Work From Anywhere: Hidden Tax Risks for UK Employers

Your senior developer asks if she can work from her partner's flat in Barcelona for the month of August. She will be on UK time, attending all the same standups, shipping the same code. From her perspective, nothing changes except the weather and the quality of the coffee.

From your perspective as a UK employer, a ticking clock has started. Every day she works on Spanish soil creates potential liabilities across three overlapping domains: income tax, social security, and corporate tax. The consequences range from the merely annoying (dual payroll obligations, withholding calculations, foreign registrations) to the genuinely alarming (your company being deemed to have a "permanent establishment" in Spain, triggering corporate tax obligations in a country where you have no presence, no accountant, and no idea how the system works).

This article explains, in plain English, what actually happens when a UK employee works from another country - and what you as an employer need to know before you say yes.

The Three Risk Areas

When an employee works from abroad, three separate legal frameworks come into play. They overlap but operate independently, and compliance with one does not guarantee compliance with the others.

1. Personal Income Tax

Most countries tax individuals based on where they are physically present when they perform the work, not where their employer is based. If your employee works from Spain for a month, Spain may assert the right to tax the income she earns during that month - regardless of the fact that her salary is paid in GBP from a UK bank into a UK account.

Many countries have a threshold before this obligation kicks in. Double taxation agreements (DTAs) between the UK and other countries typically provide an exemption if the employee spends fewer than 183 days in the host country in a 12-month period, the salary is paid by a UK employer (not a local entity), and the employer does not have a permanent establishment in the host country. However, this 183-day rule is not universal. Some countries count calendar days, some count working days, some apply a rolling 12-month window, and some apply the tax year of the host country. France, for example, can apply tax obligations from day one in certain circumstances.

UK Tax Residency

Do not forget the UK side. If an employee spends significant time abroad, they may also trigger questions about their UK tax residency under the Statutory Residence Test (SRT). If they cease to be UK tax resident, the employer's PAYE obligations change. This is uncommon for a one-month trip but becomes relevant for employees who routinely spend 3+ months abroad per year.

2. Social Security Contributions

Social security (National Insurance in the UK) is governed by separate rules from income tax. Within the EU/EEA, the applicable legislation is determined by EU Regulation 883/2004, which - despite Brexit - continues to apply to the UK through the UK-EU Trade and Cooperation Agreement (TCA) for most cross-border workers.

The general rule is that a worker pays social security in the country where they physically work. If your employee works in Spain for a month, Spain may require social security contributions for that period. To avoid this, you can obtain an A1 certificate from HMRC, which certifies that the employee remains subject to UK National Insurance. However:

The A1 certificate must be obtained before the employee starts working abroad.
It is only available if the overseas work is temporary and the employee is habitually employed in the UK.
If the employee regularly works in multiple EU countries (for example, alternating months between the UK and Spain), the "habitual" test becomes complicated, and they may end up owing social security in the country of residence rather than the country of the employer.
For non-EU/EEA countries, the position depends on whether the UK has a bilateral social security agreement with that country. The UK has agreements with a limited number of countries (including the USA, Canada, Japan, and Australia) but not with many popular "digital nomad" destinations like Thailand, Mexico, or Portugal (social security specifically - Portugal has different agreements for tax).

3. Corporate Tax and Permanent Establishment

This is the risk that keeps tax advisors awake at night. Under most DTAs, a company can be deemed to have a "permanent establishment" (PE) in a foreign country if it has a fixed place of business there through which its business is partly carried on. An employee working from a home office in another country can constitute a PE if the arrangement is regular, prolonged, or if the employee has authority to conclude contracts on behalf of the company.

If a PE is triggered, the host country can tax the profits attributable to that establishment. This means your UK company could be required to:

Register for corporate tax in the host country.
File a corporate tax return in the host country.
Pay corporate tax on the profits attributable to the employee's activities.
Maintain local accounting records and potentially appoint a local fiscal representative.

A one-month stint is unlikely to trigger PE risk if it is genuinely temporary and one-off. But if the same employee works from Spain every summer, or if multiple employees routinely work from the same country, the risk escalates rapidly.

Country-Specific Pitfalls

Different countries create different levels of risk. Here are some of the most popular "work from anywhere" destinations and their specific complications for UK employers:

Spain

Spain is notoriously aggressive on tax residency. Spending more than 183 days in Spain in a calendar year makes you tax resident there, meaning your worldwide income becomes taxable in Spain. Even below 183 days, Spain can assert taxation rights on Spanish-source income (income from work physically performed in Spain). Social security complications arise quickly for EU nationals. Spain also has a digital nomad visa programme, but this is designed for freelancers and contractors rather than employees of foreign companies, and does not solve the employer's obligations.

Portugal

Portugal offers an attractive Non-Habitual Resident (NHR) tax regime, but this is a personal tax status for individuals who relocate - it does not protect the UK employer from PE risk or social security obligations. Portugal's tax authorities have become increasingly active in identifying foreign companies with employees working remotely from Portuguese territory.

France

France can apply income tax obligations from day one of working on French soil. The 183-day DTA exemption is available, but France interprets the "employer" condition narrowly - if the employee's costs are recharged to a French entity, or if the work directly benefits French operations, the exemption may not apply. France is also one of the strictest countries on social security, requiring registration and contributions for virtually any work performed on its territory.

