HR administration in Excel works as long as one person keeps track of everything, but with every extra file and every extra user the risk of errors, data breaches and changes nobody can explain grows. An HR app with access rights, approvals and history largely covers those risks, provided you switch in phases.
Many companies with staff on the road or on site start with one worksheet for leave balances, a second for sickness and medical certificates, a third for hours per site and a folder of expense receipts. The problem comes later, when those files become the basis for payroll preparation and for declarations to the NSSO.
This article is about administration, not planning. For planning, we already wrote 7 signs that Excel can no longer handle your planning on go-virtual.com (in Dutch).
In this article you will read what research says about spreadsheet errors, what GDPR requires for personnel data, when a data breach must be reported within 72 hours, why an audit trail matters when correcting a DmfA and how to switch in six steps without giving up Excel entirely.
How often do Excel files contain errors?
The best-known research comes from Raymond Panko, who compiled audits of real spreadsheets. In the audits from 1997 onwards, which used better methods, 91% of 54 spreadsheets examined contained errors. The share of incorrect cells ranged from 0.38% to 2.5%.
In a later synthesis from 2015, Panko arrives at 94% of spreadsheets with errors, across 85 thorough inspections. In laboratory studies, an average of 3.9% of cells were wrong. According to Panko, reviewers find on average only about 60% of errors. Experience helps, but does not eliminate errors.
A caveat: these figures come from older, mostly American studies of financial models, not of HR files. The mechanism is the same, though: retyping, copying and pasting, formulas that do not run down to the last row. As an illustration: a leave overview of 50 employees with 20 columns has 1,000 cells. At an error rate of 1%, within the range of Panko's audits, that is around ten incorrect cells.
Excel can also make data disappear silently. In the United Kingdom in 2020, the data of 15,841 people who tested positive (25 September to 2 October) were left out of contact tracing. This was probably due to a row limit in Excel, although that cause was not confirmed.
What we see in practice with HR in Excel
The following situations are not measured facts but experiences we often hear from employers. Several versions of the leave file exist, and nobody knows for sure which balance is correct. Medical certificates sit in a mailbox or a shared folder, separate from the absence in the worksheet.
Hours arrive on paper slips and are retyped on Friday. Expense receipts arrive as photos through a chat app. Every handover is a chance for an error. Read in our article on time registration in 2027 whether Excel or paper will still be enough for that; no law has been adopted yet.
What does GDPR require for personnel data in Excel?
Article 32 of the GDPR requires the employer to take appropriate technical and organisational measures to secure personnel data. The text mentions, among others:
- pseudonymisation and encryption of personal data;
- the ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems;
- the ability to restore the availability of data in a timely manner after an incident;
- a process for regularly testing and evaluating the measures.
What is appropriate depends on the risk. For data about sickness the bar is higher than for a phone list. With separate Excel files that is difficult: a password on a file is not an access right per person, whoever opens the file sees all columns, and copies on laptops or in email attachments escape any control.
When must you report a data breach within 72 hours?
Under Article 33 of the GDPR, you report a data breach without undue delay and where feasible within 72 hours of becoming aware of it to the supervisory authority, in Belgium the Data Protection Authority (DPA). This is not necessary if the breach is unlikely to result in a risk to the people concerned. If you report later, you must give reasons for the delay. Every breach, including one you do not report, is documented internally.
Some examples from HR administration that you should at least assess:
- A laptop with the personnel file, including addresses and national register numbers, is stolen from a van.
- A leave and sickness overview is emailed to all employees by mistake instead of to the accountant.
- A USB stick with expense claims and bank account numbers goes missing.
- A former employee still has access to the shared folder with medical certificates.
Health data is a special category under the GDPR, so the risk weighs more heavily as soon as sickness or certificates are involved. If the risk is high, you must also inform the employees themselves. In practice, the biggest difficulty with Excel is often that nobody knows which version circulated where, which makes it hard to assess within 72 hours what was leaked.
Why does an audit trail matter, also towards the NSSO?
An audit trail is the history of a piece of data: who changed what, when, from which value to which, and who approved it. In Excel you only see the last value in the cell. Who adjusted a leave balance or a number of hours, and why, remains invisible.
This becomes concrete when correcting a DmfA, the quarterly declaration to the NSSO. Anyone who modifies a DmfA through the portal must keep a ticket number, and the NSSO sends proof to the eBox Enterprise within 24 hours. The correction itself is therefore documented, but you must be able to show the reason behind it yourself: which absence or which hours changed, based on which certificate or which approval.
A good audit trail keeps at least:
- the user who made the change, with date and time;
- the old and the new value;
- who approved or rejected the change;
- the underlying document, such as a certificate or a receipt.
In explainable AI and audit trail (in Dutch) you can read why that history also matters with automation.
Excel or HR app: what is the difference per task?
