People Group Services Limited Company Number: 11570329

OCR & Automated Data Extraction Policy

Policy Statement

People Group Services Ltd (“PGS”) utilises Optical Character Recognition (“OCR”) and automated data extraction technologies to enhance the accuracy, efficiency, and transparency of payroll processing, compliance verification, and reporting.

This policy sets out how OCR and automated extraction processes are governed to ensure:

• Full compliance with UK data protection law
• Alignment with HMRC reporting requirements
• Accuracy and integrity of payroll data
• Transparency across agency, MSP, and end-user supply chains

PGS is committed to a “compliance-first, technology-enabled” approach, ensuring automation strengthens — not replaces — accountability.

Scope

This policy applies to:

• All OCR and data extraction systems used within PGS
• Payslip parsing and payroll data ingestion processes
• Agency/MSP portal uploads (PDF, CSV, XLSX formats)
• All employees, workers, agencies, MSPs, and third parties interacting with PGS systems

Definition of OCR & Automated Data Extraction

OCR and automated extraction refers to:

• The conversion of scanned or digital documents (e.g. payslips) into structured data
• The automated identification and mapping of key payroll fields
• The ingestion and processing of extracted data into PGS systems

Typical extracted fields include:

• Worker name and reference
• Tax code
• Gross pay (period and YTD)
• PAYE tax
• Employee and Employer National Insurance
• Net pay
• Apprenticeship Levy
• Pay frequency and period

Lawful Basis for Processing

PGS processes data under the following lawful bases:

• Contractual necessity – to fulfil payroll and employment obligations
• Legal obligation – including HMRC RTI reporting and compliance
• Legitimate interests – ensuring transparency, fraud prevention, and compliance across supply chains

Where required, explicit worker consent is obtained via contractual agreements and onboarding processes.

Data Accuracy & Validation Controls

To ensure the highest level of accuracy:

Multi-Layer Validation

• OCR-extracted data is validated against:
  • Structured templates (where available)
  • System logic and expected payroll parameters
  • HMRC calculation methodologies

HMRC Alignment

• Extracted payroll data is cross-checked against HMRC calculation standards
• Post-processing validation ensures:
  • PAYE tax accuracy
  • National Insurance correctness
  • No rounding discrepancies

Exception Handling

• Any anomalies are:
  • Flagged automatically
  • Subject to manual review
  • Logged within audit trails

Human Oversight

PGS operates a human-in-the-loop model, ensuring:

• Critical payroll decisions are never fully automated
• Manual review is triggered where:
  • OCR confidence thresholds are not met
  • Data inconsistencies are detected
• Final payroll outputs remain subject to professional oversight

Data Security & Protection

All OCR and extraction processes operate within PGS’s secure infrastructure:

• Encryption in transit and at rest
• Role-based access controls
• Secure storage of source documents and extracted data
• Alignment with Cyber Essentials Plus standards

PGS ensures compliance with:

• UK GDPR
• Data Protection Act 2018

Data Minimisation & Retention

• Only data necessary for payroll and compliance purposes is extracted
• Irrelevant or excess data is not retained
• Data is stored in line with PGS Data Retention Policy

Where data is shared across supply chains:

• Only relevant fields are disclosed
• Non-essential personal data is redacted where possible

Transparency & Auditability

PGS provides full transparency through its portal systems:

• Visibility of extracted payroll data
• Access to:
  • Payslips
  • Key Information Documents (KIDs)
  • Assignment reconciliation schedules
• Full audit trail including:
  • Upload source
  • Extraction timestamps
  • Validation results

This supports agency and MSP compliance obligations, including those arising under Joint & Several Liability (JSL) legislation.

Third-Party Technology & Integrations

Where third-party OCR technologies are used:

• Vendors are subject to due diligence
• Data processing agreements are in place
• Systems must meet PGS security and compliance standards

No third-party provider is permitted to:

• Use data for their own purposes
• Store data outside agreed jurisdictions without safeguards

Error Management & Corrections

In the event of an OCR or extraction error:

• Corrections are:
  • Logged and timestamped
  • Traceable to source documents
• Affected parties may be notified where relevant
• Root cause analysis is conducted for systemic issues

Training & Awareness

All relevant personnel are trained on:

• OCR system usage
• Data validation processes
• Data protection obligations
• Exception handling procedures

Monitoring & Continuous Improvement

PGS continuously improves OCR performance through:

• Template learning and refinement
• Accuracy benchmarking
• Feedback loops from agencies and MSPs
• Regular system audits

Governance & Accountability

Responsibility for this policy sits with:

• Data Protection Officer (DPO) – data privacy compliance
• Head of Payroll Operations – operational integrity
• Technology/IT Lead – system security and performance

Breach & Incident Management

Any data breach or system failure involving OCR processes will be handled in accordance with:

• PGS Data Incident Response Policy
• UK GDPR reporting requirements

Policy Review

This policy will be reviewed:

• Annually
• Upon regulatory change (e.g. HMRC or employment legislation updates)
• Following any significant system or process change

Conclusion

PGS leverages OCR and automated data extraction to deliver:

• Enhanced accuracy
• Real-time transparency
• Stronger compliance assurance

While maintaining:

• Human oversight
• Full auditability
• Alignment with HMRC and UK regulatory frameworks

Declaration

This Policy is approved by the Board of Directors of: People Group Services Limited Company Number: 11570329

Last updated: 30th March 2026