Thailand and Bali

Popular digital nomad destinations in Southeast Asia present a different problem: many employees work on tourist visas, which typically do not permit employment. Working on a tourist visa is illegal in most countries, and if the employee is caught, the consequences fall on both the individual (deportation, entry bans) and potentially the employer (fines, reputational damage). There is no UK-Thailand social security agreement, so dual contributions may apply.

United States

The US adds a layer of state-level complexity. Each of the 50 states has its own income tax rules (some have no state income tax; others, like California and New York, are aggressively taxing). An employee working from a US state for even a short period can create "nexus" - a connection that triggers the state's right to tax both the individual and, in some cases, the company's income. US federal tax obligations also apply, and the UK-US DTA is complex.

Immigration and Right to Work

Before even reaching the tax questions, there is a fundamental immigration issue: does the employee have the legal right to work in the destination country? Post-Brexit, UK nationals no longer have automatic freedom of movement within the EU. Working from an EU country - even remotely for a UK employer - generally requires either a work visa, a posted worker arrangement, or reliance on the business visitor exemption (which typically covers meetings and conferences, not productive work).

Many employees assume that "working remotely" is not really "working in" the host country. Immigration authorities do not share this view. Remote work performed on a country's territory is work performed in that country, and the immigration rules apply regardless of who the employer is or where they are based.

Employment Law Complications

If an employee works in another country for an extended period, they may acquire employment rights under that country's local labour law. This could include:

Local minimum wage requirements (which may exceed UK minimum wage).
Local working time restrictions (France's 35-hour week, for example).
Local dismissal protections (many EU countries have stronger unfair dismissal protections than the UK).
Local holiday entitlements (which may differ from the UK's 28-day statutory minimum).
Mandatory local benefits (health insurance, pension contributions, meal vouchers).

The exact threshold varies by country, but extended or repeated work in a single location significantly increases the risk of local employment law applying.

Data Protection and GDPR

If the employee handles personal data (customer records, employee information, medical data), working from another country may create cross-border data transfer issues. Within the EU/EEA, GDPR provides a consistent framework, but working from a non-EEA country without an adequacy decision could mean that the employee's access to EU/UK personal data violates data protection law. Your company's data protection impact assessment should cover remote work scenarios, and you may need additional safeguards (encryption, VPN, restricted access) for employees working from high-risk jurisdictions.

What Should UK Employers Do?

1. Create a Clear Work-from-Abroad Policy

Do not leave it to ad-hoc manager decisions. Create a written policy that specifies which countries are pre-approved (low-risk, DTA-covered EU countries for short stays), the maximum number of consecutive days allowed (many companies cap at 2 to 4 weeks per year), the approval process (who needs to sign off and how far in advance), and prohibited countries (those with no DTA, high PE risk, or immigration complications).

2. Get Specialist Advice Early

If an employee wants to work from abroad for more than two weeks, consult a tax adviser with international expertise before approving it. The cost of specialist advice is trivial compared to the cost of an unexpected foreign tax registration, social security audit, or PE determination.

3. Obtain an A1 Certificate for EU/EEA Work

For any employee working in an EU/EEA country, apply for an A1 certificate from HMRC before the work begins. This confirms that the employee remains subject to UK National Insurance and prevents the host country from demanding local social security contributions. The application is straightforward but must be done proactively.

4. Track Where Your People Are

You need to know where your employees are working at all times - not because you do not trust them, but because your tax and legal obligations depend on it. A leave management system that records not just when people are off but also flags work-from-abroad periods is essential for compliance. Maintain a log of overseas work days per employee per country per tax year.

5. Consider Insurance

Employer's liability insurance policies typically have territorial limits. Check whether your policy covers employees working outside the UK. If not, arrange overseas cover - or explicitly exclude overseas work from your policy and communicate this to employees.

6. Do Not Forget the Basics

Ensure the employee has appropriate travel and health insurance, secure access to company systems (VPN, encrypted devices), a suitable workspace that meets health and safety standards (even remotely), and awareness of local laws that may affect their behaviour (for example, accessing certain websites may be illegal in some countries).

A Quick Decision Framework

Duration	Risk Level	Recommended Action
1–2 weeks, EU/EEA	Low	Obtain A1 certificate. Check immigration. Generally safe under most DTAs.
3–4 weeks, EU/EEA	Medium	Obtain A1 certificate. Check DTA specifics for the country. Consider specialist tax advice.
1+ month, any country	High	Mandatory specialist advice. Check PE risk, local employment law, immigration, data protection.
Recurring/regular pattern	Very High	Likely need local entity, EOR, or formal posted worker arrangement. Professional advice essential.

The Bottom Line

"Working from the beach" sounds idyllic, but the regulatory reality is complex. A short, occasional, pre-approved stint in a DTA-covered EU country is manageable with basic planning. Anything beyond that requires specialist advice and a clear policy framework. The cost of getting it wrong - unexpected tax bills, social security penalties, PE determinations, immigration violations - far exceeds the cost of getting advice upfront.

As a UK employer, your responsibility is to know where your people are working, understand the obligations that creates, and have systems in place to track and manage the risk. A leave management system that records work-from-abroad periods alongside regular leave is a practical first step.

Track Your Team's Leave the Easy Way

Work-from-Anywhere vs. Digital Nomad Tax: The Hidden Risks for UK Employers