Right-to-work — checked before day one, evidenced forever
Every UK employer must verify right-to-work status before the first day of work — not the first day of pay. Since April 2022 the Home Office accepts digital identity verification for British and Irish citizens via IDSPs, and share-code checks for everyone else. The evidence pack must be retained for the full employment plus two years. A missed or late RTW check is a £20,000 civil penalty per worker and, in the worst cases, up to five years' imprisonment for the responsible director.
GDPR — the lawful basis conversation you're skipping
Every piece of personal data collected during onboarding needs a lawful basis under UK GDPR. Employment contract data (name, address, NI, bank) is contractual necessity. DBS results are legal obligation. Photographs, emergency contacts and dietary info are usually legitimate interests or consent. Get the lawful basis mapped in your data-protection notice, hand it to the new hire on day one, and record their acknowledgement. This is a five-minute exercise that closes 80% of your ICO exposure.
Health & safety — the DSE the small employer forgets
Every desk-based worker in the UK is entitled to a Display Screen Equipment (DSE) assessment on request, and every worker regardless of role is entitled to a workplace induction covering fire, first aid and hazard reporting. Big employers do this reflexively; SMBs skip it and then discover the gap after an incident. A 20-minute induction on day one, signed off by the new hire, is the whole compliance ask.
DBS — only where it's legally required or genuinely proportionate
DBS checks are legally required for roles involving regulated activity with children or vulnerable adults, and for a defined list of positions of trust. For everything else, standard or basic DBS is discretionary — and disproportionate DBS demands are increasingly flagged in unfair-treatment claims. Decide the level per role, document the reason, and don't drift over time.
RTW before day one, GDPR notice on day one, H&S induction on day one, DBS only where proportionate. Get those four right and the onboarding compliance file is done.