14% of UK workers experienced at least one clear legal violation in the two years before a major government survey, representing roughly 5.4 to 5.8 million workers. Compliance in the workplace is therefore both a legal duty and an operational challenge, and modern HR platforms can help organisations manage the evidence, approvals and review dates involved.
That finding changes how leaders should think about compliance. It isn't a narrow onboarding task owned solely by HR. It includes lawful pay, payslips, annual leave, working arrangements, health and safety, employee data, training, documentation and the controls applied to people who work through agencies, suppliers or platforms.
For UK organisations, the timing matters. The UK's illegal-working regime is set to extend from 1 October 2026 to workers, individual subcontractors and online matching services, alongside direct employees. Employers that have only documented their permanent hiring process may therefore have a significant governance gap across procurement, operations and contingent labour.
Table of Contents
- Why Workplace Compliance Matters Now
- Key Compliance Obligations for UK and EU Employers
- How to Manage Compliance Across the Employee Lifecycle
- Using Microsoft Technology to Support Compliance Processes
- Real-World Compliance Challenges and How to Overcome Them
- Building a Compliance-Ready Organisation
Why Workplace Compliance Matters Now
The scale of workplace harm makes compliance more than an administrative exercise. The UK government's Working Lives research found that 7 in 10 workers had experienced at least one of eight main issues examined, including clear and potential legal violations and other harmful workplace practices. The report estimated that this affected 26.6 to 28.7 million workers across the UK. (UK government research on labour market non-compliance)
The same research quantified 155 clear legal violations per 1,000 workers across the full workforce, rising to 287 per 1,000 among precarious workers. That distinction matters because organisations often concentrate their strongest controls on standard employees while relying on informal arrangements for temporary, outsourced or irregular labour.
Compliance reaches beyond immigration checks
Right to Work controls are important, but they represent only one part of the picture. Official UK labour market research estimated that 445,000 jobs were paid below the minimum wage in 2025, equal to 22% of jobs covered by the minimum wage. It also recorded 1.4 million workers in 2023–24 who reported not receiving a payslip, while 2.2 million jobs in 2025 did not include paid annual leave. (UK government enforcement and labour market findings)
These are everyday controls. A payroll interface may calculate pay, but employers still need clear ownership of rate changes, working time, leave rules and evidence. A policy may describe entitlement, but managers need a reliable process for approving leave and escalating exceptions.
For EU employers, the legal framework differs by country and subject. EU-level rules can shape areas such as working time, data protection and worker protections, but employment, payroll and tax obligations still require member-state analysis. A process that works for a UK employee may need different contracts, consultation arrangements, leave calculations or payroll controls in an EU country.
October 2026 changes the operating model
The planned UK expansion creates a practical question that many onboarding guides miss: who owns checks when the worker isn't hired directly by HR? Procurement may manage a supplier, operations may supervise the work, and HR may hold the only compliance expertise. Without a clear control model, each function can assume another team has retained the evidence.
A resilient approach maps every labour route, assigns ownership, defines evidence requirements and schedules reviews. The remaining sections set out the legal foundations, lifecycle controls and Microsoft-based technology approach that can help turn that model into daily practice.
Key Compliance Obligations for UK and EU Employers
Employers need a compliance register that distinguishes legal duties, internal policy controls and evidence requirements. Treating all three as interchangeable creates confusion. A legal duty may require a check or entitlement, while best practice determines how the organisation assigns, records and reviews that control.
UK duties
Before employment starts in the UK, an employer must conduct a Right to Work check using a prescribed method. Depending on the worker's status, that may involve the Home Office online share-code service, original documents or an identity service provider using identity document validation technology. The employer must keep copies or records so it can establish a statutory excuse against civil penalties. (Home Office employer guidance on Right to Work checks)
Employers can face a fine of up to £20,000 if they can't show evidence that they checked an employee's right to work in the UK. (GOV.UK employer checks guidance) That makes evidence retention a core control, not a filing preference.
Pay and leave require equal discipline. Minimum wage assessments, payslips and paid annual leave should be represented in policies, payroll processes and management reporting. The figures cited above show why a narrow focus on immigration status can leave significant statutory rights unmanaged.
