Right to Work Compliance: Practical Guidance for UK Employers

Ensuring Right to Work compliance is a legal and operational priority for UK employers. A robust approach protects your organisation from expensive employer penalties, demonstrates good governance to regulators and keeps recruitment processes fair. This guide explains practical steps, common pitfalls and real-world examples to help HR teams meet Home Office requirements and preserve a statutory excuse where possible.

What constitutes a valid right to work check?

A correct right to work check depends on the individual’s immigration status and the method of verification. For British and Irish nationals, original documents such as a passport or birth certificate can be checked in person. For non-British nationals with permission to work, the Home Office online service and the applicant’s share code are commonly used. The online check, when performed at the time of hire, creates a digital record that helps employers establish a statutory excuse against liability.

Where identity proofing is carried out remotely, follow recognised standards. The Government’s GPG45 identity-proofing principles are increasingly referenced by auditors and compliance teams — practical guidance on implementing those principles can be found in our article on GPG45 identity-proofing guidance.

Example

A London staffing agency hires a healthcare assistant who provides a Home Office share code during the onboarding call. The recruiter uses the share code to check the individual’s status in real time, records the screen output and stores the check with the candidate’s HR file. Because the check was done before the first day of work and retained correctly, the agency preserves its statutory excuse.

Practical steps to minimise risk

• Create a clear right to work policy — Specify acceptable documents, online check procedures and who in the business is authorised to perform and record checks.
• Use the Home Office online service where possible — For those able to share a code, the online check is straightforward and timestamped. Always capture the result and candidate name for your records.
• Train staff and maintain an audit trail — Poorly performed checks are a frequent cause of compliance failure. Train recruiters to spot forgeries and maintain records that demonstrate the check date and outcome.
• Inspect originals where required — If relying on physical documents, examine originals and, if you take copies, annotate them with the date and purpose of the copy.
• Regularly review ongoing permissions — Some permissions are time-limited. Set calendar reminders to re-check status ahead of expiry to avoid accidental unlawful employment.

Example

A midsize tech firm introduced mandatory training and a short checklist for all hires. After implementation, the HR director reported fewer ambiguous cases and a faster resolution when immigration questions arose. The business also reduced exposure to potential penalties by ensuring all checks were recorded and reviewed.

Understanding employer penalties and the statutory excuse

Employer penalties for hiring someone who does not have the right to work in the UK can be significant. Civil penalties may reach up to £20,000 per illegal worker; in serious or deliberate cases criminal sanctions — including fines and imprisonment — are possible. The statutory excuse is your primary defence: if you followed prescribed checks correctly and kept appropriate evidence, you are generally protected from civil penalties.

To rely on the statutory excuse you must carry out the Home Office-approved checks and retain the supporting evidence for the required retention period (usually the duration of employment and for two years afterwards). When the check is the online Home Office service, retain a copy of the digital check result that includes the candidate’s name, date of birth and check date.

Retention, GDPR and data minimisation

Right to Work checks collect sensitive personal data. Under GDPR, you must have a lawful basis to process that data — typically compliance with a legal obligation — and you must apply data minimisation and secure storage principles. Only retain documents or digital records for the minimum necessary period (the Home Office expectation is generally up to two years after employment ends) and ensure access is restricted to staff who need it.

Good practice includes encrypted storage, clear retention schedules, and written procedures for lawful disposal. Conduct a Data Protection Impact Assessment (DPIA) if you introduce new remote identity-proofing technology or share data with third-party suppliers.

Technology, audits and sector considerations

Digital identity tools can speed checks and strengthen audit trails, but choose suppliers that demonstrate compliance and data security. Integrating automated right to work checks with HR systems reduces human error and provides time-stamped evidence. For sector-specific considerations — such as finance, care or regulated industries — follow tailored guidance and ensure checks meet any additional regulatory standards; our sector guidance article explains how verification differs between industries and the extra safeguards often required for Right to Work compliance.

Final checklist for HR teams

• Adopt a documented Right to Work policy and train responsible staff.
• Use the Home Office online check and collect the share code when available.
• Annotate physical copies with the check date and the name of the checker.
• Retain records securely for the legally required period and apply GDPR safeguards.
• Schedule re-checks before time-limited permissions expire.
• Maintain an audit trail to demonstrate a consistent approach if inspected.

Right to Work compliance is an operational necessity that protects both employers and workers. By combining clear policies, staff training, reliable technology and proper record-keeping you reduce the risk of employer penalties and ensure you can evidence a statutory excuse when required. If you need to update processes, start with a simple policy review and a sample audit of recent hires — small changes now can prevent large liabilities later.