HR system for small companies: what UK law makes you keep

The first HR system conversation in a small company almost never starts with software. It starts with a question nobody can answer. How long do we keep the leaver's file. Where is the copy of the passport we checked in 2022. Did anyone write down the risk assessment, and were we supposed to.

Feature lists are no help here, because they describe products rather than duties. A more reliable method is to work backwards from the records the law already requires, name the period each one has to survive, and only then ask what has to hold them. This article does that for payroll and PAYE, right to work evidence, working time and holiday, pension auto enrolment, health and safety, and data protection, and it ends with the honest answer about spreadsheets.

Records fail at handovers rather than at storage: a starter whose check was never filed, a leaver nobody deleted. New Dynamics workflows put an owner and a date on each of those steps so the task reaches a person instead of a shared inbox.

Two disclosures. New Dynamics, whose blog this is, is a performance management platform for goals, feedback, recognition, reviews and onboarding. It is not a core HR system of record, not payroll and not a compliance register. No products are named below, ours included, no prices are quoted and nothing here is a ranking. The jurisdiction is the United Kingdom throughout, and this is general information rather than legal advice.

Why this is the normal case, not the edge case

Most UK employers are very small. The Department for Business and Trade's Business population estimates for the UK and regions 2026, published on 5 November 2026 for the start of 2026, reports that of 5.6 million private sector businesses, "1.5 million (26%) businesses had employees". Its Table C puts 1,198,870 of those employers in the 1 to 9 employees band. More UK employers sit below ten people than above it, which is why the five-employee thresholds further down decide so much.

Payroll and PAYE: three years, and six for the minimum wage

GOV.UK's guidance on keeping payroll records lists what you must collect: what you pay employees and the deductions you make, your reports to HMRC, your payments to HMRC, "employee leave and sickness absences", tax code notices, taxable expenses or benefits, and Payroll Giving documents. Then the period: "Your records must show you've reported accurately, and you need to keep them for 3 years from the end of the tax year they relate to." And the consequence: "If you do not keep full records, HMRC may estimate what you have to pay and charge you a penalty of up to £3,000."

Notice "employee leave and sickness absences" sitting inside a payroll duty. Absence is not a nice-to-have report. It is part of the record HMRC can ask for.

The same page says different rules apply to proving two things, and the first doubles the period. GOV.UK's guidance for employers and the minimum wage states that minimum wage records "must be kept for at least 6 years" where they "were created on or after 1 April 2021", and that the period "starts from the last day of the pay reference period after the one they cover". Our post on payroll records covers the register itself.

So one hire creates a three-year obligation and a six-year obligation in the same month, from the same facts.

Right to work: the evidence that buys a statutory excuse

Here the record is the whole point, because the check protects you only if you can produce evidence of it.

The Home Office's Employer's guide to right to work checks, in the version dated 1 October 2026, defines the prize: "If checks are conducted as prescribed by the Home Office in legislation and statutory codes of practice in force at the time the check was made, employers will have a statutory excuse against liability for payment of a civil penalty." Its glossary calls that "an employer's defence against liability for payment of a civil penalty, which is established where the employer carries out prescribed right to work checks before the worker commences employment". GOV.UK's page on penalties for employing illegal workers gives the number it is a defence against: "a civil penalty (fine) of up to £60,000 for each illegal worker".

The filing instruction is explicit. GOV.UK's guide to checking a job applicant's right to work says to "keep copies during the applicant's employment and for 2 years after they stop working for you" and to "record the date the check was made". The employer's guide ends the period in deletion rather than storage: copies must be "kept securely for the duration of the worker's employment and for two years afterwards. The file or document must then be securely destroyed."

Three requirements fall straight out of that. An unalterable copy. A stored check date, separate from the copy. And a prompt about two years after a leaving date telling you to destroy the file. Add a fourth for anyone with time-limited permission, because GOV.UK says that "if your employee's right to work is time-limited, you'll need to check their documents again when it's due to expire". That is a diary entry per person, not a policy.

Working time and holiday: two years, and no prescribed format

Working time is the duty most often assumed to require a timesheet. It does not.

