Right to Work Compliance: Practical Guidance for UK Employers

Right to work compliance remains a core responsibility for UK employers. With evolving Home Office guidance, expanding digital checks and significant employer penalties for non-compliance, HR teams need clear processes that meet legal tests while protecting applicant data under GDPR.

Why right to work checks matter

Employers who fail to carry out appropriate right to work checks risk civil penalties of up to £20,000 per illegal worker and potential criminal charges where there is knowingly unlawful employment. Equally important is establishing a statutory excuse against civil penalties by following the prescribed Home Office checks and retaining evidence of those checks.

Prescribed checks: physical documents and the online share code

The Home Office provides two common routes for checks:

• Manual document checks – inspecting original, physical documents such as passports or biometric residence permits. Employers should check the document, record the document type, number, and expiry date and keep a clear copy.
• Digital checks via share code – workers with a digital status can generate a share code from the government service. Employers use the share code alongside the applicant's date of birth to view and record their right to work status online.

Practical tip: share codes are time-limited (the Home Office service typically issues codes valid for 30 days). Always verify the status at the point of hire and capture a screenshot or PDF of the online status page with the date and your company details recorded to preserve the statutory excuse.

Creating and preserving a statutory excuse

To secure the statutory excuse, follow the Home Office’s prescribed steps exactly. For a manual check this means physically examining the original documents and keeping a clear copy; for an online check using a share code you must record the date of the check, the share code used and a dated screenshot of the result. In either case, logging who carried out the check and where it was stored will strengthen your defence if inspected.

Record keeping and GDPR considerations

Retaining right to work evidence is necessary to demonstrate compliance, but it must be balanced with data protection obligations. Under GDPR, keep data minimised, store it securely, and document retention periods in your privacy notices. Conduct a Data Protection Impact Assessment where you process large volumes of sensitive identity information or use biometric checks.

Practical steps to build a robust compliance process

• Standardise onboarding: adopt a clear checklist for HR teams and hiring managers that sets out whether a manual check or online check (share code) is required.
• Train frontline staff: ensure anyone conducting checks understands how to inspect documents, how to verify digital status pages and the steps required to preserve the statutory excuse.
• Use secure systems: store copies and screenshots in encrypted HR systems with restricted access; retention and deletion schedules should be formalised.
• Record audits: maintain a simple audit log showing who performed each check and when – this is often decisive if the Home Office queries a case.

Real-world examples

Example 1: A recruitment agency hires a contractor who provides a share code. The recruiter checks the digital status, captures a dated screenshot showing permission to work, records the share code and stores it in the contractor file. Later a Home Office inspection examines the records; the recruiter can demonstrate the statutory excuse and avoids a civil penalty.

Example 2: An employer hires seasonally without consistent processes. A candidate provides copies of documents by email but the employer fails to verify originals or obtain a share code. The worker is later found to be disqualified from employment. Because the employer did not follow prescribed checks or retain valid evidence, they face a significant fine.

Managing common problem scenarios

• If an applicant cannot provide acceptable documents or a valid share code, do not proceed with employment until the check can be completed. Consider offering conditional start dates or using short-term agency staff who have verified status.
• Where digital status expires or changes (e.g. time-limited visas), set calendar reminders to re-check before the permission lapses.
• For remote hires, follow the Home Office’s guidance on acceptable remote checks and consider digital identity services that meet GPG45 standards for more secure identity proofing.

Complementary guidance and further reading

For teams implementing identity-proofing at scale, follow the GPG45 approach to ensure robust remote identity checks. Our guide on identity verification best practices covers secure onboarding workflows and record keeping. For a deeper legal perspective on Right to Work obligations and Home Office procedures, see Understanding Right to Work Compliance.

Final checklist for HR teams

• Adopt a single consistent procedure for checks and record retention.
• Train staff to perform both manual and online checks (including share code handling).
• Store evidence securely and apply retention rules aligned to GDPR.
• Schedule regular audits and update policies when Home Office guidance changes.

Right to work compliance is both a legal requirement and a reputational safeguard. By standardising checks, documenting each step and protecting personal data, employers limit the risk of costly employer penalties while treating applicants fairly and securely.