OCA · OCA-git-bot · Jan 5, 2026 · Dec 31, 2025
diff --git a/hr_payroll_document/README.rst b/hr_payroll_document/README.rst
@@ -30,6 +30,9 @@ HR - Payroll Document
 
 This module have a wizard view to manage the different payrolls of employees which is identified by the identification_id attribute.
 
+By default, the employee's payroll is encrypted using their identification number.
+This behavior can be changed by the employee in their profile or by HR in the employee's form.
+
 **Table of contents**
 
 .. contents::
@@ -58,6 +61,9 @@ Contributors
 
 * Antoni Marroig Campomar <amarroig@apsl.net>
 * Miquel Alzanillas Monserrat <malzanillas@apsl.net>
+* `PyTech <https://www.pytech.it>`_:
+
+  * Simone Rubino <simone.rubino@pytech.it>
 
 Maintainers
 ~~~~~~~~~~~

diff --git a/hr_payroll_document/__manifest__.py b/hr_payroll_document/__manifest__.py
@@ -13,5 +13,7 @@
         "wizard/payroll_management_wizard.xml",
         "security/ir.model.access.csv",
         "data/email_payroll_employee.xml",
+        "views/hr_employee_views.xml",
+        "views/res_users_views.xml",
     ],
 }
diff --git a/hr_payroll_document/models/__init__.py b/hr_payroll_document/models/__init__.py
@@ -1,3 +1,4 @@
 from . import ir_attachment_payroll_custom
 from . import ir_attachment
 from . import hr_employee
+from . import res_users
diff --git a/hr_payroll_document/models/hr_employee.py b/hr_payroll_document/models/hr_employee.py
@@ -1,10 +1,18 @@
-from odoo import _, models
+from odoo import _, fields, models
 from odoo.exceptions import ValidationError
 
 
 class Employee(models.Model):
     _inherit = "hr.employee"
 
+    no_payroll_encryption = fields.Boolean(
+        string="Disable payrolls encryption",
+        help="If this is disabled (default), "
+        "the PDF payrolls are encrypted using the Identification No.\n"
+        "Only future payrolls are affected by this change, "
+        "existing payrolls will not change their encryption status.",
+    )
+
     def write(self, vals):
         res = super().write(vals)
         if "identification_id" in vals and not self.env["res.partner"].simple_vat_check(

diff --git a/hr_payroll_document/models/res_users.py b/hr_payroll_document/models/res_users.py
@@ -0,0 +1,18 @@
+# Copyright 2025 Simone Rubino - PyTech
+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+from odoo import fields, models
+
+from odoo.addons.hr.models.res_users import HR_WRITABLE_FIELDS
+
+HR_WRITABLE_FIELDS.append("no_payroll_encryption")
+
+
+class ResUsers(models.Model):
+    _inherit = "res.users"
+
+    no_payroll_encryption = fields.Boolean(
+        related="employee_id.no_payroll_encryption",
+        readonly=False,
+        related_sudo=False,
+    )
diff --git a/hr_payroll_document/readme/CONTRIBUTORS.rst b/hr_payroll_document/readme/CONTRIBUTORS.rst
@@ -1,2 +1,5 @@
 * Antoni Marroig Campomar <amarroig@apsl.net>
 * Miquel Alzanillas Monserrat <malzanillas@apsl.net>
+* `PyTech <https://www.pytech.it>`_:
+
+  * Simone Rubino <simone.rubino@pytech.it>
diff --git a/hr_payroll_document/readme/DESCRIPTION.rst b/hr_payroll_document/readme/DESCRIPTION.rst
@@ -1 +1,4 @@
 This module have a wizard view to manage the different payrolls of employees which is identified by the identification_id attribute.
+
+By default, the employee's payroll is encrypted using their identification number.
+This behavior can be changed by the employee in their profile or by HR in the employee's form.
diff --git a/hr_payroll_document/static/description/index.html b/hr_payroll_document/static/description/index.html
@@ -1,4 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 <head>
@@ -9,10 +8,11 @@
 
 /*
 :Author: David Goodger (goodger@python.org)
-:Id: $Id: html4css1.css 8954 2022-01-20 10:10:25Z milde $
+:Id: $Id: html4css1.css 9511 2024-01-13 09:50:07Z milde $
 :Copyright: This stylesheet has been placed in the public domain.
 
