It is pretty typical to split sensitive personal information (e.g. SSN, pay, health records, etc) from administrative activities (e.g. leave requests). In the event that the administrative side gets compromised, it will limit how "bad" that compromise might be, additionally they may be required to store sensitive information differently (e.g. better physical security, server-drive encryption, etc).