Recordkeeping also needs a defined retention policy. UK government human resources records guidance says some core HR records should be kept until the employee is 85 years old and then reviewed. If the employee remains employed, those records should be kept until the last day of service plus one year, while other operationally relevant records may be kept for a further three years. (UK human resources records guidance)
EU requirements need local interpretation
EU organisations must separate EU-wide principles from member-state rules. GDPR affects how employers collect, access, share and retain employee information, but the lawful basis, transparency wording and employment-law context should be reviewed for each relevant jurisdiction. Employers should also assess working time, consultation, whistle-blower protection, health and safety, payroll and leave obligations at country level.
A data processing agreement can form part of the supplier governance around HR technology and outsourced processing. Organisations that need to review the practical detail can browse 2026 DPA requirements, then confirm the position with their privacy and legal advisers.
Contingent labour is the overlooked control surface
From 1 October 2026, the UK regime is set to cover workers, individual subcontractors and online matching services. (EY analysis of the wider UK Right to Work scope) Organisations should therefore map agency staff, subcontractors, gig workers, platform-based labour and supplier-managed teams before the change takes effect.
The operational choice may be centralised checks, supplier-owned checks or a hybrid arrangement. Whatever model an organisation adopts, its contracts should define responsibilities, the evidence to provide, access rights, repeat-check triggers and audit support. Read the practical implications in this guide to Right to Work checks for employers.
How to Manage Compliance Across the Employee Lifecycle
A reliable compliance process follows the person, not just the vacancy. Each stage creates evidence that someone may need to retrieve later, and each hand-off creates an opportunity for a record to be incomplete, duplicated or overlooked.
Recruitment and onboarding
Start with a control gate before the employment start date. The recruiter or HR operations team should record which Right to Work route was used, when it was completed, what evidence was reviewed and who completed the check. The system should prevent the process from moving to a confirmed start where the required evidence is missing.
For online checks, the employer uses the worker's share code and date of birth. If permission is time-limited, the employer must repeat the check when that permission expires. (GOV.UK Right to Work checking service) Biometric residence cards and permits can no longer be accepted for this process, so older checklists and manager guidance should be reviewed.
Onboarding then extends beyond immigration status. Contracts, policies, tax information, emergency contacts, mandatory training and role-specific certifications should each have an owner and completion status. Don't store these items as unstructured email attachments if the organisation needs to prove when they were issued, accepted or renewed.
During employment
Leave and absence records should reflect the applicable policy and jurisdiction. Training records need course details, completion dates, renewal dates and any certificate or qualification that affects the employee's work. Performance reviews can also create compliance evidence when they document objectives, capability concerns, support provided and agreed actions.
A practical lifecycle record should answer four questions:
- What was required?
- Who completed or approved it?
- When was it completed?
- What happens next, if the permission or qualification expires?
Practical rule: A reminder without an accountable owner is only an alert, not a control.
The organisation should also define how managers receive tasks. A manager who can approve leave in Microsoft Teams may need a different notification from HR, while a compliance administrator may need an exception queue containing overdue or incomplete records.
Reviews and exit
At review points, HR should check that permissions, certifications, policies and role data remain current. A change in role, location, contract type or supplier relationship may trigger a new assessment. This is particularly important when an organisation uses multiple labour models.
Offboarding should close active access and preserve records according to the approved retention schedule. The process should identify which documents must be retained, which data should be restricted and which information should eventually be deleted or reviewed. The HR records guidance cited earlier shows why retention can extend far beyond the employee's final working day.
The lifecycle model is easier to maintain when each event produces a structured record rather than a message in a shared inbox. Workflow design and a controlled data model become as important as the policy itself.
Using Microsoft Technology to Support Compliance Processes
Manual spreadsheets can work for a small, stable team, but they become fragile when records change frequently, several people approve tasks or evidence sits across email, shared drives and HR folders. The core issue is not just the number of records. It is whether the organisation can identify the current status, find the supporting evidence and explain who performed each action.
A controlled data foundation
HRManagement365 is a UK and EU HR solution powered by Hubdrive and Microsoft technology. It is based on Microsoft Dynamics 365, Power Platform and Dataverse, and can connect HR processes with Microsoft 365 services and Dynamics 365 business systems.
Dataverse can provide structured tables, relationships, security roles and business data rules. Power Apps can present forms for HR, managers and employees, while Power Automate can route approvals, send reminders and create escalation paths. These are standard Microsoft capabilities, but the compliance outcome depends on how the organisation configures them, governs access and defines its processes.
