Probably not. And that is not an insult. It is a pattern.
Most companies rolled out remote and hybrid work policies during or after the pandemic. They focused on the operational side. Laptop stipends. Video call etiquette. How many days in the office. Maybe a clause about ergonomic chairs. What they did not do, in many cases, is run those policies through the filter of employment law in every country where their employees were now working from home, from a cafe, or from another country entirely.
The result is a gap. Not a dramatic gap that triggers an immediate crisis, but a quiet one. The kind where HR compliance laws are being technically violated in three or four jurisdictions and nobody knows because nobody checked. Until someone files a complaint. Or a tax authority sends a letter. Or a departing employee’s lawyer finds the exposure during a termination dispute.
This piece is not a policy guide. It is a diagnostic. Read each section and ask yourself whether your company has actually addressed it. Be honest. Most have not.
Do you know where your employees are actually working from?
Start here because everything else depends on it.
A surprising number of companies do not systematically track where their remote employees physically sit. The employee was hired in London. Their contract says London. But they moved to Lisbon eight months ago and never told HR. Or they did tell HR, and HR said “cool” without flagging that Portuguese employment law might now apply.
This is not a hypothetical. It happens constantly in distributed teams. And it matters because HR compliance laws follow the employee, not the company. When someone works from a country for long enough, that country’s labor protections, tax obligations, social security system, and data protection rules can all kick in. The contract can say “governed by UK law.” The Portuguese court will apply Portuguese law if the employee habitually works from Portugal.
If your company does not have a system for tracking where remote employees are located, and updating that information when it changes, everything below this point is built on a foundation you cannot verify.
Ask yourself: do we have a current, accurate record of the physical work location for every remote and hybrid employee? If the answer is no, that is the first gap.
Are your employment contracts written for where the employee works, not where the company sits?
This one catches companies mid-growth. The headquarters is in the US. The contract template is American. The employee works from Germany.
That contract is almost certainly missing mandatory provisions under German law. Statutory notice periods. Annual leave minimums. Working time limits. Overtime rules. Reference letter obligations. A US-style at-will employment clause is not just unusual in Germany, it is unenforceable. The employee has dismissal protections from day one regardless of what the contract says.
The same problem plays out across dozens of countries. French employees have a right to disconnect. Australian employees have minimum award rates that depend on their job classification. Indian employees are now covered by four consolidated labor codes that redefine how wages, benefits, and termination compensation are calculated.
A remote work arrangement does not exempt the employer from local employment law. If anything, it makes compliance harder because the employer is less likely to have local HR infrastructure to catch the gaps.
Ask yourself: are our employment contracts localized to the country where each remote employee works? Or are we using a headquarters template with a remote work addendum stapled to it?
Are you meeting working time and overtime obligations for remote workers?
Here is where the compliance gap gets most common and most invisible.
Remote employees control their own schedules to a degree that office workers do not. They might start early, work late, check emails at midnight. The flexibility is one of the reasons people want remote work. But from a compliance perspective, that flexibility does not eliminate the employer’s obligations around working time.
Most countries have maximum working hour limits. The EU Working Time Directive caps the average at 48 hours per week across member states. Many countries set lower limits. France has a 35-hour standard workweek. Germany caps daily working time at 8 hours, extendable to 10 under specific conditions with compensatory rest.
Overtime is where the financial risk sits. If a remote employee in a country with mandatory overtime pay regularly works beyond the statutory limit, the employer owes overtime compensation whether or not anyone authorized those extra hours. The fact that the employee chose to work late does not eliminate the obligation in most jurisdictions. The employer is expected to have systems in place to monitor and prevent excessive working time.
Ask yourself: do we track working hours for our remote employees in countries with statutory working time limits? Do we have a mechanism to flag when someone consistently exceeds the maximum? If not, you may have an overtime liability accumulating quietly.
Have you addressed the right to disconnect in every applicable jurisdiction?
This is the compliance area that most remote-first companies have completely ignored.
France, Portugal, Spain, Belgium, and Australia all have active right-to-disconnect provisions. More countries are drafting their own. The specifics vary, but the core obligation is the same: employees have a legal right to not respond to work communications during their rest periods, and employers must have policies that protect that right.
For a global company with a distributed team spanning multiple time zones, this creates a real operational challenge.
- A Slack message sent at 3 PM in New York arrives at 9 PM in Paris. Under French law, the employee should not feel compelled to respond.
