HR compliance: the duties that come with employing someone, in the order they arrive

Search for HR compliance and you will mostly be sold software. The underlying question is simpler and duller: what is an employer legally required to do, and by when?

This article answers that using the government's own sequence, then covers the duties with hard deadlines (the written statement, right to work, PAYE, pensions and insurance) and what to do if you are already behind.

Compliance fails at handovers, not at decisions. See how New Dynamics workflows make each step's owner and due date explicit.

It is a list, not a category

GOV.UK publishes a step-by-step guide to employing staff for the first time. Its six steps are a better definition of HR compliance than any framework:

1. Check that you are taking on someone as an employee. The rules differ for "agency staff, freelancers, consultants and contractors". This step also covers the National Minimum Wage, National Insurance, sick pay, pension contributions, and maternity and paternity pay.
2. Make your workplace safe and accessible. Preventing discrimination, accessibility for employees "with disabilities or health conditions", keeping "employee information and data safe", fire safety and health and safety.
3. Register as an employer and set up PAYE, because "you need to register with HMRC so you can pay tax and national insurance for your employees".
4. Check your responsibilities around workplace pensions.
5. Get Employers' Liability insurance.
6. Recruit and employ someone.

Recruiting is step six. Most first-time employers start there, which is how the other five end up being done late.

The day-one duty most people get wrong

GOV.UK's guidance on the written statement of employment particulars is precise, and the precision is the point. "An employer must give employees and workers a document stating the main conditions of employment when they start work." It "is not an employment contract".

It comes in two parts with two different deadlines. The employer "must provide the principal statement on the first day of employment and the wider written statement within 2 months of the start of employment". People who remember only "two months" miss the day-one obligation entirely.

The principal statement must include at least:

• the employer's name, and the employee's or worker's name, "job title or a description of work and start date";
• "how much and how often an employee or worker will get paid";
• "hours and days of work and if and how they may vary", including Sunday work, night work and overtime;
• "holiday entitlement (and if that includes public holidays)";
• where the person will be working, and "whether they might have to relocate";
• "how long a job is expected to last (and what the end date is if it's a fixed-term contract)";
• "how long any probation period is and what its conditions are";
• "any other benefits", and "obligatory training, whether or not this is paid for by the employer".

Changes must be communicated too, "within one month of making the change".

Note that it covers workers as well as employees. Our post on the independent contractor distinction covers where that line falls.

Right to work, and the trap inside it

"You must check that a job applicant is allowed to work for you in the UK before you employ them." GOV.UK's guidance on checking a job applicant's right to work gives three routes: an online check "if they've given you their share code", checking "the applicant's original documents", or using "an identity service provider that offers Identity Document Validation Technology (IDVT)".

Two details catch employers out. British and Irish citizens "cannot get an online share code to prove their right to work", so their original documents must be checked or an identity service provider used. And biometric residence cards and permits can no longer be accepted; ask for a share code instead.

The trap is the second requirement sitting alongside the first: "you must not discriminate against anyone because of where they're from." Checking everyone the same way, at the same stage, is both the compliant approach and the safe one. Asking only the people whose names sound foreign is how an employer turns one duty into two breaches.

Getting this wrong has a price: "you could face a civil penalty if you employ an illegal worker and have not carried out a correct right to work check."

Payroll and pensions

Payroll compliance is largely about dates. Registration with HMRC comes before the first payday, and each pay run carries reporting obligations. Our payroll definition post covers the pay run itself, and our post on payroll certification covers who is qualified to run it.

Pensions start earlier than most employers expect. The Pensions Regulator's guidance for new employers states that "your automatic enrolment duties start when you employ your first member of staff", and that "automatic enrolment is your legal duty and if you don't act in time you could be fined". There is a declaration deadline as well as an enrolment duty, and missing the declaration is a common failure even where people were enrolled correctly.

Employers' liability insurance belongs on the same day-one list, our post on employers' liability insurance covers the £5 million minimum and the certificate rules.

Records, data and the workplace

Keeping "employee information and data safe" is one of the government's six steps rather than an optional extra. That means knowing what personal data you hold about staff, why, and for how long.

The workplace duties sit alongside: preventing discrimination, making the workplace accessible to employees with disabilities or health conditions, fire safety, and health and safety.

Sector rules sit on top of all this. Regulated professions, safeguarding, and licensing regimes add duties that a general list cannot cover. This is general information rather than legal advice.

If you are already behind

Most organisations reading this are not starting from zero. They are employing people and discovering gaps. The order that limits damage:

1. Anything with a live penalty. Missing employers' liability insurance is charged per day; unenrolled staff and missed declarations accrue.
2. Anything owed to a person. Written statements not issued, pay below the minimum wage, holiday not given.
3. Anything that gets worse with time. Missing right to work checks on current employees, and records nobody can locate.
4. Everything else, with a date and an owner rather than a resolution to improve.

Do not start with a policy document. A handbook full of policies in an organisation with no written statements is compliance theatre.

A checklist

Before the first day: employment status decided, right to work checked, PAYE registered, employers' liability insurance in place, pension scheme identified.

On the first day: principal statement issued.

Within one month: changes to the statement communicated as they happen.

Within two months: wider written statement issued.

Ongoing: payroll reporting each pay run, pension contributions and declaration, records kept and secured, workplace duties reviewed.

Our HR management post covers the wider function this sits inside.

Frequently asked questions

What is HR compliance?

Meeting the legal duties that come with employing people: employment status and pay, a safe and accessible workplace, PAYE registration, pension automatic enrolment, employers' liability insurance, right to work checks and the written statement of particulars. GOV.UK publishes the sequence for a first-time employer.

What must an employer give an employee on their first day?

The principal statement, the main part of the written statement of employment particulars. GOV.UK is explicit that it must be provided "on the first day of employment", with the wider written statement following within two months.

What is in a written statement of employment particulars?

At minimum the names, job title or description of work and start date, pay and pay frequency, hours and days of work and how they vary, holiday entitlement, work location and any relocation, expected duration, probation terms, other benefits, and obligatory training.

Do you have to check right to work for British citizens?

Yes, and the method differs. British and Irish citizens cannot get an online share code, so you check original documents or use an identity service provider. Checking everyone in the same way at the same stage is what keeps the process both compliant and non-discriminatory.

When do pension duties start?

When you employ your first member of staff. The Pensions Regulator calls this the duties start date and warns that automatic enrolment is a legal duty which can attract a fine if you do not act in time. There is a declaration deadline as well as the enrolment itself.

What is payroll compliance?

Registering with HMRC as an employer before the first payday, calculating and deducting the right amounts, issuing payslips, and reporting each pay run on time. The obligations are dated, which makes them unusually easy to audit.

Do these rules apply to workers as well as employees?

The written statement does, GOV.UK says employers must give it to "employees and workers". Other duties depend on status, which is why the government's first step is deciding what status you are taking somebody on under.

Your next step: audit the day-one list

1. Pick three current employees and find their principal statements.
2. Check the date each was issued against the start date.
3. Confirm the right to work check exists for each, in the same form.
4. Check the pension declaration was made, not just the enrolment.

For the wider function these duties sit inside, read and download our human resources management guide. The guide is free to read, and the PDF uses our short download form.

Want each of these steps to have an owner and a due date rather than a good intention? Book a New Dynamics demo and bring your onboarding process. You can also email contact@new-dynamics.com.