Right to Work Compliance: How Employers Avoid Costly Penalties

Employers in the UK face significant responsibility to ensure every worker has the legal right to work. A robust right to work compliance process protects the business from employer penalties, supports safer hiring and demonstrates good governance under Home Office rules. This article explains practical steps, legal obligations and real-world examples HR teams can use today.

Why a consistent right to work check matters

Carrying out a reliable right to work check is not merely administrative: it is the primary defence against civil and criminal sanctions. The Home Office makes clear that an employer who fails to check properly can be liable for civil penalties (and in serious cases criminal prosecution). Completing the correct check can create a statutory excuse against a civil penalty for employing an illegal worker.

What creates a statutory excuse?

A statutory excuse is generally achieved by following one of the Home Office-approved procedures at the time of hiring. For most employees this means obtaining specified documents, or conducting an online right to work check that produces a share code and a recorded result from the Government service. To maintain the statutory excuse you must:

• carry out the check before the employment starts (or as required by the Home Office guidance);
• rely on the original documents or the certified online check result including share code details;
• retain a copy of the evidence in your records for the required retention period.

Practical steps HR teams should adopt

Implementing a straightforward, auditable process reduces the risk of errors and demonstrates compliance if inspected. Consider these steps:

• Standardise your checklist: Create a short, role-specific right to work checklist and ensure all hiring managers use it. Include whether an online check (share code) or manual document check is required.
• Use the Home Office service correctly: When an individual provides a share code, verify the result on the Government portal and save a screenshot or PDF showing the date, time, applicant name, restrictions and share-code reference.
• Retain evidence securely: Keep copies of checks for the duration of employment and for two years after employment ends as the Home Office recommends. Align this with your GDPR retention records to justify processing.
• Automate where appropriate: Digital identity checks reduce human error and create auditable trails. Where using third-party providers, ensure they meet security standards and that you can access stored evidence when needed.
• Train staff and update procedures: Regular refresher training for HR and hiring managers reduces inconsistent practice and helps spot counterfeit documents or suspicious share codes.

Real-world examples

Example 1 — hospitality employer: A small restaurant used a simple paper checklist and took photocopies of passports. When the Home Office visited, the employer presented dated stamped copies and a hiring log. Because checks were conducted before employment began and evidence retained correctly, the employer established a statutory excuse and avoided a civil penalty after a compliance visit.

Example 2 — contractor engagement: A recruitment agency hired a contractor with time-limited permission to work. The agency failed to re-check before the permission expired. A subsequent Home Office inspection led to a civil penalty. The lesson: implement automatic reminders for re-checks for limited-time permissions and retain the re-check evidence.

Handling online checks and share codes

The Government’s digital check produces a share code that applicants provide to employers. Best practice when using share codes:

• ask the candidate to generate a new share code on the day of their check and show you the live result;
• view and download the result on the Government portal immediately, or capture a secure screenshot showing the share code, date and time;
• store the result with the candidate’s recruitment file and note who carried out the check.

Regulatory and data protection considerations

Right to work checks cross into several regulatory areas. Identity proofing standards such as GPG45 offer practical guidance on verifying identity in higher-risk settings — consider your sector’s needs and consult the GPG45 identity proofing guidance where appropriate. Additionally, records from checks contain personal data so you must process and store them lawfully under GDPR: establish a clear lawful basis (typically legal obligation), minimise held data and implement secure access controls.

For broader policy alignment and updates, see our article on practical right to work compliance which covers check types and retention in more detail: practical right to work guidance.

Preparing for Home Office visits and audits

Inspections typically focus on whether checks were conducted correctly and evidence retained. Prepare by:

• keeping an up-to-date central record of checks with dates, who checked and what was seen;
• maintaining a documented policy that explains how temporary staff, remote hires and contractors are verified;
• running internal audits quarterly to identify gaps and fix them promptly.

Conclusion

Right to work compliance is an ongoing obligation that combines legal understanding, practical process design and secure record-keeping. By standardising checks, using the Home Office online service correctly (including share codes), applying GPG45 where relevant and embedding GDPR-friendly data practices, employers can secure a statutory excuse and significantly reduce the risk of employer penalties. Regular training, simple automation and documented retention policies make the difference between a defensive posture and confident compliance.

If you want help reviewing processes or implementing digital checks, VerifyOnline provides tailored solutions for UK HR teams to simplify right to work checks while maintaining robust audit trails.