Labour compliance for SMEs: 2026 guide to obligations by workforce size in Spain

Labour compliance in an SME is not a department or an expensive programme: it is the list of obligations the company has towards its workers, Social Security and the Labour Inspectorate, and the proof that it meets them. The problem is that the list has grown a lot in a few years and changes with the size of the workforce: what the law demands of a 12-person company is not what it demands of a 55-person one. This guide orders the obligations in force in Spain in September 2026 by headcount threshold, with the rule behind each, and separates what already binds from what is still being processed.

Obligations from the first worker

They apply to every company with at least one person hired, whatever the sector.

Hiring and registration

• Registration with Social Security before work begins and notification of the contract to the public employment service within the following ten working days (article 16 of the Workers’ Statute).
• Written form where the law requires it (part-time, permanent-seasonal, training, remote, temporary contracts of more than four weeks) and whenever either party asks. A basic copy to the workers’ representatives, if any, within ten days.

Working time

• Daily working-time record (article 34.9), kept for four years. It is the most inspected obligation. The Royal Decree that will make it exclusively digital remains unpublished as of 15 September 2026; we explain its status in the new digital clock-in law.
• Annual work calendar drawn up and displayed in a visible place at each site (article 34.6), as detailed in our guide to Spain’s 2026 work calendar.
• Limits on hours, rest periods and overtime under the Statute and the collective agreement. The maximum legal week is still 40 hours on average over the year; the reduction to 37.5 hours is not in force, as we explain in what happened to the 37.5-hour week.

Pay and documentation

• Individual payslip delivered to each worker (article 29) and retention of payslips and contribution documentation for four years.
• Pay register for the whole workforce, with mean and median values of salaries and supplements broken down by sex and group or category, mandatory for all companies since 14 April 2021 (Royal Decree 902/2020).

Equality and protection against harassment

• Protocol against sexual and sex-based harassment and measures to prevent it (article 48 of Organic Law 3/2007), mandatory for all companies.
• Adaptation of working hours for work-life balance (article 34.8): the obligation to negotiate requests in good faith.

Occupational risk prevention

• Prevention plan, risk assessment and planning (Law 31/1995), with a preventive arrangement: the employer personally in very small companies where the law allows, a designated worker, or an in-house or external prevention service. Training and information for workers, health surveillance and coordination of activities when several companies share a site.

Data protection and disconnection

• GDPR and LOPDGDD: information to workers on the processing of their data, a record of processing activities, security measures, and specific rules on digital devices, video surveillance and geolocation (articles 87 to 90 of the LOPDGDD).
• Internal digital disconnection policy (article 88.3 of the LOPDGDD), mandatory for all companies.

Remote work and absences

• Written remote-work agreement when teleworking is regular (Law 10/2021), with compensation of expenses; detailed in remote work in Spain: obligations.
• Management of sick leave under Royal Decree 1060/2022: the company reports the economic data through the RED System within three working days and no longer receives the note from the worker, as we explain in medical absences in the SME.

Obligations that arrive at 50 workers

The threshold of 50 changes the map. The company’s total headcount counts, with the counting rules of each rule.

Obligation	Rule	From	What it involves
Equality plan, negotiated and registered	Organic Law 3/2007 and Royal Decree 901/2020	50 or more workers, mandatory since 7 March 2022	Diagnosis, measures, calendar of up to four years, negotiating committee and entry in the public register
Pay audit	Royal Decree 902/2020	Companies required to have an equality plan	Evaluation of jobs of equal value and a plan to correct inequalities, within the plan
Whistleblowing channel (internal reporting system)	Law 2/2023	50 or more workers	System Manager, anonymous and confidential channel, 7-day and 3-month deadlines, information on the external channel; detail in internal or external whistleblowing channel
LGTBI measures and protocol	Law 4/2023 and Royal Decree 1026/2024	More than 50 workers, in force since 10 October 2024	A planned set of negotiated measures and a protocol against harassment and violence towards LGTBI people
Reserved quota for people with disabilities	Legislative Royal Decree 1/2013	50 or more workers	At least 2 % of the workforce, or authorised alternative measures
Works council	Workers’ Statute	50 or more workers	Representative body with information and consultation rights; below that, staff delegates from 6 workers if elections are called

Below 50, some of these obligations may come through the collective agreement or by agreement, and the equality plan is voluntary but can be registered.

