HR Admin Compliance in 2026: Personnel Files, Right to Work Checks and DBS Requirements
Author: Staffinity Solutions Team | Published: July 2026 | Category: HR & Payroll Compliance
Personnel file management is the least glamorous part of HR administration and the single most common source of exposure we find when auditing an SME's employment records. Right to work checks and DBS requirements sit alongside it as the two compliance areas most likely to result in civil penalties, criminal liability or safeguarding failure if administered incorrectly. This guide sets out the technical standard, informed by CIPD Level 7 practice, that an audit ready personnel file and pre employment checking process should meet.
What an audit ready personnel file actually contains
A personnel file is not simply a folder of correspondence. It is a structured record that must, at minimum, evidence the lawful basis for employment, the terms on which the individual works, and a chronological history of any change to those terms. For UK employers this means:
Core documentation
- A signed contract of employment or written statement of particulars, provided no later than the employee's first day of work as required under section 1 of the Employment Rights Act.
- Evidence of the right to work check carried out before employment began, retained in the format prescribed by the Home Office.
- Records of any DBS check undertaken, where the role is eligible, including the certificate reference and, where applicable, evidence of ongoing subscription to the DBS Update Service.
- A complete history of contract variations: changes of hours, changes of role, pay changes and any other amendment to the original terms, each evidenced by a signed variation letter or amended contract.
- Records of statutory leave, disciplinary and grievance proceedings, and performance management, retained in line with the employer's data retention policy and UK GDPR requirements.
Retention and data protection
Personnel records must be retained for a period the employer can justify against a legitimate business need, commonly six years after termination of employment to cover the limitation period for contract claims, though right to work evidence has its own specific retention requirement. Records must be stored securely, access restricted to those with a legitimate need, and disposed of in a manner consistent with UK GDPR once the retention justification expires. We frequently find SMEs retaining records indefinitely with no documented retention policy at all, which is itself a data protection compliance gap.
Right to work checks: getting the mechanics correct
A right to work check is not a box ticking exercise. It is a specific, three step process defined by Home Office guidance, and only when all three steps are followed correctly does the employer establish a statutory excuse against a civil penalty for employing someone without the right to work.
The three step check
- Obtain original, acceptable documents, or complete an online right to work check, or an Identity Service Provider check for British and Irish citizens holding a valid passport.
- Check the documents are genuine, unaltered and belong to the holder, in the holder's presence or via a live video call for digital checks.
- Make and retain a clear copy of the documents, along with a record of the date the check was made, and for time limited permission to work, a note of when a follow up check is due.
Where SMEs typically fail this process
The most common failure we identify is retaining a photocopy of a passport with no record of the date the check was carried out, which invalidates the statutory excuse entirely, because the excuse depends on evidence of when the check happened, not merely that a copy exists. The second common failure is missing follow up checks for employees on time limited visas, where the original check was correctly performed but no system existed to flag the expiry date and trigger a repeat check before permission to work lapsed. Civil penalties for employing someone without the right to work currently run into tens of thousands of pounds per illegal worker for repeat breaches, which makes this one of the highest financial risk areas in HR administration.
DBS requirements and the Update Service
Not every role requires a DBS check, and applying for the wrong level of check, standard, enhanced, or enhanced with barred list, is itself a compliance failure that can invalidate the check or breach the Rehabilitation of Offenders Act by revealing information the employer was not entitled to see.
Determining the correct level of check
The level of DBS check required depends on the nature of the role and the sector. Roles involving regulated activity with children or vulnerable adults, common across care and education employers, require enhanced checks with barred list information. Getting this wrong in either direction carries risk: too low a level and safeguarding exposure remains, too high a level and the employer risks a data protection breach for processing information they had no legal basis to request.
Administering the Update Service
Where an employee subscribes to the DBS Update Service, employers must check the status online before the individual starts, or periodically for existing staff, rather than relying on a paper certificate that may no longer reflect the individual's current status. Many SMEs fail to build this check into their onboarding administration at all, relying instead on the original certificate date, which can be months or years out of date by the time it matters.
Building a compliant personnel file system without in house HR expertise
For SMEs without a qualified HR function, the practical difficulty is not understanding any single requirement in isolation, it is maintaining consistent administration of all of them, for every employee, over time, as visas expire, DBS checks lapse, and contracts vary. This is where documentation discipline breaks down under day to day operational pressure.
At Staffinity Solutions, our HR admin support is built to CIPD Level 7 standard: personnel files structured and maintained to be audit ready at any point, right to work checks tracked with automatic follow up flags for time limited permissions, and DBS status monitored against the Update Service on an ongoing basis. We provide administrative support and record keeping, not legal advice; where a specific case requires an employment law opinion we will always say so.
Frequently Asked Questions
How long do we need to keep right to work check evidence after an employee leaves?
Home Office guidance requires right to work check evidence to be retained for the duration of employment and for a minimum of two years after employment ends, to allow the employer to demonstrate the statutory excuse was validly established if a compliance check is carried out retrospectively.
Do we need a DBS check for every new employee?
No. A DBS check is only appropriate where the role is eligible under the Rehabilitation of Offenders Act exceptions, typically roles involving regulated activity, working with children or vulnerable adults, or specific licensed occupations. Requesting a DBS check for an ineligible role can itself be a data protection compliance failure.
What counts as an acceptable right to work document for a British citizen?
A British or Irish passport, current or expired, is acceptable when checked in person or via an Identity Service Provider using digital identity verification technology. Employers can also use the Home Office online right to work checking service where the individual holds an eligible immigration status, which is now the required route for many non passport holders.
What happens if we discover a gap in our personnel files during an audit?
A gap in personnel records, such as a missing right to work check or an unrecorded contract variation, should be remediated immediately by carrying out the correct check now and documenting clearly that it was a retrospective remediation. Employers should not attempt to backdate documentation, which can itself constitute a further compliance breach; the correct approach is transparent, contemporaneous correction.
Book a Free Consultation
If you are not confident your personnel files, right to work checks and DBS records would withstand scrutiny, book a free consultation with our team and we will review your current record keeping at no cost.
Staffinity Solutions Team, CIPD Level 7 and CIPP Qualified