 Default cascading style sheet for the HTML output of Docutils.
+Despite the name, some widely supported CSS2 features are used.
 
 See https://docutils.sourceforge.io/docs/howto/html-stylesheets.html for how to
 customize this style sheet.
@@ -275,7 +275,7 @@
   margin-left: 2em ;
   margin-right: 2em }
 
-pre.code .ln { color: grey; } /* line numbers */
+pre.code .ln { color: gray; } /* line numbers */
 pre.code, code { background-color: #eeeeee }
 pre.code .comment, code .comment { color: #5C6576 }
 pre.code .keyword, code .keyword { color: #3B0D06; font-weight: bold }
@@ -301,7 +301,7 @@
 span.pre {
   white-space: pre }
 
-span.problematic {
+span.problematic, pre.problematic {
   color: red }
 
 span.section-subtitle {
@@ -371,6 +371,8 @@ <h1 class="title">HR - Payroll Document</h1>
 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -->
 <p><a class="reference external image-reference" href="https://odoo-community.org/page/development-status"><img alt="Beta" src="https://img.shields.io/badge/maturity-Beta-yellow.png" /></a> <a class="reference external image-reference" href="http://www.gnu.org/licenses/agpl-3.0-standalone.html"><img alt="License: AGPL-3" src="https://img.shields.io/badge/licence-AGPL--3-blue.png" /></a> <a class="reference external image-reference" href="https://github.com/OCA/payroll/tree/16.0/hr_payroll_document"><img alt="OCA/payroll" src="https://img.shields.io/badge/github-OCA%2Fpayroll-lightgray.png?logo=github" /></a> <a class="reference external image-reference" href="https://translation.odoo-community.org/projects/payroll-16-0/payroll-16-0-hr_payroll_document"><img alt="Translate me on Weblate" src="https://img.shields.io/badge/weblate-Translate%20me-F47D42.png" /></a> <a class="reference external image-reference" href="https://runboat.odoo-community.org/builds?repo=OCA/payroll&amp;target_branch=16.0"><img alt="Try me on Runboat" src="https://img.shields.io/badge/runboat-Try%20me-875A7B.png" /></a></p>
 <p>This module have a wizard view to manage the different payrolls of employees which is identified by the identification_id attribute.</p>
+<p>By default, the employee’s payroll is encrypted using their identification number.
+This behavior can be changed by the employee in their profile or by HR in the employee’s form.</p>
 <p><strong>Table of contents</strong></p>
 <div class="contents local topic" id="contents">
 <ul class="simple">
@@ -404,12 +406,18 @@ <h2><a class="toc-backref" href="#toc-entry-4">Contributors</a></h2>
 <ul class="simple">
 <li>Antoni Marroig Campomar &lt;<a class="reference external" href="mailto:amarroig&#64;apsl.net">amarroig&#64;apsl.net</a>&gt;</li>
 <li>Miquel Alzanillas Monserrat &lt;<a class="reference external" href="mailto:malzanillas&#64;apsl.net">malzanillas&#64;apsl.net</a>&gt;</li>
+<li><a class="reference external" href="https://www.pytech.it">PyTech</a>:<ul>
+<li>Simone Rubino &lt;<a class="reference external" href="mailto:simone.rubino&#64;pytech.it">simone.rubino&#64;pytech.it</a>&gt;</li>
+</ul>
+</li>
 </ul>
 </div>
 <div class="section" id="maintainers">
 <h2><a class="toc-backref" href="#toc-entry-5">Maintainers</a></h2>
 <p>This module is maintained by the OCA.</p>
-<a class="reference external image-reference" href="https://odoo-community.org"><img alt="Odoo Community Association" src="https://odoo-community.org/logo.png" /></a>
+<a class="reference external image-reference" href="https://odoo-community.org">
+<img alt="Odoo Community Association" src="https://odoo-community.org/logo.png" />
+</a>
 <p>OCA, or the Odoo Community Association, is a nonprofit organization whose
 mission is to support the collaborative development of Odoo features and
 promote its widespread use.</p>

diff --git a/hr_payroll_document/tests/test_hr_payroll_document.py b/hr_payroll_document/tests/test_hr_payroll_document.py
@@ -1,4 +1,7 @@
 import base64
+import io
+
+import pypdf
 
 from odoo import _
