Right to Work Compliance: Practical Steps for HR Teams in the UK

Right to work compliance is a critical obligation for UK employers. Getting checks wrong can lead to significant employer penalties and reputational damage, while a robust process protects your business and creates a fair, consistent hiring experience. This article explains practical steps HR teams should follow, how to use the Home Office share code service, and how to preserve a statutory excuse against civil penalties—while meeting data protection obligations.

Why right to work checks matter

Employers must prevent illegal working by checking that every prospective employee has the legal right to work in the UK. The Home Office sets out the prescribed checks that create a statutory excuse to defend against civil penalties where an individual turns out to be an illegal worker. Failure to follow those checks can attract civil penalties (up to £20,000 per illegal worker) and may expose employers to criminal liability in deliberate breach cases.

Prescribed checks: what to do and when

There are two main routes for checks:

• Manual document checks – examine original documents (passport, biometric residence permit, birth certificate plus proof of permanent National Insurance, etc.) in the employee's physical presence and take appropriate copies or retain a scanned image where permitted.
• Digital checks using a share code – where a prospective employee has permission recorded digitally with the Home Office, they can provide a share code and date of birth so an employer can view and record their online right to work record.

For time-limited permissions you must re-check before the permission expires to maintain a continuous statutory excuse. For many HR teams the digital route using the Home Office online service is the most efficient—but it must be done correctly and the evidence retained.

Using the Home Office share code

The applicant generates a share code and provides it to you together with the date of birth. You use the Home Office online service to view the applicant's record and must retain a copy of the outcome—for example, a screenshot showing the name, right to work status and expiry date, plus the date you checked. Record-keeping is essential: without retained evidence you cannot rely on the statutory excuse.

Practical steps for HR teams

• Create a documented policy – ensure your right to work procedure is part of recruitment training and accessible to hiring managers.
• Standardise evidence capture – use consistent templates for recording manual checks and a secure process for storing digital screenshots from share code checks.
• Train staff – appoint trained staff to carry out checks. A common failure is inconsistent treatment of documents or missing re-check dates.
• Automate reminders – track expiry dates for limited permissions and set automated reminders well before re-checks are due.
• Verify doubtful documents – if a document looks suspicious, do not proceed; escalate to a designated compliance lead and consider using specialist verification services.

Real-world examples

Example 1: An agency worker provided a share code showing time-limited permission valid for six months. The HR team recorded the screenshot and scheduled a re-check one month before expiry. When the re-check revealed permission had not been renewed, the agency and employer were alerted and the worker’s role was suspended until new evidence was provided. Because checks had been carried out and evidence retained, the employer kept the statutory excuse.

Example 2: A small business accepted a photocopy of a passport by email and did not retain a dated record of the check. Later the Home Office investigation found the passport was forged. The employer could not demonstrate a prescribed check had taken place and therefore faced a civil penalty. This illustrates why retention of evidence and doing checks in the prescribed manner is non-negotiable.

Data protection and record keeping

Right to work evidence contains personal data and might include special category data (e.g. immigration status details). Under GDPR you must have a lawful basis for processing and ensure records are kept securely and only for as long as necessary. Practical measures include encrypted storage, access controls, and clear retention policies that align with employment and immigration risk (for example, keep records throughout employment plus a reasonable period afterwards, defined in your data retention schedule).

Further compliance considerations

• Follow Home Office guidance – the Home Office publishes detailed Right to Work guidance. Documented adherence protects your business and staff from inadvertent non-compliance.
• Use technology sensibly – digital identity and biometric tools can streamline checks and reduce fraud risk, but they should be implemented in line with GPG45 identity-proofing principles where applicable. For more on implementing GPG45-consistent processes, see our practical guidance on GPG45 identity proofing.
• Integrate fraud prevention – combine right to work checks with broader identity verification measures to spot inconsistencies early; our article on fraud prevention strategies outlines practical measures HR teams can adopt.

Maintaining a defensible position

To secure the statutory excuse you must be able to show: the prescribed check was carried out before employment began, the result was recorded and retained, and any follow-up checks were completed for time-limited permissions. Regular audit of right to work checks, training updates for hiring managers and prompt action when documents or digital checks raise questions will materially reduce risk.

Final checklist for HR

• Have a documented right to work policy and trained checkers.
• Use the Home Office share code correctly and retain dated evidence.
• Record manual checks, keep secure copies where permitted, and set re-check reminders.
• Protect personal data under GDPR with clear retention and security controls.
• Escalate suspicious cases and consider specialist identity verification support.

Right to work compliance is more than a formality: it's a risk-management activity that protects both the business and its workforce. By following Home Office rules, keeping accurate records and embedding good practice into recruitment, HR teams can avoid employer penalties and maintain operational resilience.