An HR compliance checklist is a systematic audit tool that verifies your organisation meets every legal obligation across employment contracts, statutory leave, workplace health and safety, data protection, and equality — before a Tribunal claim, regulatory fine, or employee complaint forces the issue. Most HR compliance failures are not dramatic breaches. They are the accumulated result of small oversights: a missing clause in a contract, a leave entitlement calculated incorrectly, a policy that was never updated after a law changed.

This checklist covers the critical compliance areas for UK employers with notes for international expansion. Use it as an annual audit framework or as a baseline when entering a new market.

Key takeaways

  • HR compliance requires annual auditing across five domains: contracts, leave, health and safety, data protection, and equality.
  • The most common compliance failures are incorrectly calculated leave entitlements, missing statutory policies, and inadequate data protection measures.
  • Employment Tribunal claims in the UK increased 35% in 2024/25 — proactive compliance is cheaper than reactive litigation.
  • International expansion multiplies compliance obligations — each jurisdiction has distinct employment law, tax, and data protection requirements.
  • This checklist is a starting point — it must be supplemented with legal advice specific to your jurisdiction and industry.

Domain 1: Employment contracts

Every employee must have a written statement of employment particulars (contract) issued on or before their first day of work [s.1 Employment Rights Act 1996].

Checklist

  1. Written statement of employment particulars issued before day one
  2. Contract includes: employer and employee names, job title, start date, salary, hours, holiday entitlement, notice periods, and place of work
  3. Contract references the applicable collective agreement (if any)
  4. Contract includes a confidentiality clause
  5. Contract includes an intellectual property clause
  6. Contract includes a restrictive covenant (where appropriate and enforceable)
  7. Contract includes a data protection/privacy notice
  8. Contract is reviewed and updated at least annually
  9. Contractor and freelancer agreements distinguish employment status clearly
  10. Right-to-work checks completed and documented before employment begins

Domain 2: Leave and statutory entitlements

Statutory leave obligations are the most frequently breached area of UK employment law.

Checklist

  1. Annual leave policy provides at least 28 days (5.6 weeks) for full-time employees, pro-rated for part-time
  2. Holiday pay calculated correctly for variable-hours workers (52-week reference period)
  3. Bank holiday treatment clearly stated in the contract
  4. Statutory Sick Pay (SSP) process documented and applied from day 4 of incapacity
  5. Maternity leave and pay provisions meet statutory requirements (52 weeks leave, 39 weeks SMP)
  6. Paternity leave and pay provisions meet statutory requirements
  7. Adoption leave and pay provisions meet statutory requirements
  8. Shared parental leave provisions included
  9. Bereavement leave (parental bereavement) provisions included
  10. Flexible working request process meets the 2-month statutory timeline
  11. Carryover rules for annual leave comply with Working Time Regulations
  12. Leave records retained for 3 years (or applicable statutory period)

Domain 3: Health and safety

Employers have a duty of care under the Health and Safety at Work Act 1974.

Checklist

  1. Health and safety policy written and reviewed annually
  2. Risk assessments completed for all work activities and reviewed regularly
  3. Workplace risk assessment for new and expectant mothers
  4. First aid provisions adequate for the number of employees
  5. Fire safety assessment completed and evacuation procedures in place
  6. Display screen equipment assessments for VDU users
  7. Stress risk assessment and mental health support provisions
  8. Accident book maintained and incidents reported under RIDDOR
  9. COSHH assessments for hazardous substances
  10. Lone working risk assessment and procedures
  11. Remote/homeworker health and safety assessment

Domain 4: Equality and anti-discrimination

The Equality Act 2010 protects employees from discrimination based on nine protected characteristics.

Checklist

  1. Equality and diversity policy in place and communicated to all employees
  2. Equal pay audit conducted (gender pay gap reporting for 250+ employees)
  3. Reasonable adjustments process documented for disabled employees
  4. Recruitment processes designed to avoid discrimination (blind CVs, diverse panels)
  5. Anti-harassment and bullying policy in place
  6. Menopause policy (recommended by ACAS, increasingly expected)
  7. Religious and cultural accommodation provisions
  8. Part-time and fixed-term worker protections (no less favourable treatment)
  9. Diversity monitoring data collected (with consent) and used to inform policy
  10. Training records for equality and diversity completed annually

Domain 5: Data protection (UK GDPR / Data Protection Act 2018)

Employee data is personal data. HR must handle it in compliance with data protection law.

