How to start a HR department: UK compliance checklist

Setting up an HR function starts with legal obligations, not organisational charts. From your first employee you need a written statement of particulars on or before day one, a completed right to work check, PAYE registration, employers’ liability insurance of at least £5 million, and pension auto-enrolment duties running from that person’s first day. Only two written policies are genuinely mandatory, and the one most employers miss is a data protection appropriate policy document. Get that foundation in place, then build the hiring, pay and performance processes on top of it.

The reason to work in that order is eliminate risk. A vague job description costs you productivity. A missing right to work check can cost up to £60,000 per worker. This guide covers the legal aspects first, then the operational build, then what changes as you grow – including the Employment Rights Act 2025, which is landing in stages between now and 2027.

Start with the legal floor, not the org chart

Most guides to building an HR department begin with structure and hierarchy. That is the wrong end. Almost every significant HR obligation in UK law starts from the first employee, with no threshold and no grace period, and several carry deadlines measured in days.

Here is what has to be true from day one.

Obligation	When	Threshold
Written statement of employment particulars	On or before the first day	Every employee and worker
Right to work check	Before employment starts	Every worker
PAYE registration with HMRC	Before the first payday	From the first payment
Employers’ liability insurance, minimum £5m	As soon as you become an employer	From the first employee
Pension auto-enrolment duties	From the employee’s first day	From the first employee
Health and safety risk assessment	Before work starts	From the first employee
Competent person appointed for health and safety	From the start	From the first employee
Health and safety law poster displayed, or leaflet issued	From the start	From the first employee
UK GDPR compliance and a staff privacy notice	At the point you collect data	From the first applicant

 

The written statement of particulars

Since April 2020 this has been a day-one right, and it extends to workers, not just employees – so casual, zero-hours and most gig staff are covered. The old one-month service requirement and two-month deadline are both gone.

The principal statement has to be a single document given on or before the first day, covering the parties, the start date, pay and when it is paid, hours including any variability, holiday entitlement, place of work, job title or description, probation terms, training entitlements, and benefits. For employees it must also state the date continuous employment began.

Failing to provide it is not directly penalised, but if an employee brings a successful tribunal claim on another matter, the tribunal can award two to four weeks’ pay for the missing statement. It is the cheapest compliance win available and the most commonly skipped. Find out why HR policies and procedures are so important.

Right to work checks

Carry out a prescribed check before employment begins and you have a statutory excuse against a civil penalty. There are three routes: a manual check of an original List A or List B document, a Home Office online check using the applicant’s share code, or identity document validation technology through a certified provider – the last of which is available only for British and Irish passport holders.

The important operational point is that for anyone whose immigration status is held digitally – eVisa holders, EU Settlement Scheme status holders, frontier workers, anyone under the points-based system – a manual document check gives you no statutory excuse. Physical biometric residence permits expired at the end of 2024, so in practice every non-UK and non-Irish national is now a share code case.

Where permission to work is time-limited, diarise a follow-up check before it expires. Get this wrong and the civil penalty is up to £60,000 per illegal worker, with a starting point of £45,000 for a first breach. Knowingly employing someone without the right to work is a criminal offence carrying up to five years’ imprisonment.

One change to prepare for: from 1 October 2026 the illegal working regime is expected to extend beyond employees to anyone engaged under a worker’s contract, including individual contractors, subcontractors, agency and platform workers. That significantly widens who you need to check. The Home Office published a draft revised employer’s guide in July 2026 in anticipation, so confirm the final position before relying on it.

Employers’ liability insurance

Compulsory from your first employee, minimum cover £5 million, though most policies are written at £10 million. You must display the certificate where employees can read it – an intranet is acceptable – and produce it to HSE inspectors on request.

The penalties are unusually sharp: £2,500 for every day you are uninsured, and £1,000 for failing to display the certificate. You are exempt only if you employ nothing but close family members, which does not apply to limited companies, or if all your staff are based outside England, Scotland and Wales.

Note that the old 40-year certificate retention rule was abolished in 2008, so there is no legal retention period. Keeping old certificates indefinitely is still sensible, because disease claims can surface decades later.

Pension auto-enrolment

Your duties start on the day your first member of staff starts work. There is no phasing and no grace period for new employers.

From that date you must assess every member of staff, automatically enrol anyone aged 22 to State Pension age earning above the trigger, write to all staff individually within six weeks about how auto-enrolment applies to them, handle opt-in requests, and pay contributions. For 2026/27 the earnings trigger is £10,000 and the qualifying earnings band runs from £6,240 to £50,270. Minimum contributions are 8% in total with at least 3% from the employer.

