Obligations · Employers
Legal obligations of a company with employees
What a company has to keep in order from the moment it hires its first person, and which of those duties have an insurance policy behind them.
This page sets out the employer's recurring duties, the ones that come back every year, not this month's news. For each one we say what it requires, who it binds and whether an insurance line answers for it or it is met with paperwork alone.
The recurring duties, and who has them
- Daily working time record
Every company with employees, with no headcount threshold. Article 34.9 of the Workers' Statute requires recording the specific start and end time of each person's working day.
No policy replaces it: it is met by keeping and retaining the record.
- Pay register
All companies, again with no threshold: article 5.1 of Royal Decree 902/2020 requires a pay register covering the whole workforce, broken down by sex.
No policy replaces it: it is met by the register and keeping it current.
- Equality plan
Companies with fifty or more workers, under article 2.2 of Royal Decree 901/2020. It is the threshold most often crossed unnoticed, because temporary staff count towards it.
No policy replaces it: it is negotiated, registered and reviewed.
- Pay audit
Companies that draw up an equality plan must include a pay audit in it, under article 7.1 of Royal Decree 902/2020. It has no threshold of its own: it hangs off the plan.
No policy replaces it.
- Internal reporting system
Known as the whistleblowing channel. Article 10.1.a of Law 2/2023 binds private sector companies with fifty or more workers on their payroll.
No policy replaces it. What can be insured is the dispute that follows, under the legal protection line.
- Occupational risk prevention
An employer duty from the first hire: risk assessment, preventive planning, training and information, and health surveillance. The specific regime depends on the activity and on the preventive arrangement chosen.
Prevention itself is not insurable. What can be insured is the consequence of an accident, through the policy the collective agreement requires.
- Employee data protection
As soon as there is a payroll there is personal data: legal bases, information to the workforce, retention periods and a record of processing activities.
Compliance is not insurable. The security incident affecting that data is what cyber insurance deals with.
Where a headcount figure appears, it comes with the article that sets it. Where none appears, it is because the duty does not depend on a single threshold but on each company's activity and arrangements.
What the initial review looks at here
Which collective agreement applies to your activity and whether it requires any policy, the duty most often left unchecked.
Which policies you hold today and which duty each one answers for, so gaps and overlaps show on the same sheet.
The order in which to deal with it, separating what is met with paperwork from what needs a policy behind it.
Start with the initial risk review
Before talking policies, we analyse your case in writing: what your company is exposed to, what your current cover answers for and what is missing. Free of charge and without commitment: we reply within 1 business day and indicative delivery is one week.
Policy purchase is not available yet: we are building our carrier panel.
Indicative description. A company's actual obligations depend on its activity, its headcount and the collective agreement that applies to it; the exact scope of any cover is set by the wording and limits of the policy taken out.