HR Compliance Checklist for Small Business: The Laws You Are Probably Breaking
Disclosure: Some links on this page are affiliate links. If you purchase through them, we may earn a commission at no extra cost to you. Full affiliate disclosure.
A former employee asks for a copy of everything you hold about them. Three people search three places: a hiring inbox, a shared drive folder nobody has opened since last year, and a laptop belonging to someone who left in the spring. What comes back is incomplete, and now you cannot tell whether that is because the records were never kept or because nobody can find them.
That is the situation this guide is written for, and it is far more common than a business knowingly doing something wrong. Most small companies are not disregarding their obligations. They are keeping records in too many places, inconsistently, with no clear owner.
One thing worth saying plainly before the list. No article can tell you which rules apply to you — that depends on where you operate, how many people you employ, what industry you are in, and whether your workers are employees or something else. What follows is a record-keeping checklist: the operational layer that makes any answer possible.
Scope note
This is a documentation checklist, not legal advice. It deliberately avoids naming statutes, deadlines, or penalties, because those vary by jurisdiction and change over time. For anything specific to your situation, speak to a qualified employment adviser in the places where you actually employ people.
Editor’s take: Small employers rarely get caught by the headline law; they get caught by recordkeeping and by notice requirements nobody owns. Work this checklist in the order an employee would trigger it — hiring documents, pay and classification, leave, then termination and retention — because that is the order problems arrive in.
Editor's Take
The uncomfortable truth in this piece is that most small-business compliance failures are ordinary oversights — missing posters, misclassified workers, records not kept — not exotic legal traps. That is good news, because a checklist fixes them. Do the boring parts first: worker classification, wage and hour records, and required notices, in that order.
The principle that makes the rest work
One system holds the record. Not a shared drive plus an HR tool plus a hiring inbox. Everything else is a copy.
Almost every problem in this area traces back to that being false. Documents live in email, notes live with individual managers, and the official system holds maybe half of it. When something needs to be produced, the work becomes archaeology rather than retrieval.
Pick the system, then make saving the record part of the process that creates it rather than a task somebody does later. Anything that relies on someone remembering to file it will not get filed.
Before you advertise a role
Records start earlier than most people expect. Keep the final job description as it was actually posted, along with the date it went live and where it was advertised.
Decide the questions you will ask every candidate for this role and write them down before the first interview. The point is consistency: two people interviewed for the same job should be asked broadly the same things. Improvised interviews are hard to explain later, because there is no record of why one candidate was preferred.
If you use an assessment or a work sample, keep the instructions and what the candidate produced. If you take references, note who was contacted and when.
At offer and hire
Keep the signed offer letter with its terms, and note anything negotiated away from the standard template.
Collect and retain whatever your jurisdiction requires to confirm identity and eligibility to work, and keep the signed paperwork rather than a verbal confirmation. Store it apart from the general personnel file — this set usually has different access rules and often a different retention period.
Keep signed acknowledgements for anything you expect the person to be bound by: confidentiality terms, the handbook, equipment and acceptable use policies, and any agreement about work product. An unsigned policy is close to worthless when you need to rely on it.
Record the agreed start date, and if it shifted after the offer was signed, keep both. A mismatch between offer and start dates is a small thing that causes outsized confusion later.
Pay and hours
Every change to pay should exist as a dated record: what changed, when it took effect, who approved it, and what the previous value was. A spreadsheet with a history column is fine. A comment in a chat thread is not.
Keep records of hours worked for anyone whose pay depends on them, along with how those hours were approved. Where rules about rest, overtime, or maximum hours apply, the record is what shows you observed them.
Keep a written note of how each worker is classified and why — employee or contractor, full or part time, and anything else that affects how they are paid. Classification decisions get revisited, and an explanation written at the time is worth far more than one reconstructed afterwards.
Time off and leave
Requests and approvals belong in writing, however informal the process feels. Not to build a paper trail for its own sake, but because disagreements about leave almost always come down to what was asked and what was agreed.
Maintain running balances where your policy has them, and keep a copy of the policy as it stood at the time. Policies change, and applying this year's rules to last year's balance is a reliable way to create a dispute.
For leave of a protected or statutory kind, keep the request, the dates, and the correspondence — in the employee's file, not in a manager's inbox.