- A meeting scheduled for 8 AM Pacific falls at 1 AM in Sydney. Under Australian law, the employee can refuse to attend without consequence.
- An automated project notification that fires at midnight in Lisbon could contribute to a pattern that Portuguese authorities consider a violation.
HR compliance laws around after-hours communication are enforced differently in each country. Portugal imposes direct fines of up to €9,690 per violation. France requires negotiated disconnect policies for companies with 50 or more employees. Australia’s Fair Work Commission has already processed dozens of right-to-disconnect applications since the law took effect.
Ask yourself: do we have country-specific right-to-disconnect policies for every jurisdiction where our remote employees are located? Or are we assuming that “we respect work-life balance” as a company value covers us legally? It does not.
Is your data protection posture aligned with where people actually work?
When an employee works from home in a different country, the data they access may be subject to that country’s data protection framework. GDPR applies to any processing of EU residents’ personal data regardless of where the employer is based. China restricts cross-border data transfer. India’s data protection legislation introduces its own consent and processing requirements.
For remote workers, this raises questions most companies have not addressed in their remote work policies:
- Is the employee’s home network secure enough to handle the data they access?
- Are cross-border data transfer mechanisms in place for the jurisdictions involved?
- Does the employee understand their obligations under the applicable data protection law?
- Is the company monitoring remote access in a way that itself complies with local privacy rules?
That last point is tricky. Employee monitoring software that is acceptable in the US may violate privacy laws in Germany, where the Federal Labor Court has set strict limits on workplace surveillance. Using keystroke logging, screenshot capture, or activity tracking without a concrete, documented suspicion of misconduct can make evidence inadmissible and expose the company to privacy claims.
Ask yourself: does our remote work policy address data protection obligations specific to each country where employees work remotely? Or does it stop at “use the company VPN”?
Are your health and safety obligations actually met for home-based workers?
This is the one that makes HR teams uncomfortable because the answer is almost always no.
In many jurisdictions, the employer’s duty of care extends to the employee’s home workspace. Germany requires employers to conduct risk assessments for home workstations. France requires remote work arrangements to be formalized through a company charter or agreement. The UK’s Health and Safety at Work Act applies regardless of where the employee is located.
Most companies handle this with a self-certification form. The employee ticks a box saying their workspace meets certain standards. That may satisfy the administrative requirement in some markets. In others, it falls short of what the law actually expects.
Ask yourself: have we confirmed that our health and safety obligations for remote workers meet the legal standard in each country, not just our internal standard?
What this diagnostic usually reveals
Most companies that run through these questions honestly end up with the same conclusion. They are compliant in some areas, partially compliant in others, and completely blind in a few. The gaps are not the result of negligence. They are the result of remote work scaling faster than the compliance framework that was supposed to support it.
Global People Strategist helps close those gaps. The platform covers HR compliance laws across 150+ countries with detailed employment law profiles, compliance calendars, and real-time regulatory updates, giving HR teams the country-specific information they need to turn “probably compliant” into “actually compliant.”
Because “we have a remote work policy” and “we are legally compliant” are not the same sentence.
FAQs
1. What are the biggest compliance risks associated with remote and hybrid work?
The most common risks include failing to track employee work locations, using non-compliant employment contracts, overlooking local working time regulations, ignoring right-to-disconnect requirements, and failing to meet country-specific tax, social security, and data protection obligations. These issues often remain hidden until a complaint, audit, or employment dispute arises.
2. Why is it important to know where remote employees are physically working?
An employee’s physical work location can determine which employment laws, tax rules, social security requirements, and data protection regulations apply. Employers that do not maintain accurate location records may unknowingly create compliance obligations in jurisdictions they are not actively monitoring.
3. Do remote employees need country-specific employment contracts?
In most cases, yes. Employment contracts should reflect the mandatory labor law requirements of the country where the employee works, including notice periods, leave entitlements, working hours, and termination protections. A contract drafted for one country may not be enforceable in another.
4. How do right-to-disconnect laws affect global remote teams?
Right-to-disconnect laws limit employers’ ability to expect or require employees to engage in work-related communication outside normal working hours. Organizations with employees across multiple time zones should review communication practices and ensure local compliance with applicable disconnect regulations.
5. What should employers include in a compliant remote work program?
A compliant program should address employee location tracking, localized employment contracts, working time management, overtime compliance, right-to-disconnect requirements, data protection responsibilities, and health and safety obligations for home-based workers. Regular reviews are important as employment laws continue to evolve.