What is still being processed (and should not be taken as in force)

• Royal Decree on the digital working-time record: it will ban paper and Excel and give the Inspectorate remote access. Unfavourable opinion of the Council of State on 23 March 2026 and announcement of “immediate” approval on 9 September; unpublished in the BOE.
• 37.5-hour week: rejected in Congress on 10 September 2025; it applies only where the collective agreement sets it.

Preparing for both costs little if the working-time record is already digital and reliable; the current penalties are in the table of time-tracking penalties.

Labour compliance checklist for an SME

Print it or copy it and tick what you have documented, not what you think you comply with.

1. Social Security registrations before start and contracts notified within ten working days.
2. Written contracts where required, signed and archived; basic copy delivered if there is representation.
3. Daily working-time record for the whole workforce, kept for four years, with traceability of corrections.
4. The year’s work calendar displayed at each site.
5. Payslips delivered with proof of receipt and kept for four years.
6. Pay register up to date and available to the workers’ representatives.
7. Protocol against sexual and sex-based harassment approved and communicated.
8. Prevention plan, risk assessment, preventive arrangement, training and health surveillance up to date.
9. Data-protection information to staff, record of activities and digital disconnection policy.
10. Written remote-work agreements with compensation of expenses.
11. Absence and sick-leave procedure under Royal Decree 1060/2022.
12. If you have 50 or more: registered equality plan, pay audit, whistleblowing channel with System Manager, LGTBI measures and protocol, disability quota and works council.

How LapsoWork helps

LapsoWork does not replace your employment adviser, but it turns much of this list into records that exist without effort: time tracking with timestamping and audited export, the document manager with biometrically signed and retained contracts and payslips, the leave and absence module with calendars per site and absence types, and, on the Advanced plan, the Law 2/2023 whistleblowing channel. All from €2 per employee per month, as you can see on our pricing page.

Frequently asked questions

What employment obligations does a company with fewer than 50 workers have in Spain?

Those that apply from the first employee: prior registration and notification of contracts, daily working-time record, displayed work calendar, payslips and four-year retention, pay register, protocol against sexual harassment, occupational risk prevention, data protection and digital disconnection policy, remote-work agreements and management of sick leave under Royal Decree 1060/2022.

What changes at 50 workers?

The negotiated and registered equality plan with its pay audit, the Law 2/2023 whistleblowing channel, the LGTBI measures and protocol of Royal Decree 1026/2024 (from more than 50), the 2 % reserved quota for people with disabilities and the works council as representative body are added.

Is the pay register mandatory in small companies?

Yes. Royal Decree 902/2020 requires all companies, regardless of size, to keep a pay register for the whole workforce since 14 April 2021, with mean and median values of salaries, supplements and non-wage payments broken down by sex and by group, category or job of equal value.

Is the digital clock-in obligation in force?

The daily working-time record is, since 2019, with any reliable system. The obligation for it to be exclusively digital, tamper-proof and accessible remotely by the Inspectorate is in the Royal Decree being processed, unpublished in the BOE as of 15 September 2026.

Do I need a labour compliance programme in an SME?

Not as a formal structure, but yes a list of obligations with an owner, evidence and a review date, and systems that generate the evidence (working-time record, signed documents, absences) without manual work. It is what the Inspectorate asks for: not that you say you comply, but that you prove it.

Conclusion

Labour compliance for an SME in Spain in 2026 comes down to two lists: the one that applies from the first worker and the one that activates at 50. None requires large structures, but all require proof: records, signed documents, approved and communicated protocols. Organising that proof in a system rather than in folders and emails is the difference between complying and being able to prove it. To start with the most inspected items, the working-time record and documents, try LapsoWork free for 30 days.