Two deadlines catch new employers out. The declaration of compliance is a legal duty and must be completed within five calendar months of your duties start date – and it is required even if you had nobody to enrol. Then re-enrolment runs on a three-year cycle: you pick a date within a six-month window around the third anniversary, put eligible opt-outs back in, and re-declare within five months of that anniversary.

The written documents you actually need

This is where most advice oversells. Strip out the best practice and the genuinely mandatory list is short.

A written health and safety policy, but only if you have five or more employees. Below that you need the policy, just not in writing. The same threshold applies to recording the significant findings of your risk assessments – the duty to do the assessment starts at one employee, only the writing down waits until five.

A disciplinary and grievance note in the written statement. There is no free-standing statutory duty to have a written disciplinary or grievance procedure. What is mandatory is the note required in the statement of particulars: it must specify any disciplinary rules or point to an accessible document containing them, name a person to appeal a disciplinary decision to and a person to raise a grievance with, and explain how to apply. In practice that forces a minimal written procedure into existence.

Beyond that, the Acas Code of Practice on Disciplinary and Grievance Procedures says procedures “should” be in writing – not “must”. But an unreasonable failure to follow the Code lets a tribunal adjust an award by up to 25%, which is a strong enough incentive to treat written procedures as effectively required. Worth noting that Acas is consulting on a replacement Code, with the consultation closing on 23 September 2026, so the current version may not be the one you are working to for long.

A data protection appropriate policy document. This is the mandatory document almost nobody has. If you process special category data about staff – sickness records, occupational health, disability adjustments, equality monitoring – and you rely on the employment condition in Schedule 1 of the Data Protection Act 2018 to do it, you must have an appropriate policy document in place. It has to explain your procedures for complying with the data protection principles and your retention and erasure policies, be kept under review, and be retained until six months after the processing ends. Since virtually every HR function processes sickness absence, virtually every HR function needs one.

A staff privacy notice is also a hard obligation rather than best practice, and it applies to job applicants as well as employees.

Everything else – equal opportunities, anti-harassment, whistleblowing, homeworking, social media, expenses, absence management, redundancy – is best practice. Useful, often very useful, but not legally required. The exception on the horizon is harassment: the Employment Rights Act 2025 duty to take “all reasonable steps” to prevent sexual harassment includes a power to specify what those steps are by regulation, which is the most likely route by which an anti-harassment policy becomes mandatory in substance.

Records, and the two retention clocks

Record keeping is where a new HR function quietly accumulates risk, and there is now an awkward split in the rules.

Records	Retention
Working time – the 48-hour limit, night work, young worker limits, health assessments	2 years
Annual leave and holiday pay	6 years
National Minimum Wage	6 years
Payroll records for HMRC	3 years
Right to work check copies	For the duration of employment plus 2 years
RIDDOR accident records	3 years

 

Two things to note. Since January 2024 you do not have to log each worker’s daily hours, provided you can demonstrate compliance some other way. But from 6 April 2026 there is a new duty to keep records adequate to show compliance with holiday entitlement and holiday pay, retained for six years, and failure is a criminal offence – so the same set of regulations now runs two different retention clocks, and the newer one carries a criminal sanction the older one does not.

On data protection more generally: a small employer with an HR function should assume it needs a record of processing activities. The exemption for organisations with fewer than 250 employees does not help, because it falls away for processing that is not occasional or that involves special category data – which describes sickness absence records exactly. You will also almost certainly owe the ICO data protection fee, which is £52 for micro organisations, £78 for SMEs and £3,763 for large ones, with a £5 discount for direct debit. Subject access requests must be answered within one month, extendable by two further months for complex requests if you tell the requester inside the first month.

Then build the function

With the floor in place, the operational build is the part the original version of this article covered – and it still matters. Six steps, in order.

1. Define roles and responsibilities

Write down what each role is actually for: its purpose, its main duties, who it reports to, and what good performance looks like. Clear definitions reduce duplication, make recruitment briefs writable and give you something to measure against later.

This also feeds a legal requirement, because the job title or a brief description of the work is one of the particulars that has to appear in the written statement.

2. Decide the reporting structure

Set out who reports to whom and where decisions sit. In a small business the useful output is not a chart for its own sake but clarity on three things: who approves time off, who handles a grievance, and who signs off pay changes. Those are the three questions that arrive first.