Regulation 9 of the Working Time Regulations 1998 requires an employer to "keep records which are adequate to show whether the employer has complied with the limits specified in regulations 4(1), 5A(1) and 6(1) and (7)" and to "retain such records for two years from the date on which they were made". Two paragraphs inserted on 1 January 2024 by the Employment Rights (Amendment, Revocation and Transitional Provision) Regulations 2023 soften the method considerably. Records "may be created, maintained and kept in such manner and format as the employer reasonably thinks fit", and "an employer need not record each worker's daily working hours in order to comply with paragraph (1) if the employer is able to demonstrate compliance without doing so".

Holiday is the second of GOV.UK's different rules, because you have to prove you provided the correct statutory leave and paid the correct holiday pay. The entitlement being evidenced is on GOV.UK's holiday entitlement page: "Almost all people classed as workers are legally entitled to 5.6 weeks' paid holiday a year", and "statutory paid holiday entitlement is limited to 28 days".

For a small employer that means a running balance per worker, with dates taken and the pay applied, satisfies more than one duty at once. A shared wall calendar does not, because it will not survive two years and cannot be produced per worker.

Pensions: day one, five months, then every three years

Auto enrolment is where small employers are most often late, because the duty does not wait for a headcount.

The Pensions Regulator is unambiguous about when it starts. On its page for new employers: "Your workplace pension legal duties begin on the day your first member of staff starts work. This is known as your duties start date. Even if you think you won't need to put your staff into a scheme, you'll still have duties." The paperwork has its own deadline: "You must do this within 5 months after your duties start date." TPR adds that even where somebody else completes it, "it is your legal duty to make sure that the declaration is completed on time and the information entered is correct. If not, you may be fined."

Then it returns. TPR's page on re-enrolment and re-declaration states: "Every three years you must put certain staff who have left your pension scheme back into it. This is called re-enrolment. Whether you have staff to put back into your scheme or not, you must complete a re-declaration of compliance to tell us how you have met your duties." Its detailed guidance adds the date you get to choose, which is worth putting in a calendar now: the employer "may choose this date from any date that falls within a six-month window, starting three months before the third anniversary of their original staging date or duties start date and ending three months from that anniversary".

On retention, TPR's detailed guidance on keeping records sets two periods: "Most of these records must be kept for a minimum of six years, with the exception of those relating to opt-outs, which must be kept for four years." It also allows reuse of what you already have, with one exception that matters for any system you buy. "Employers can use their existing business documentation (eg payroll records) for the purpose of collecting and storing records, but should note that the notices (an opt-in notice, joining notice or opt-out notice) must be retained in the original format, as this is proof of an individual exercising a right." Our post on auto enrolment thresholds covers the earnings figures behind each category.

Health and safety: five employees is the line that matters

Two duties change at five employees and are often confused with each other, so take HSE's own wording for both.

On recording an assessment, HSE's guidance on steps needed to manage risk says: "If you employ 5 or more people, you must record your significant findings." It lists three things to record: the hazards, who might be harmed and how, and what you are doing to control the risks. It also warns against treating the file as the job: "Do not rely purely on paperwork as your main priority should be to control the risks in practice."

On the policy, HSE's guidance on preparing a health and safety policy is separate and differently worded: "The law says that every business must have a policy for managing health and safety." Then the threshold: "If you have five or more employees, you must write your policy down. If you have fewer than five employees you do not have to write anything down, but it is useful to do so."

Read together, the position for a four-person employer is clear. You must assess your risks and you must have a policy. You are simply not required to write either one down. Our post on risk assessment sets out the regulation behind the recording duty.

Data protection: the one duty with no fixed period

Everything above gives you a number. This one deliberately does not.

The ICO's guidance on collecting and keeping employment records states it plainly: "Data protection law does not set specific time limits for how long you can keep your workers' personal information. This is up to you, and will depend on how long you need the information for your particular purposes." It then rules out the obvious shortcut: "Do not take a 'one-size-fits-all' approach to retaining workers' personal information."

What the ICO asks for instead is a schedule. You "should set up a retention policy or schedule" listing "the types of record or information you hold", "what you use it for" and "how long you intend to keep it". On tooling, its guidance is one sentence and worth quoting to any supplier: "Where possible, you could set up automated systems to help with this process, which would flag when information you are holding is due to be reviewed or deleted."

Two more lines are system requirements in disguise. Access must be controlled, "for example, ensuring that access to employment records systems is limited to HR staff only, and that managers only have access to the information they need to meet their obligations". And the file has to outlive the manager: "you could store employment records centrally rather than locally, so you are not dependent on the availability of individual managers for access". Our post on employee records retention builds the schedule itself.

