How to restrict HR users in Odoo
Scope an Access Profile to the Employees app with salary, national ID, and bank-account fields masked by default, full access reserved for HR leadership, and a record rule limiting most HR staff to their own assigned employees rather than the whole company roster.
Mask the identifying fields
National ID numbers, salary, bank details — masked for general HR staff, visible in full only to HR leadership.
Scope records to assigned employees
Use 'own + subordinates' or a department match so HR generalists see their remit, not the entire company.
Keep it enforced past the UI
These fields matter most in exports and integrations — payroll syncs, background-check tools — where a UI-only mask wouldn't help at all.
Employees, private data, and payroll are different grants
People say “HR access” and mean three things: the Employees directory, private contact fields (home address, national ID, bank), and compensation. Most HR officers need the first. Many should not have the third. Mask or hide salary, bonus and bank by default; full values for a named leadership profile. Data masking is the last-four-digits pattern; Invisible is “this field does not exist for you.”
Record-scope the roster: own assigned employees, a department, or the company. A receptionist who can open every contract is an accident. Record rules · payroll as its own profile.
Access minimisation is a control, not a policy PDF
Showing every HR user every national ID because “they’re in the HR group” is the opposite of minimisation. Field access and record rules are the evidence you can show. Installing a module does not make you compliant — GDPR and data access — but you cannot claim minimisation with a single HR/Officer group either.
Export off for anyone who does not run payroll or legal extracts. API keys off for the same people.
Managers seeing their team is not HR Officer
A department manager often needs time off and reporting line, not salary. That is a profile with a manager-chain record rule and compensation fields Invisible. Do not reuse HR/Officer and “trust them.”
Test: manager cannot open another department’s salary, cannot export employee list, can approve their own team’s leave. Three checks, fifteen minutes.
The rest of the cluster
Before you set it up
What should most HR users not see?
Salary, national ID and bank account by default. Mask those fields; full access for HR leadership. Data masking · Field-level security.
Can I limit HR staff to their own employees?
Yes — a record rule on the employee they are assigned, not the whole roster. Record rules · Restrict records.
Does this help with GDPR access minimisation?
It is one control, not a compliance programme. GDPR and data access.
Ready to lock this down?
Try it on the live sandbox first — nothing to install.