HR Insights • 12 MIN READ
HR Compliance Checklist: What Every Company Needs in 2026
MAY 8, 2026
HR compliance is more complex than ever. Use this checklist to ensure your organisation is covered across employment law, data protection, and health and safety.
Why compliance cannot be delegated entirely to legal
HR professionals are on the front line of employment law compliance. Every day, HR makes decisions about disciplinary processes, pay, working time, and data that have legal implications. Whilst a solicitor can provide advice when things go wrong, HR's job is to ensure they do not go wrong in the first place. A well-designed compliance programme is far cheaper than defending an employment tribunal claim or a data protection investigation.
Employment contracts and documentation
Every employee must receive a written statement of the main terms and conditions of employment on or before their first day. The statement must cover pay, working hours, holiday entitlement, notice periods, and the place of work. Review template contracts annually to ensure they reflect current legislation. Ensure that all changes to employment terms are confirmed in writing and that employees sign to acknowledge receipt.
Right to work checks
Employers must check that every employee has the right to work in the country before they start. The method of checking depends on whether the individual is a British or Irish citizen, has a Biometric Residence Permit, or uses the Home Office online checking service. Keep records of every check, including the document seen and the date, for the duration of employment and for two years after it ends. Fines for employing someone without the right to work can reach £60,000 per illegal worker.
Data protection and GDPR
HR processes vast amounts of personal data: job applications, performance records, payroll data, health information, and disciplinary records. Under UK GDPR, this data must be collected for a specific and legitimate purpose, retained only as long as necessary, kept secure, and accessible to the data subject on request. Conduct a data mapping exercise to identify all personal data held by HR, document the legal basis for processing each category, and set retention policies that are enforced automatically wherever possible.