The table compares the daily HR tasks side by side. The difference rarely lies in what you can keep track of, but in who enters data, who checks it and what is kept.
| Task | In Excel | In an HR app |
|---|---|---|
| Personnel data | One file with all columns for everyone who opens it | Rights per role: the foreman sees his team, HR sees everything |
| Leave requests and balance | Request by email or on paper, balance updated manually | Employee requests in the app, balance adjusts after approval |
| Sickness and certificate | Report by phone, certificate separate in a mailbox | Report and photo of the certificate together with the absence |
| Hours per day and per site | Slips or weekly timesheets retyped at the office | Registration per day and per site by the employee |
| Expenses | Receipts via chat or in an envelope, totals in a worksheet | Expense with photo submitted and approved in one flow |
| Correction afterwards | New value overwrites the old one without a trace | History with user, time and approval |
| Analysis and reporting | Strong, as long as the source data is correct | Reports and exports based on validated data |
How do you switch from Excel to an HR app in six steps?
A switch rarely fails because of the software, but because of messy data or doing too much at once. This step-by-step plan keeps it manageable.
- Make an inventory. List every file that contains HR data: who manages it, who uses it, what data it contains and where copies are kept, including on laptops and in email attachments.
- Clean the data. Choose one source per data item, remove duplicate and departed employees, and check leave balances against the latest payslip before you transfer them.
- Start with one function. For example, begin with leave requests or sickness reporting and leave the rest in Excel for now. A small first step is more visible to employees and easier to adjust.
- Run in parallel for one month. Register a full month in both systems and compare the results before payroll preparation. Differences show where settings or agreements are not yet right.
- Set the access rights. Decide per role who may see and approve what, close accounts of departed employees immediately and give sickness data only to those who need it.
- Archive the old files. Put the latest version read-only in a secured folder with limited access, delete loose copies and keep nothing longer than the legal retention periods require.
How do you keep Excel for analysis?
Excel remains a strong tool for analysis, for example absence per team or the evolution of hours per site. The rule is simple: the HR app is the source, Excel is an export to look at.
- Export only the columns you need for the analysis, and leave out names where possible.
- Always enter corrections in the app, never in the export, so the history stays complete.
- Delete exports containing personal data as soon as the analysis is done.
How MyVIRO helps
MyVIRO is an employee self-service app: employees request leave, report sickness with a photo of the certificate, register hours per day and per site and submit expenses, in one app for iOS and Android. Per team you choose which functions are visible, so you can start with one function as in the step-by-step plan.
In the back office you approve requests and see immediately, before payroll preparation, which registrations are missing and which approvals are still open. The validated data goes to your HR, ERP or payroll system, or to VIRO. MyVIRO does not calculate wages itself, and the data stays in Belgium.
- See how MyVIRO works, from check-in and check-out to full self-service
- Read what an ESS app is and how it differs from HR software
- Discover VIRO for pre-payroll as the next step after registration
Request a demo and find out which function to start with to move your HR administration out of Excel.
Read also
- What is an ESS app? Employee self-service explained for Belgian employers
- Monthly payroll preparation checklist: what to send your social secretariat
- Digital payslips and social documents: what does Belgian law say?
Frequently asked questions about HR administration in Excel
No. GDPR does not prohibit any specific program, but it requires appropriate security. With separate files that is hard to demonstrate, especially for data about sickness.
A password protects the file, but everyone who knows it sees all the data. You cannot use it to give rights per person, and it does not record who changed what.
If the breach is likely to result in a risk to the employees, you report it where feasible within 72 hours to the Data Protection Authority. In any case, document the incident internally, even if you do not report it.
Count on one full month per function, so you can compare at least one payroll preparation. If the figures match, you stop using the Excel file for that function.
Keep the latest version read-only in a secured folder with limited access and delete loose copies. Ask your social secretariat which retention periods apply to you.
Yes. Use Excel for exports from the HR app and always enter corrections in the app itself, so that no second version of the truth emerges.
That depends on the app. MyVIRO does not calculate wages: it collects and validates the data, which then goes to your payroll system or to VIRO.
Sources
- R.R. Panko, Spreadsheet Errors: What We Know. What We Think We Can Do, EuSpRIG 2000: arxiv.org/pdf/0802.3457
- R.R. Panko, synthesis on spreadsheet errors, EuSpRIG 2015: arxiv.org/pdf/1602.02601
- GDPR (Regulation 2016/679), Article 32 Security of processing (in Dutch): gdpr-text.com
- NSSO, Modifying a DmfA (in Dutch): socialsecurity.be
- PublicTechnology, on the lost data of almost 16,000 coronavirus cases in Excel: publictechnology.net
Author: Jean-Philippe Delberghe at MyVIRO. Published on 23 October 2026. Last updated on 23 October 2026.
This article is an informative explanation and not legal advice. Consult your social secretariat for your specific situation.