Performance and conduct
Feedback should be written down when it is given, not assembled at review time. A short dated note of what was discussed and what was agreed is enough, and it is far more credible than a document produced months later.
If performance becomes a formal process, keep the written warning, the improvement plan, the dates of any checkpoints, and the outcome. Note when the employee was actually given the document — a warning that was never delivered tells you nothing useful.
Keep records of training that was required, or that was provided in response to a performance issue. It shows what was offered.
When someone leaves
Keep the resignation letter or, where the company ended the employment, a dated written record of the reason and who made the decision. Vague exit paperwork is the single most common gap in small business files.
For smaller teams, see our best HRIS for small business guide.
Record the final day, the final payment and how it was calculated, any outstanding leave balance and how it was settled, and confirmation that property was returned and access was revoked.
Note who may be contacted for a reference and what the agreed response is. Deciding this after the fact is how inconsistent references happen.
How to store all of it
- One system of record. Everything else is a convenience copy, and everyone should know which is which.
- Restricted access. Most people need nothing from a personnel file. Whoever has access should be a deliberate, reviewable list rather than an inherited default.
- Separate the sensitive sets. Eligibility and identity documents, health-related information, and anything arising from an investigation do not belong in the general file.
- Consistent naming and dating. A file named for the person and the event, with the date in it, is findable. A file named "scan001" is not.
- One retention rule per record type, applied consistently. Have the durations confirmed for your jurisdiction rather than guessed at.
- A named owner. If nobody owns the file, nobody checks it, and gaps accumulate silently.
What usually gets missed
Dates, overwhelmingly. A pay rise with no effective date. A verbal warning with no record of the conversation. A handbook the employee never acknowledged. The substance is usually present; the evidence of when and how it happened is not.
After that: contractors folded into the employee process, or employees treated as contractors, both of which produce paperwork that fits neither. And records that lived with one person and left when they did.
Keeping it alive
Put a recurring review in the calendar — quarterly is plenty for a small team — and use it to sample two or three files end to end. Check that hire documents are present, that every pay change carries an effective date, and that nothing is sitting outside the system.
Then fix the process that produced the gap, not just the file. Backfilling one missing signature helps once; changing where signatures get saved helps every time after.
Fix where records live, not just which ones are missing
Most small business compliance problems are retrieval problems wearing a different hat. Choose one system of record, move hire documents into it, and make saving part of the workflow that creates them. If you are deciding where those records should live, our HR software comparison looks at which platforms handle document storage and access control properly.
How we compared
This checklist is organised by when obligations arise, drawing on generally applicable employment requirements rather than jurisdiction-specific legal advice.
- Organising principle — Obligations grouped by hiring stage, so they can be worked through in order
- Scope — Requirements that apply broadly to small employers, with the common failure points named
- Limits — Employment law varies by jurisdiction; this is a starting checklist, not legal advice
Looking for the full shortlist with pricing, plan limits and trade-offs? The comparison table above puts every option side by side.
See the full comparisonFrequently asked questions
Can a checklist tell me whether I am compliant?
Not on its own. Requirements differ by country, state, city, headcount, and industry, and a generic list cannot account for any of that. What a checklist can do is make sure the underlying records exist and can be found, which is the part most small businesses are actually missing when a question comes up.
What belongs in an employee's personnel file?
The documents from their hire, anything they signed, every change to pay or role with a date attached, written performance feedback, and the paperwork from their departure. The test is whether someone unfamiliar with the person could reconstruct the whole employment history from the file alone.
Should managers keep their own notes on employees?
They should keep dated notes on what happened and what was said, and those notes should live somewhere the company can find them. Private documents that nobody knows about are a problem in both directions: they cannot support a decision, and they can complicate one.
How long should employment records be kept?
Longer than feels necessary, and the honest answer is that it depends on where you operate and what the record is. Rather than guessing, pick a single retention rule for each record type, apply it consistently, and have it confirmed by someone qualified to advise on your jurisdiction.
What is the most common gap in small business HR records?
Missing dates. A pay change with no effective date, a warning with no record of when it was delivered, a policy the employee never acknowledged in writing. The substance is usually there; the evidence of when and how it happened is not.
Do contractors need the same records as employees?
They need a different and smaller set: the agreement, identity and invoicing details, records of what was paid, and whatever your local rules require for non-payroll workers. The mistake is treating them identically, which creates both unnecessary paperwork and gaps where it matters.
