Alex is Sprintlaw's co-founder and principal lawyer. Alex previously worked at a top-tier firm as a lawyer specialising in technology and media contracts, and founded a digital agency which he sold in 2015.
Contents
If you run a small business, payroll can feel like a constant balancing act: paying people correctly, keeping the right records, protecting sensitive information, and staying compliant with Australian workplace laws.
One question we often see come up in practice is whether you can (or should) include an employee’s Tax File Number (TFN) on their payslip. It’s a fair question - especially if you’re trying to keep things “organised” and avoid mix-ups.
But a TFN is one of the most sensitive pieces of personal information you’ll ever handle as an employer. If you include it on a payslip unnecessarily, you may be increasing your privacy risk exposure and creating a data breach problem you didn’t need to have.
Below, we’ll walk you through what Australian businesses need to know about including a tax file number on payslips, how this interacts with privacy and record-keeping laws, and practical ways to keep payroll compliant (without over-collecting or over-sharing personal data). This article is general information only and isn’t tax advice - if you need advice on PAYG withholding or your reporting obligations, you should speak to your accountant or the ATO.
What Is A TFN, And Why Is It So Sensitive?
A Tax File Number (TFN) is an identifier issued by the Australian Taxation Office (ATO) to individuals and some entities. In an employment context, you use a TFN to:
- set up tax withholding correctly (PAYG withholding);
- report employee income and tax withheld through Single Touch Payroll (STP); and
- help ensure your employee is taxed at the right rate.
From a risk perspective, a TFN is “high value” personal information. If mishandled, it can contribute to identity theft or fraud. That’s why TFNs are subject to strict handling expectations.
In Australia, TFNs are protected not just by general privacy principles, but also by specific rules that apply to TFN information (commonly referred to as the TFN Rules, made under the Privacy Act 1988 (Cth)). In simple terms, TFN information should only be collected, used or disclosed where it’s authorised (for example, for tax and superannuation administration) and it should be kept secure. Even if your business isn’t covered by every part of the Privacy Act, TFNs still deserve a “treat it like it’s confidential” approach. In practice, it’s usually not worth taking on extra risk unless there’s a clear compliance reason.
Can You Put A Tax File Number On A Payslip In Australia?
In most cases, you should avoid putting an employee’s TFN on a payslip.
As a general rule, payslips are meant to show pay and entitlements information (hours worked, gross and net pay, super contributions, leave balances if relevant, and so on). They are not intended to be identity documents.
Is It Illegal To Put A TFN On A Payslip?
There isn’t typically a “payslip law” that says, word-for-word, “you must never show a TFN on a payslip.” The bigger issue is whether including a TFN on a routinely shared document is:
- necessary for your payroll purpose; and
- consistent with your obligations when handling TFN information (including the TFN Rules under the Privacy Act 1988 (Cth)) and your broader confidentiality and security practices.
If a TFN appears on a payslip, that payslip may be:
- emailed to the employee (and could be forwarded, mis-sent, or accessed on an unsecured device);
- downloaded through a payroll portal (and then stored unencrypted);
- printed at home or at work and left on a desk; or
- provided to a mortgage broker, landlord, or third party as proof of income (increasing the disclosure risk even further).
From a business owner’s perspective, the key question is: what do you gain by putting the TFN on the payslip that you can’t gain another way? In most payroll systems, you can identify employees using an internal employee ID, or even partial identifiers (like the last 4 digits of an employee number) without exposing a TFN.
When Might A TFN Appear On Payroll Documents?
Sometimes TFNs appear because:
- a payroll template or default setting includes it;
- your accountant set up payroll years ago and no one reviewed the template; or
- a third-party payroll provider automatically displays it unless it’s disabled.
If that’s your situation, it’s worth treating this as a “settings and process” issue, not a necessity.
What Are Your Payslip Record-Keeping Obligations As An Employer?
Even if your goal is to maintain accurate employee records, the solution is usually not adding more personal information to payslips. Instead, you want to ensure you’re meeting your payslip and record-keeping obligations under the Fair Work framework.
Broadly, under the Fair Work Act 2009 (Cth) and the Fair Work Regulations 2009 (Cth), employers must:
- issue payslips within the required timeframe (generally within 1 working day of paying employees);
- ensure payslips include the required information (including the employer’s name, the employee’s name, pay period/date of payment, gross and net amounts, any loadings/allowances/penalty rates or other separately identifiable amounts, and superannuation contributions where required to be shown); and
- keep employee records that are accurate, in a legible form, and readily accessible for inspection.
It’s also important your payroll practices line up with what your employment arrangements actually say - for example, you should have written terms setting expectations around pay rates, hours, and payroll processes. If you haven’t reviewed your contracts in a while, it may be time to refresh your Employment Contract templates.
In many cases, if there’s a payroll dispute, the most valuable documents are:
- the employment contract and any variations;
- timesheets/rosters;
- payslips and pay summaries (where applicable); and
- super payment records.
Notice what’s not on that list: “TFN printed on payslips.” For most businesses, it isn’t a compliance requirement - it’s just an extra exposure point.
Privacy Risks For Employers: Why A TFN On A Payslip Can Backfire
When you include a TFN on payslip documents, you’re increasing the number of places that TFN exists, and increasing the chance it’s disclosed in a way you didn’t intend.
