description.

Example: a software verification record

As an example, build a verification record around the named products and submission duties. Use the same evidence fields for every candidate, but enter only behaviour you have observed or a rule you have checked. Keep the demonstrated software action separate from the employer's remaining task.

Keep the observed result beside each test, including any action completed outside the software. Use a payroll quality checklist to organise the evidence and a selection checklist to repeat the trial across finalists. For QuickBooks, distinguish a generated EPS from evidence of submission; do not record those as the same event.