 from odoo.exceptions import UserError, ValidationError
@@ -105,3 +108,35 @@ def test_send_payrolls_correctly(self):
                 },
             },
         )
+
+    def test_optional_encryption(self):
+        """The employee's payroll can be not encrypted."""
+        # Arrange
+        self.fill_company_id()
+        employee = self.employee_emp
+        employee.update(
+            {
+                "identification_id": "51000278D",
+                "no_payroll_encryption": True,
+            }
+        )
+        # pre-condition
+        self.assertTrue(employee.no_payroll_encryption)
+
+        # Act
+        self.wizard.send_payrolls()
+
+        # Assert
+        payroll = (
+            self.env["ir.attachment.payroll.custom"]
+            .search(
+                [
+                    ("identification_id", "=", employee.identification_id),
+                ]
+            )
+            .attachment_id
+        )
+        self.assertTrue(payroll)
+        payroll_content = base64.b64decode(payroll.datas)
+        payroll_pdf = pypdf.PdfReader(io.BytesIO(payroll_content))
+        self.assertFalse(payroll_pdf.is_encrypted)
diff --git a/hr_payroll_document/views/hr_employee_views.xml b/hr_payroll_document/views/hr_employee_views.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!--
+    ~ Copyright 2025 Simone Rubino - PyTech
+    ~ License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+-->
+<odoo>
+    <record id="view_employee_form" model="ir.ui.view">
+        <field name="name">hr.employee.form</field>
+        <field name="model">hr.employee</field>
+        <field name="inherit_id" ref="hr.view_employee_form" />
+        <field name="arch" type="xml">
+            <group name="payroll_group" position="attributes">
+                <attribute name="invisible" />
+            </group>
+            <group name="payroll_group" position="inside">
+                <field name="no_payroll_encryption" string="Disable encryption" />
+            </group>
+        </field>
+    </record>
+</odoo>
diff --git a/hr_payroll_document/views/res_users_views.xml b/hr_payroll_document/views/res_users_views.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!--
+    ~ Copyright 2025 Simone Rubino - PyTech
+    ~ License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+-->
+<odoo>
+    <record id="res_users_view_form_profile" model="ir.ui.view">
+        <field name="name">Add Payroll fields to User profile form view</field>
+        <field name="model">res.users</field>
+        <field name="inherit_id" ref="hr.res_users_view_form_profile" />
+        <field name="arch" type="xml">
+            <div id="o_work_employee_main" position="inside">
+                <group name="payroll" string="Payroll">
+                    <field
+                        name="no_payroll_encryption"
+                        string="Disable encryption"
+                        attrs="{
+                            'readonly': [
+                                ('can_edit', '=', False),
+                            ],
+                        }"
+                    />
+                </group>
+            </div>
+        </field>
+    </record>
+</odoo>
diff --git a/hr_payroll_document/wizard/payroll_management_wizard.py b/hr_payroll_document/wizard/payroll_management_wizard.py
@@ -54,8 +54,9 @@ def send_payrolls(self):
 
             path = "/tmp/" + _("Payroll ") + employee.name + ".pdf"
 
-            # Encrypt the payroll file with the identification identifier of the employee
-            pdfWriter.encrypt(employee.identification_id, algorithm="AES-256")
+            if not employee.no_payroll_encryption:
+                # Encrypt the payroll file with the identification identifier of the employee
+                pdfWriter.encrypt(employee.identification_id, algorithm="AES-256")
 
             f = open(path, "wb")
             pdfWriter.write(f)