The Five HR Documents Your Business Doesn't Have (And Needs by Christmas)
A client sent me her "complete HR pack" last month. She'd paid £600 for it from an online provider. It had 47 documents in it. It was also missing three things that are now statutory requirements and including four things that were repealed in 2023.
That's the HR template market for you. Volume substitutes for accuracy, and nobody's coming back to update what they sold you.
If you run an SME and you're trying to work out what you actually need (not what someone wants to sell you), here are the five documents most businesses are missing in 2026. Not the obvious ones. The ones that quietly create liability when they're absent.
Note: this post is about the documents SMEs typically don't have. For the statutory floor — what the law explicitly requires you to have, with citations — see our Five Policies Every UK Business Must Have by Law. The two posts overlap by design. This one is about the operational gap. The other is about the legal one.
1. A Written Statement of Employment Particulars That's Actually Current
Every employee and worker has the right to one of these on day one. Not the contract, the statement. They're different documents and they have different statutory contents.
Most SMEs roll them into the contract, which is fine — but the statutory content list expanded in 2020 and again under recent regulations. Probationary period details, training entitlements, paid leave breakdown by type, and benefits beyond pay all need to be in there explicitly. If your contracts are pre-2020 and you've never reviewed them, they're probably non-compliant.
2. A Data Protection Notice for Employees
Separate from your customer privacy policy. Employees need to know what data you hold on them, why, how long for, and what their rights are. UK GDPR makes this an active obligation, not a "we'll deal with it if asked" obligation.
The ICO has been quietly fining small businesses for missing this — £2,000 to £15,000 range. Nobody talks about it because nobody wants to be the example.
3. A Grievance Procedure That Someone Could Actually Follow
Most SME grievance procedures are two paragraphs that say "raise concerns with your manager" and then "if unresolved, escalate to a director." That's not a procedure — that's a hope.
A usable grievance procedure has timelines (10 working days to acknowledge, 20 to investigate, 5 to communicate outcome), names a route that doesn't depend on the person being complained about, and includes appeal rights. The ACAS Code is the floor, and tribunals adjust awards by up to 25% for unreasonable failure to follow it.
4. A Disciplinary Policy With Actual Structure
Same problem. Most have "informal chat, written warning, final warning, dismissal" and nothing else. That's a list, not a policy.
What's missing: who investigates versus who decides (different people, ideally), what evidence threshold applies, what right of accompaniment looks like, how appeals work, and how serious misconduct (gross misconduct) is treated differently from capability issues. The two get conflated constantly — and it causes most of the procedural failures we see. See our guide to a structured disciplinary policy for what operational depth looks like.
5. A Whistleblowing Policy
Mandatory for UK businesses operating in EU jurisdictions where the EU Whistleblower Directive applies. For UK-only businesses of any size, the Public Interest Disclosure Act 1998 (PIDA) protections apply to workers who raise protected disclosures, regardless of whether the employer has a formal whistleblowing policy in place.
This creates an asymmetry: the legal protection exists for the employee whether you have a policy or not. The absence of a policy means employees may go straight to regulators or media because there is no documented internal route. The cost of "no policy" isn't a fine — it's that you find out about issues from outside parties when you could have heard about them inside.
Most SMEs don't have this document at all. It's the single biggest gap we see.
Why This List Differs From the Legal Floor
Three of the five documents above (Written Statement of Particulars, Data Protection Notice, Grievance Procedure) appear on the strict legal floor. The other two (Disciplinary Policy with structure, Whistleblowing Policy) are operationally critical but only partially mandatory.
This is intentional. The "what's legally required" question is a different question from "what does an SME actually need to operate defensibly." A grievance procedure that satisfies ERA 1996 Section 3 (one paragraph saying "raise concerns with your manager") technically complies with the statute. It also loses at tribunal almost every time.
The five documents above are what we see SMEs missing when something goes wrong. The five policies in our other post are what the statute explicitly demands. The overlap is real and intentional — the second list is a subset of operational reality with sharper legal grounding.
Common questions about HR documents for UK SMEs
How many HR documents does a small business legally need?
The strict statutory floor is set out in our Five Policies post — Health and Safety Policy, Disciplinary and Grievance Procedures, Data Protection Notice, Written Statement of Particulars, and Risk Assessment. Beyond those, additional documents are required in specific contexts (modern slavery statements at £36m turnover, gender pay gap reporting at 250+ employees, etc.).
Do I need separate documents or can I bundle them into one handbook?
You are not legally required to have a single handbook document. The legal requirements are about the content, not the format. Most SMEs choose a handbook because it is easier to maintain one document than several separate ones, but a folder of distinct policies is equally compliant if the content is there.
Should I buy a template pack or have a solicitor draft them?
Both have failure modes. Generic template packs (£200–£800) cover the basics but are often years out of date and don't reflect specific industry or operational context. Solicitor-drafted documents (£2,000–£5,000) are typically current but expensive enough to discourage updates as law changes. The third option — AI-assisted drafting with practitioner review — is what Bounda is trying to build. The honest answer is that "current and contextually fit" matters more than which production method got you there.
How often should HR documents be reviewed?
Annually at minimum. Plus whenever there's a material change in the law (Employment Rights Act 2025 is the obvious 2026 example) or in your operations (new locations, new types of workers, significant headcount changes). Documents written more than two years ago and never reviewed are routinely non-compliant.
What's the single most missed HR document?
Across the SMEs we see, the most consistently missing document is the employee-facing data protection notice. Most businesses have a customer privacy policy but no equivalent for staff. The ICO has been quietly enforcing this for several years.
What This Looks Like by Christmas
Five documents. None of them long. Maybe ten pages of total content, properly written. The cost of getting them done is somewhere between £600 (template provider, partial accuracy) and £3,000 (employment solicitor, full coverage).
The cost of not having them shows up as a single tribunal award — currently averaging roughly £14,000 for unfair dismissal and £37,000 for discrimination claims.
The Honest Take
HR documentation is genuinely boring. Nobody started a business to write a grievance procedure. But the businesses that handle this badly aren't the ones with bad intentions — they're the ones with no time — and the cost of "we'll sort it later" compounds quietly until it doesn't.
Bounda exists because this gap is structural, not personal. It's not that SME owners don't care. It's that the existing options (£600 template packs or £3,000 solicitors) are both wrong for most businesses. We're trying to build the middle. Read the longer version of why we built it and what we're trying to do differently. For a follow-on on a policy most handbooks get wrong even when the documents exist, see sickness absence.