What this means when you choose a system

Turn the six duties into questions and the shortlist narrows fast.

1. Can it hold a different retention period per record type? At least four periods run at once. A single global setting cannot express three years, six years, employment plus two years and two years from creation.
2. Does it delete, or only store? The right to work rule ends in secure destruction, and the ICO asks for a flag when information is due for review or deletion.
3. Can it keep a document unaltered, with a separate check date? Both the copy and the date of the check are part of the right to work evidence.
4. Does it produce a per-worker, per-period output? GOV.UK requires that employers "must be able to produce records for an individual pay reference period in a single document".
5. Can access be restricted by role? Managers see what managing requires, and no more.
6. Can you get your data out? Your duties run for six years. Your contract probably does not.

None of those is a feature name, which is the point. Our vendor-neutral guide to HR software selection covers the wider evaluation, including the four product categories people confuse, and our HRIS selection guide turns it into a scorecard.

When a spreadsheet is still enough

Often, honestly. The official sources are more relaxed about format than most buying advice admits.

GOV.UK says minimum wage records "do not have to be kept in any particular form, for example they can be paper or computer records". The Working Time Regulations let you keep records "in such manner and format as the employer reasonably thinks fit". TPR lets you use "existing business documentation (eg payroll records)". No official source names a product, a category of product or a headcount at which software becomes a legal requirement, because none exists.

A spreadsheet plus a document folder is defensible when all of this is true: one named person maintains it, it is backed up and access-controlled, every record carries a date, you can produce one worker's pay reference period as a single document, and something outside the spreadsheet reminds you about the follow-up check, the re-enrolment window and the deletion date.

It stops being enough when those reminders depend on somebody remembering. That is usually a change in pattern rather than size: your first worker with time-limited permission to work, your first year with real turnover, the arrival of a second person who needs the file. Our overview of HR tools sets out what teams of different sizes typically end up running.

Frequently asked questions

Does a small company legally need an HR system?

No. No UK source names software as a requirement. The duties are to keep particular records for particular periods, and GOV.UK says minimum wage records "do not have to be kept in any particular form, for example they can be paper or computer records". Regulation 9 of the Working Time Regulations 1998 lets you keep records in whatever manner and format you reasonably think fit. What you cannot do is fail to produce them.

How long must a small employer keep payroll records in the UK?

GOV.UK states that payroll records must be kept "for 3 years from the end of the tax year they relate to", and that failing to keep full records can mean HMRC estimating what you owe and charging "a penalty of up to £3,000". Records proving you paid the minimum wage run longer: at least 6 years where they were created on or after 1 April 2021.

How long do we keep a copy of a right to work check?

For the person's employment and two years after it ends, then destroy it. GOV.UK says to "keep copies during the applicant's employment and for 2 years after they stop working for you", and the Home Office employer's guide adds that the file "must then be securely destroyed". Keeping it longer becomes its own data protection problem.

Do we need a written risk assessment with four employees?

No, but you still need the assessment. HSE states that "if you employ 5 or more people, you must record your significant findings". Separately, on the health and safety policy, HSE says that "if you have fewer than five employees you do not have to write anything down, but it is useful to do so". The duties to assess risks and to have a policy apply whatever the headcount.

When do pension duties start for a new small employer?

On day one of your first employee. The Pensions Regulator says "your workplace pension legal duties begin on the day your first member of staff starts work", and that this is your duties start date. The declaration of compliance is due within 5 months after that date, and re-enrolment comes round "every three years".

How long should we keep employee files generally?

There is no single answer, and the ICO says so: "Data protection law does not set specific time limits for how long you can keep your workers' personal information." Write a retention schedule listing what you hold, why, and for how long, and let the statutory periods above set the floor for the record types they cover.

Your next step: build the schedule before the shortlist

Take one recent hire and one recent leaver, and list every record you created about each of them. Put the statutory period beside each one, using the sources linked above, and mark the three entries that carry a date you would have to act on: the follow-up right to work check, the re-enrolment window and the right to work destruction date. That list is your requirements document, and it will tell you in an afternoon whether a spreadsheet is still coping.

If the gap turns out to be process rather than storage, that the facts never reach the person who has to act on them, Book a New Dynamics demo and bring that list. You can also email contact@new-dynamics.com.