Checklist

  1. Privacy notice for employees issued before or on the first day of work
  2. Lawful basis for processing employee data identified and documented
  3. Special category data (health, trade union membership) processed with appropriate safeguards
  4. Data retention policy for HR records (typically 6 years post-termination)
  5. Subject access request (SAR) process documented and staff trained
  6. International data transfers (if applicable) covered by appropriate safeguards
  7. Employee data security measures in place (encrypted storage, access controls)
  8. Right to be forgotten requests handled correctly
  9. Data protection impact assessment (DPIA) for high-risk processing (e.g., surveillance, monitoring)
  10. Annual data protection training for all HR staff

Domain 6: Payroll and tax

Incorrect payroll is a fast route to HMRC penalties and employee grievances.

Checklist

  1. PAYE and National Insurance correctly operated for all employees
  2. Real Time Information (RTI) submissions made on or before each payday
  3. Automatic enrolment pension compliance (staging date, contribution levels)
  4. Student loan deductions applied where applicable
  5. Minimum wage compliance checked (including for apprentices, interns, and agency workers)
  6. Gender pay gap report published (250+ employees)
  7. Benefits in kind reported on P11D
  8. Holiday pay calculations comply with the 52-week reference period
  9. SMP, SSP, SAP, and other statutory payments correctly calculated and reported
  10. Payslips meet legal requirements (itemised, issued on or before payment)

Domain 7: Workplace policies

Policies are not just documentation — they are the framework that demonstrates compliance in practice.

Checklist

  1. Employee handbook issued and acknowledged
  2. Disciplinary and grievance policies meet ACAS Code of Practice
  3. Absence management policy in place
  4. Anti-bribery and corruption policy (Bribery Act 2010)
  5. Whistleblowing policy (Public Interest Disclosure Act 1998)
  6. Social media policy
  7. IT and acceptable use policy
  8. Environmental/sustainability policy
  9. Modern slavery statement (500+ employees, or best practice for smaller firms)
  10. Remote/hybrid working policy

Putting it into practice

Run this checklist annually as a compliance audit. Assign each domain to a responsible person, set a completion deadline, and track remediation of any gaps identified.

The five most common compliance failures found in audits:

  1. Missing or outdated employment contracts
  2. Incorrectly calculated annual leave entitlements
  3. Inadequate data protection privacy notices
  4. Missing or outdated risk assessments
  5. No recorded equality and diversity training
You can take advantage of the free 14 days trial and explore Leave Balance.

Leave Balance automates leave calculations, maintains audit-ready records, and ensures statutory compliance across jurisdictions — so your HR compliance checklist gets shorter every year, not longer.

Frequently asked questions

How often should I run an HR compliance audit?

At minimum, annually. More frequent reviews (quarterly) are recommended for organisations undergoing rapid growth, entering new markets, or operating in heavily regulated industries. Trigger-based reviews should also occur when legislation changes or after any employee relations incident.

What are the most common HR compliance failures?

The most common failures are: incorrect leave calculations, missing or outdated employment contracts, inadequate data protection notices, missing risk assessments, and failure to follow the ACAS Code of Practice in disciplinary or grievance situations.

Do I need a compliance audit if I have fewer than 25 employees?

Yes. Many legal obligations apply from the first employee (written statement of employment particulars, right to work checks, health and safety duties). The scale of the audit may be smaller, but the obligations are the same.

Can I run a compliance audit myself, or do I need a consultant?

You can run a self-audit using this checklist, but consider engaging an employment law specialist for the first audit or when entering a new jurisdiction. The cost of a professional audit is typically far less than the cost of a single Tribunal claim.

What happens if I fail a compliance audit?

Identify the gaps, prioritise them by risk (legal exposure, financial impact, employee welfare), and remediate them within a defined timeframe. Document the remediation steps and the dates they were completed. This demonstrates good faith if a compliance issue later becomes a legal dispute.

This article is general information, not legal advice. Consult qualified employment counsel for jurisdiction-specific guidance.