Power BI can help present current HR information through reports and dashboards. A compliance report might show open checks, upcoming permission reviews, incomplete training or missing documentation. It shouldn't be treated as proof that every legal obligation has been satisfied. It's a management view that helps people identify what needs attention.
Configuration versus custom development
Hubdrive and Microsoft functionality can provide a foundation for employee records, workflows, documents, security and reporting. HRManagement365 extends that foundation through its own expertise, integrations, customisations, workflows and HR applications.
For example, HRManagement365 can configure or develop processes for Right to Work evidence capture, expiry management, reminders and auditable history. Those features should be described accurately as configured or extended functionality, not as a claim that Microsoft products independently determine compliance.
A platform can organise evidence and automate tasks. It can't replace legal interpretation, accountable decision-making or periodic policy review.
Connecting HR and finance
Integration matters when compliance data affects payroll, planning or operational access. HRManagement365 can support connections with Dynamics 365 Business Central, Finance & Operations and other Dynamics 365 processes, helping reduce re-keying between workforce and business records.
The appropriate design depends on the organisation's existing architecture. Some employers may need employee master-data synchronisation, others may require absence and time information for payroll or operational planning. HR teams should document the source of truth, synchronisation rules, exception handling and access permissions before automating the flow.
A connected platform can therefore replace several fragile hand-offs, but implementation should begin with the control requirement. The technology should make the policy executable, visible and reviewable.
For a broader view of how a central HR platform can organise employee data and processes, see this HR management information system guide.
Real-World Compliance Challenges and How to Overcome Them
Consider a UK mid-market organisation with permanent employees, agency workers and subcontractors. HR keeps Right to Work documents in a spreadsheet, managers email leave approvals to a shared inbox, training certificates sit in personal folders and supplier evidence is collected only when somebody asks for it.
Nothing appears broken on an ordinary day. The risk becomes visible when a permission expires, a manager changes role, an auditor requests a record or the organisation needs to establish which party completed a check. HR staff then search across email threads, spreadsheets and folders, while managers wait for answers that should have been available from a controlled record.
The move from fragmented records
The organisation's first step is not to automate everything. It maps the lifecycle and identifies ownership. Recruitment owns the pre-employment gate, HR operations owns employee records, managers own approvals and procurement owns supplier evidence, with escalation to a central compliance or HR governance team.
The organisation then creates a connected workflow using its Microsoft environment. Structured records hold status and dates, documents are associated with the relevant person or engagement, and Power Automate can issue reminders for review points. Teams-based self-service can help managers complete routine tasks without giving them unrestricted access to sensitive employee information.
The change is operational rather than cosmetic. HR no longer has to reconstruct a history from messages, and managers receive a clear task instead of an informal request. Reports can identify exceptions, while audit preparation becomes a matter of reviewing controlled records and access permissions.
Include safety and supplier controls
Workplace compliance also includes practical safety responsibilities. A lone worker process should define risk assessment, communication, escalation and incident handling. Organisations reviewing that area may find it useful to write a lone worker policy that works, then configure the resulting responsibilities within their own governance framework.
The organisation still needs legal advice where the facts are complex. Technology doesn't decide whether a worker is correctly classified, whether a specific document is sufficient or whether a local EU rule applies. Its value is in making the agreed process consistent, visible and easier to audit.
Building a Compliance-Ready Organisation
Compliance in the workplace becomes sustainable when four elements work together: clear legal interpretation, assigned ownership, reliable evidence and repeatable workflows. A policy without a process is difficult to operate, while a workflow without proper legal design can automate the wrong action.
UK organisations should prepare for the wider labour models covered by the planned October 2026 changes. EU organisations should maintain a country-aware compliance register that separates EU principles from member-state employment, payroll, tax, consultation and privacy requirements. Both need a lifecycle view that continues through role changes, renewals and exit.
HRManagement365, powered by Hubdrive and Microsoft, can help organisations improve, connect and automate HR processes across the UK and EU. Its approach combines implementation and consultancy with configuration, custom workflows, integrations, Power Apps, Power Automate, reporting and custom HR applications where standard functionality doesn't cover a customer-specific process. A controlled HR document centre can also support consistent document organisation and retrieval.
HRManagement365 can help you design Right to Work evidence trails, lifecycle workflows, approval processes and reporting across your Microsoft environment, including integrations with Business Central and Finance & Operations. Speak with the HRManagement365 team about your current compliance gaps and visit HR Management 365 to arrange a practical conversation, or call +44 1522 508096 today.