Name the grievance and disciplinary appeal contacts explicitly, because the statement of particulars has to identify them.

3. Set your hiring process

Publish a real job description, agree the selection criteria before you interview rather than after, and build the compliance steps into the flow so they cannot be skipped: right to work check completed before the start date, written statement issued on or before day one, privacy notice given at application stage.

Keep recruitment records, but not forever – applicant data needs a retention period and a reason for it.

4. Pay, benefits and pay reviews

Benchmark against the market, then check the floor. Any salary has to deliver at least the National Minimum Wage for the hours actually worked, tested in each pay period. From April 2026 that is £12.71 an hour for those aged 21 and over, £10.85 for 18 to 20, and £8.00 for under-18s and apprentices.

Decide your payroll date, register for PAYE before the first one, and set out how and when pay is reviewed. If you offer a bonus, write the scheme down – including how it is pro-rated for part-timers, joiners and leavers, because those are the disputes you will actually have.

5. Performance and appraisals

Put a light, regular review cycle in place rather than an annual set-piece. The point is not the paperwork; it is that capability and conduct concerns are documented early, which is what makes a fair process possible later if it comes to that.

Two constraints worth designing around: pro-rate performance-linked rewards fairly for part-time staff, and be careful about linking rewards to attendance, because automatic penalties for absence are how employers end up defending disability discrimination claims.

6. HR software and systems

A system earns its place when it holds the records you are legally required to keep and produces them on demand. Prioritise, in order: employee records and contracts, absence and holiday tracking with an audit trail, right to work expiry reminders, and payroll integration.

Given the new six-year holiday record duty and its criminal sanction, holiday tracking that can evidence compliance is no longer a nice-to-have.

Statutory leave and pay you need to be able to administer

Your HR function has to be able to calculate and pay all of this correctly from day one. Rates below are 2026/27.

Entitlement	Leave	Pay	Day-one right?
Annual leave	5.6 weeks, capped at 28 days	Full pay	Yes, accrues from day one
Statutory sick pay	Up to 28 weeks	£123.25 a week, or 80% of average weekly earnings, whichever is lower	Yes, and from the first day of sickness since April 2026
Maternity	52 weeks, of which 2 are compulsory after birth	39 weeks: 90% of earnings for 6 weeks, then £194.32 or 90%, whichever is lower	Leave yes, pay needs 26 weeks’ service
Paternity	1 or 2 weeks	£194.32 or 90% of earnings, whichever is lower	Leave yes, since April 2026
Adoption	52 weeks	39 weeks, as maternity	Leave yes, pay needs service
Shared parental	Up to 50 weeks shared	Up to 37 weeks at £194.32 or 90%	No, service and earnings tests apply
Parental bereavement	2 weeks	£194.32 or 90%	Yes
Neonatal care	Up to 12 weeks	£194.32 or 90%	Leave yes, pay needs service
Carer’s leave	1 week unpaid per year	Unpaid	Yes
Unpaid parental leave	18 weeks per child	Unpaid	Yes, since April 2026

 

Note one inconsistency to watch: GOV.UK’s employer maternity pages were still showing the 2025/26 rate of £187.18 when checked, against £194.32 on the HMRC rates and thresholds page. The HMRC page is the authoritative one for 2026/27.

Flexible working is a day-one right, but for employees only rather than all workers. An employee can make two requests in any 12-month period, you must consult before refusing, and you must decide within two months including any appeal. There are eight permitted grounds for refusal, and the remedy for getting it wrong is capped at eight weeks’ pay.

What changes as you grow

Most of the big duties have no threshold. The ones that do are worth knowing before you cross them.

Headcount	What kicks in
5	Written health and safety policy; recorded risk assessment findings
10 or fewer	TUPE lets you consult affected employees directly rather than electing representatives
20+	Collective redundancy consultation: 20 or more dismissals at one establishment in 90 days, with at least 30 days’ consultation (45 for 100 or more) and notification to the Secretary of State on form HR1
50+	Obligation to negotiate an information and consultation agreement, but only if a valid employee request is made
250+	Gender pay gap reporting, published within 12 months of the snapshot date; full record of processing under data protection law; gender equality and menopause action plans

 

Non-headcount triggers worth diarising: the apprenticeship levy at a £3 million pay bill, and a modern slavery statement at £36 million turnover.