Common Ways TFNs Get Accidentally Disclosed
In small businesses, privacy issues often happen without bad intent. A few common scenarios include:
- Email errors: payslip emails sent to the wrong recipient due to autocomplete or outdated contact details.
- Shared inboxes: payroll messages go to an accounts inbox accessed by multiple staff members.
- Printed payslips: printed payslips left on printers, in vehicles, or on-site.
- Payroll access controls: too many team members have admin access to payroll software.
- Employee forwarding: the employee forwards the payslip to a third party for a loan/rental application, spreading the TFN further.
Once a TFN is out, you can’t “take it back” in any meaningful way. That’s why privacy risk management is often about minimising what you disclose in the first place.
Do Small Businesses Have To Comply With Privacy Laws?
Some small businesses are exempt from parts of the Privacy Act depending on their turnover and activities, but relying on exemptions can be risky. Also, even if an entity is exempt from parts of the Privacy Act, TFN information can still be subject to specific handling rules and expectations. Either way, you still have:
- confidentiality expectations from your staff;
- potential obligations via contracts with clients or suppliers;
- reputational risk if a data incident occurs; and
- good governance obligations (especially as you scale).
Practically, most growing businesses benefit from treating personal information carefully from day one. That includes having a clear Privacy Policy (especially if you collect personal information online, through forms, or through HR systems).
Even though a Privacy Policy is usually customer-facing, the discipline of mapping what you collect, why you collect it, and how you store it often helps clean up internal practices too - like whether TFNs are being unnecessarily displayed on payslips.
Practical Compliance Tips: How To Handle TFNs Safely In Payroll
If you’re trying to run payroll efficiently and keep your employee records clean, you can do that without putting TFNs on payslips. Here are practical tips that work well for small businesses.
1. Remove TFNs From Payslip Templates And Settings
Start with the obvious: check your payroll software settings and payslip templates. If a TFN field is being pulled into payslips, disable it.
If you use a bookkeeper, accountant, or outsourced payroll provider, ask them to confirm (in writing, if possible) that TFNs are not displayed on payslips.
2. Limit Access To TFNs Internally
Within your team, you should restrict access to TFNs to only those who genuinely need it for payroll and reporting. For many small businesses, that might be:
- the business owner;
- one payroll/admin team member; and/or
- your external accountant/bookkeeper.
Role-based access controls in payroll software are your friend here. This also helps you demonstrate you’re taking reasonable steps to protect personal information.
3. Store TFN Declarations Separately And Securely
TFN Declarations (and related onboarding documents) should be stored securely, with controlled access, and ideally separated from documents that are routinely shared.
If you’re using cloud tools, make sure:
- storage is password protected (and ideally uses multi-factor authentication);
- links aren’t “public access” links;
- access is removed promptly when staff leave; and
- you have a basic retention/deletion plan so you’re not keeping sensitive documents longer than necessary.
4. Set A Clear Internal Rule: TFNs Never Go In Emails Or Attachments Unless Truly Necessary
One of the simplest ways to reduce risk is to implement a clear rule internally: TFNs should not be included in email subject lines, email bodies, or routine attachments.
If you ever truly need to share a TFN (for example, with your accountant), use a secure channel and document why the disclosure was necessary.
5. Have The Right HR And Payroll Paperwork In Place
A lot of privacy risk comes from unclear processes - not from bad people.
Solid employment documentation can help you set expectations around payroll processes, access to employee records, and confidentiality. Depending on your business, this might include:
- a tailored Employment Contract for each team member;
- workplace policies covering confidentiality, IT use, and payroll admin processes; and
- appropriate clauses if you’re engaging contractors vs employees.
If you’re updating your internal paperwork more broadly (especially as you grow or bring on co-founders), it can also be a good time to review your business governance documents like a Company Constitution.
What Should You Put On Payslips Instead Of A TFN?
If your main reason for including a TFN is “we need a unique identifier,” there are safer alternatives that still help you manage payroll and reduce mistakes.
Common options include:
- Employee ID number generated by your payroll system;
- Partial identifiers (for example, last 4 digits of an internal ID - not of a TFN);
- Payroll reference numbers for the pay run; and
- Consistent naming conventions (especially important if you have staff with similar names).
If you’re worried about employees disputing pay or confusion around hours, the better risk-control measure is to improve your timekeeping, rosters, and contractual documentation - not to add a TFN to payslips.
For example, if you have casuals and shift changes, it’s worth ensuring your roster and shift management processes are consistent with your legal obligations and your internal policy settings. You might also want to review your approach to employee rostering so payroll inputs match what actually occurred.
Key Takeaways
- In most situations, it’s best practice to avoid including an employee’s TFN on payslips because it increases privacy and data breach risk without adding real compliance value.
- Payslips are designed to show pay details and entitlements - not to act as identity documents containing high-risk identifiers like TFNs.
- TFN information has specific handling expectations (including under the TFN Rules made under the Privacy Act 1988 (Cth)), so employers should limit collection, access, use and disclosure to what’s necessary and keep it secure.
- You can keep payroll accurate using safer alternatives like internal employee IDs, strong timekeeping processes, and clear workplace documentation.
- Good compliance is a systems issue: review payroll templates, restrict internal access to TFNs, store TFN documents securely, and keep your Privacy Policy and employment paperwork up to date.
If you’d like help tightening up your payroll processes, employment documentation, or privacy compliance, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.
Official Sources to Check
Rules and regulator guidance can change. Check the current official material most relevant to this issue before relying on the article:
