A developer in Berlin. A marketing lead working from Lisbon three months a year. A finance analyst who moved to Bali and never mentioned it to HR. These are not edge cases anymore. These are Tuesday.
Remote work broke the seal on something that international employment laws were never designed for. The laws assumed workers sat in one country, paid taxes in that country, and stayed covered by that country’s labor protections. The moment an employee opens a laptop from a different jurisdiction, that assumption falls apart. And with it, a long list of compliance obligations that most companies did not see coming.
Over 60 countries now offer digital nomad visas. An estimated 40 million people work remotely across borders. The infrastructure is there. The legal frameworks? Still catching up. And in that gap between how people actually work and what the law says about where they work, there is a growing pile of risk that lands squarely on the employer.
The employee moved. The legal obligations followed them.
This is the part that surprises a lot of companies. When an employee works from another country, even temporarily, the labor laws of that country can apply to the employment relationship. Not might. Can. And in a growing number of jurisdictions, the courts are saying: they do.
A UK employee who relocates to Spain for six months does not remain governed purely by their UK employment contract. Spanish labor law starts to apply. That means local minimum wage rules, mandatory benefits, termination protections, working time limits. The employment contract can say “governed by UK law” at the top. The Spanish court does not particularly care.
This creates a strange situation where one employee can be simultaneously subject to the employment law of the country where the employer is registered, the country where the employee is physically working, and potentially a third country if there is a regional framework involved (like the EU). Sorting out which rules apply, and when, is not a question most HR teams were trained to answer.
And it gets worse the longer the arrangement continues. A few weeks of working abroad is usually tolerable. Three months starts to raise flags. Six months and you are almost certainly triggering local employment obligations that require real compliance effort.
Tax exposure is the one that hits the bottom line hardest
If an employee works in a country for long enough, the employer may owe taxes there. Not just personal income tax for the employee. Corporate tax.
The concept is called permanent establishment. In simple terms, if your employee’s work in a foreign country is regular enough and substantial enough, tax authorities can decide that your company has a taxable presence there. One employee. Working from a co-working space. That can be enough.
The OECD updated its guidance in November 2025 with a new framework specifically addressing this. It includes a 50 percent working time safe harbor, meaning if an employee works less than half their time in a foreign country, the risk of triggering permanent establishment is lower. But “lower” is not “zero.” And tax authorities in countries like India, which do not follow the OECD model on all points, may take a stricter view.
Then there is the shadow payroll question. Many countries now require employers to withhold income tax from day one when an employee works within their borders. Even if the employee is on a short-term assignment. Even if the employer has no entity in that country. The withholding obligation exists because the work happened there.
For companies that allow employees to work remotely without tracking where they are actually sitting, this creates a tax exposure that is invisible until an audit reveals it.
Social security splits across borders in ways that nobody planned for
This is where international employment laws create one of the most confusing compliance layers for remote work.
An employee who lives in France but works for a UK company needs to be covered by social security. But which country’s system? If they work entirely from France, it is France. If they split time between France and the UK, the answer depends on the percentage split, the EU coordination regulations, and whether the employer has filed the right paperwork.
Within the EU and EEA, social security coordination follows specific rules. The general principle is that the employee pays into the system of the country where they perform a substantial part of their work (25% or more). If the arrangement changes and the employee starts spending more time in another member state, the social security jurisdiction can shift.
Outside the EU, bilateral social security agreements between countries determine the rules. Some countries have them. Many do not. Where no agreement exists, there is a real possibility that both countries will expect contributions, and the employee gets double-charged unless someone intervenes.
For employers managing distributed teams across multiple countries, the administrative burden of tracking social security jurisdiction for each employee is significant. And most standard HR or payroll systems were not built to handle this level of jurisdiction-by-jurisdiction logic.
Right to disconnect laws do not stop at the company border
Here is a scenario that plays out constantly in global remote teams. The company is headquartered in New York. The team lead sends a Slack message at 5 PM Eastern. The remote employee in Lisbon receives it at 10 PM local time. Under Portugal’s right-to-disconnect law, contacting an employee during rest periods can result in fines up to €9,690 per violation.
The company did not intend to violate anything. The time zone math just did not occur to anyone. But intention does not matter under international employment laws that regulate after-hours communication. The obligation falls on the employer to ensure that the employee’s right to disconnect is respected, regardless of where the manager sending the message happens to be.
France, Portugal, Spain, Belgium, and Australia all have active right-to-disconnect provisions. More countries are drafting their own. For a company with remote employees scattered across these jurisdictions, the internal communication culture itself becomes a compliance variable.
This is not just about email. It includes:
- Slack and Teams messages sent across time zones
- Calendar invitations that fall outside local working hours
- Automated notifications from project management tools
- Meetings scheduled without accounting for local rest periods
The fix is not complicated in theory. Respect local working hours. Adjust notification settings. Do not expect responses outside of them. But in practice, this requires the company to know, for every remote employee, what local employment law says about after-hours contact. And most companies do not have that information readily available.
Data protection adds yet another layer
When an employee works from another country, the data they handle may be subject to that country’s data protection laws. GDPR applies to any employee handling personal data of EU residents, regardless of where the company is based. China’s data protection framework restricts cross-border transfer of personal information. India’s data protection legislation has its own requirements.
For remote employees, this means the company needs to know where data is being accessed from, whether the employee’s home network meets the security requirements of the applicable data protection law, and whether cross-border data transfer mechanisms are in place.
Most remote work policies do not address this. They cover working hours, equipment, and maybe expense reimbursement. Very few address the data protection implications of working from a jurisdiction the company did not plan for.
What makes this manageable
The answer is not to ban remote work across borders. That ship left a long time ago.
The companies that handle this well tend to do a few things consistently. They define clear policies about where employees can work from and for how long. They track employee locations, not to surveil, but to know which country’s laws apply. They set thresholds, typically 30 to 90 days, beyond which a formal compliance review is triggered. And they invest in understanding the international employment laws of the countries where their employees actually sit, not just the countries where the company has an office.
None of this requires a massive legal department. It requires information. Current, organized, country-specific information about employment obligations, tax triggers, social security rules, and leave entitlements.
That is exactly what Global People Strategist provides. The platform covers employment laws and compliance requirements across 150+ countries, giving HR teams one place to check what applies when an employee works from a new jurisdiction, before the compliance risk becomes a compliance problem.
Because the future of work already crossed the border. The question is whether your compliance framework followed it.
FAQs
1. Can employees work remotely from another country without creating legal obligations for their employer?
Not always. When employees work from another country, local employment, tax, social security, and data protection laws may apply. Even temporary remote work arrangements can trigger compliance obligations depending on the duration and nature of the work.
2. What is permanent establishment risk in international remote work?
Permanent establishment refers to a situation where a company may be considered to have a taxable presence in a foreign country because of an employee’s activities there. If triggered, the employer could face corporate tax obligations and additional reporting requirements in that jurisdiction.
3. How do social security obligations work when employees work across borders?
Social security requirements depend on where the employee performs their work, applicable international agreements, and local regulations. In some cases, employees and employers may need to contribute to a different country’s social security system or obtain documentation to avoid double contributions.
4. What are right-to-disconnect laws and why do they matter for remote teams?
Right-to-disconnect laws protect employees from being expected to engage in work communications during rest periods. Companies with distributed teams must be mindful of local working hours and communication practices, as some countries impose penalties for repeated after-hours contact.
5. How can employers manage compliance risks associated with cross-border remote work?
Organizations can reduce risk by establishing clear remote work policies, tracking employee work locations, setting approval processes for international remote work requests, and regularly reviewing employment law requirements in the countries where employees are working.