Note that the collective redundancy protective award doubled from 90 to 180 days’ pay in April 2026, which materially raises the cost of getting consultation wrong. And the Employment Rights Act 2025 will add an organisation-wide redundancy threshold alongside the existing establishment test, with the number set by regulations in 2027.

What is changing: the Employment Rights Act 2025

This is the reason a 2021 guide to setting up HR is no longer usable. The Act received Royal Assent in December 2025 and is commencing in stages.

Already in force:

Date	Change
6 April 2026	SSP payable from day one, with the lower earnings limit removed and an 80% floor
6 April 2026	Duty to keep annual leave records for six years, breach being a criminal offence
6 April 2026	Day-one paternity leave and unpaid parental leave; new bereaved partner’s paternity leave
6 April 2026	Collective redundancy protective award doubled to 180 days’ pay
6 April 2026	Whistleblowing protection extended to disclosures about sexual harassment
7 April 2026	Fair Work Agency established

 

Scheduled, with dates announced:

Date	Change
1 October 2026	Employment tribunal time limits rise from three months to six
30 October 2026	Duty to take “all reasonable steps” to prevent sexual harassment, plus liability for third-party harassment
1 January 2027	Unfair dismissal qualifying period cut from two years to six months, and the cap on the compensatory award removed
January 2027	Fire and rehire restrictions

 

One correction worth making explicitly, because it is repeated almost everywhere: the Act does not create a day-one unfair dismissal right. The original Bill proposed one, but the final Act reduces the qualifying period to six months. The bigger commercial exposure is arguably the removal of the compensatory award cap, which gets much less attention.

Two of the scheduled items – the harassment duty and the tribunal time limit change – still showed as not in force on legislation.gov.uk in early September 2026, with no commencement instrument located, despite the government roadmap giving those dates. Treat them as coming rather than current, and check before advising anyone.

Announced without specific dates, and the largest outstanding laws yet to come into play include: the right to guaranteed hours, reasonable notice of shifts, and payment for cancelled, moved and curtailed shifts. Consultation closed in August 2026 and the timing is explicitly to be updated. Nobody can yet tell you how many days’ notice of a shift the law will require, because the figure is left to regulations that do not yet exist. Also pending: mandatory gender equality and menopause action plans, enhanced dismissal protection for new and expectant mothers, bereavement leave extended to pregnancy loss, and regulations restricting non-disclosure agreements in harassment and discrimination cases.

When to hire HR, and when to outsource

There is no legal trigger for employing an HR professional – the obligations sit with the employer whether or not anyone in the building is called HR.

In practice the pattern is that up to around 20 to 30 employees, HR usually sits with a founder, finance lead or operations manager, supported by an outsourced adviser or an employment law helpline for anything contentious. Somewhere between 30 and 50 the administrative load and the frequency of employee relations issues usually justify a dedicated hire, often at HR officer or manager level rather than a director.

What tends to force the decision earlier is not headcount but risk: a first disciplinary, a grievance, a redundancy, a tribunal claim, or a TUPE transfer. If you are approaching any of those without HR capability, get advice before you act rather than after.

Your first 90 days

• Register for PAYE before the first payday, and note you cannot register more than two months ahead.
• Arrange employers’ liability insurance and display the certificate.
• Set up a qualifying pension scheme, assess your staff, write to everyone, and diarise the declaration of compliance deadline five months out.
• Build a right to work check into the offer process, with expiry reminders for time-limited permissions.
• Issue a compliant written statement of particulars to everyone, including existing staff who never got one.
• Write the health and safety policy if you have five or more employees, appoint a competent person, complete the risk assessment, and display the law poster.
• Produce a staff privacy notice, a data protection appropriate policy document, and a record of processing activities. Pay the ICO fee.
• Set retention periods for every category of HR record, noting the two-year and six-year clocks.
• Write minimal disciplinary and grievance procedures and name the contacts.
• Diarise the Employment Rights Act dates: 1 October 2026, 30 October 2026 and 1 January 2027.

In summary

Building an HR department from scratch is less about structure than sequence. The compliance floor arrives with your first employee and most of it has no headcount threshold, so start there: the written statement, the right to work check, PAYE, insurance, pensions, and the small set of documents that are genuinely mandatory rather than merely recommended.

Then build the hiring, pay, performance and systems layer on top, and keep one eye on the Employment Rights Act timeline, because the unfair dismissal qualifying period drops to six months in January 2027 and the compensation cap goes with it. The processes you write this year are the ones that will be tested under those rules.