Remote Hiring Compliance 2026

Your employee’s location creates your compliance obligations

When your engineer works from Lisbon, Portuguese rules apply. HQ location and “Delaware governing law” language do not move Portuguese tax authority jurisdiction. Pair country detail with best EOR by country and country hiring guides.

1. Permanent Establishment Risk

Permanent establishment (PE) is the risk that your company creates a taxable presence in another country through the activities of a remote employee. If a tax authority determines you have a PE, you owe corporate income tax on profits attributable to that PE, retroactively.

The OECD framework. Most countries base PE rules on the OECD Model Tax Convention, which defines PE through two main tests:

Fixed place of business PE. If your company has a fixed location through which it conducts business, an office, a branch, even a home office in some interpretations, a PE may exist. A remote employee working from their apartment generally doesn’t trigger this, unless the employer requires them to work from that location (creating a “fixed place at the employer’s disposal”).

Dependent agent PE. If a person in a country habitually exercises authority to conclude contracts on your behalf, or habitually plays the principal role leading to the conclusion of contracts, they create a dependent agent PE. This is the risk for sales roles. Your remote sales rep in Germany who meets clients, negotiates pricing, and effectively closes deals creates a PE, even if someone in headquarters clicks “approve” on the contract.

Country-specific PE risk levels:

Mitigation: Restrict remote employees from activities that trigger PE, no contract signing, no deal negotiation, no strategic decision-making on behalf of the company in-country. Document these restrictions. Use EOR for employment (which separates the employment relationship from your entity), but understand that EOR doesn’t prevent PE from the employee’s commercial activities.

2. Tax Nexus and Withholding Obligations

Separate from PE, having an employee in a country can create tax withholding and reporting obligations.

Payroll tax. If you employ someone in a country (even through EOR), payroll taxes must be withheld and remitted in that country. The EOR handles this. But if you also have direct payments to the employee (bonuses, equity, reimbursements) that bypass the EOR’s payroll, you may create parallel withholding obligations.

Corporate tax nexus (US state-level). In the US, each state has its own nexus rules. Having a remote employee in California, New York, or Texas can create corporate income tax, franchise tax, and sales tax obligations in that state. Some states assert nexus with a single employee. The Wayfair decision expanded economic nexus for sales tax, and states are applying similar logic to income tax.

Double taxation treaties. If PE is triggered, double taxation agreements (DTAs) between countries determine how profits are allocated and which country has primary taxing rights. Most DTAs follow the OECD model, but specifics vary. The DTA may not fully eliminate double taxation, it allocates primary and secondary taxing rights, and the mechanics of credits and exemptions create real complexity.

Employee tax residency. Your EOR employee is tax-resident where they live. But if they spend significant time in another country, your headquarters country, a client’s country, a “workcation” country, they may trigger tax obligations there too. The 183-day rule is a rough guide, but many countries use more nuanced tests.

3. Employment Law Jurisdiction

The employment law that governs your remote worker is the law of the country where they work. An EOR handles compliance with this law, that’s the core EOR value proposition.

But some employment law issues sit at the intersection of the EOR’s responsibility and yours:

Working time regulations. The EU Working Time Directive limits working weeks to 48 hours (averaged). France adds the “right to disconnect.” Germany’s Arbeitszeitgesetz restricts daily working hours to 10 hours. If your US-based manager expects your German remote employee to be available 12 hours a day, you’re violating German working time law, and the EOR contract won’t protect you from an employee complaint.

Health and safety. Many countries extend workplace health and safety obligations to home offices. Germany’s Arbeitsstättenverordnung covers home workstations. France requires employers to ensure ergonomic working conditions even for remote workers. The EOR may include basic guidance, but the practical responsibility to ensure your remote employee has a safe workspace falls on you.

Data protection in the employment context. Employee monitoring, email access policies, and productivity tracking are regulated differently by country. Germany’s Bundesdatenschutzgesetz (BDSG) and works council co-determination rights severely restrict employee monitoring. France limits employer surveillance. Installing monitoring software on your German EOR employee’s laptop without proper consent and works council approval violates German law.

4. Data Privacy (GDPR and Beyond)

Remote international teams create cross-border data flows that trigger privacy regulations.

GDPR for EU/EEA employees. If you have employees (including EOR employees) in the EU, GDPR governs their personal data. This includes:

• Lawful basis for processing. Employment data is typically processed under “legitimate interest” or “performance of a contract.” Consent is rarely the right basis for employment data (because the power imbalance between employer and employee makes consent non-voluntary).
• Cross-border transfers. If employee data flows from the EU to your US headquarters, you need transfer mechanisms: Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or reliance on an adequacy decision (the EU-US Data Privacy Framework, if still in effect).
• Data minimization. Collect only the personal data you need. Your US HR team doesn’t need your German employee’s religious affiliation (which is relevant for German tax purposes but shouldn’t flow to your US systems).
• Data breach notification. 72 hours to notify the relevant supervisory authority. If your employee’s data is breached (payroll records, health information, tax IDs), the clock starts immediately.

GDPR fines: Up to €20M or 4% of global annual turnover. These are theoretical maximums, but regulators have issued multi-million euro fines for employment data violations. The Austrian DPA fined a medical company for unlawful processing of employee health data. The French CNIL has fined companies for excessive employee monitoring.

Beyond GDPR:

• Brazil’s LGPD (Lei Geral de Proteção de Dados) mirrors GDPR for Brazilian employee data
• India’s DPDP Act (Digital Personal Data Protection Act, 2023) creates data processing obligations for Indian employee data
• Singapore’s PDPA covers employee personal data with some employment-specific exemptions
• US state privacy laws (California’s CCPA/CPRA, Virginia’s CDPA, Colorado’s CPA) increasingly cover employee data

5. Work-From-Anywhere Policies: The Compliance Framework

“Work from anywhere” sounds progressive until your employee works from a country that creates PE, triggers tax obligations, or violates immigration rules.

The compliance risks of unrestricted work-from-anywhere:

• Tax residency. Employee spends 4 months in Portugal → becomes Portuguese tax resident → owes Portuguese income tax → your EOR was only set up in the UK
• Immigration. Employee works from Thailand on a tourist visa → violating Thai immigration law → potential deportation and employer penalties
• PE creation. Employee works from Germany for 6 months → performs sales activities → triggers German PE → corporate tax liability
• Social security conflicts. Employee works in multiple EU countries → A1 certificate requirements → potential dual social security obligations

Building a compliant policy:

1. Define approved countries. Limit work-from-anywhere to countries where you already have employment coverage (through EOR or entity) or where the compliance risk is low for the employee’s role.

2. Set duration limits. Most compliance obligations trigger after extended stays (30–90 days depending on country and obligation type). Set a maximum of 30 days per country per year for “workcation” travel.

3. Require pre-approval. Employees must notify you (and your EOR) before working from a different country for more than X days. This gives you time to assess tax and PE implications.

4. Distinguish between relocation and travel. Working from a cafe in Barcelona for 2 weeks is travel. Moving to Barcelona permanently is relocation. The compliance obligations are fundamentally different, and your policy should distinguish between them.

5. Consider role-based restrictions. Sales roles that create PE risk may need stricter geographic restrictions than engineering roles. A remote engineer writing code in Lisbon is low risk. A remote sales director meeting Portuguese clients from Lisbon is high risk.

6. Track employee locations. Use self-reporting or location tracking tools. Deel and Remote offer policy management tools that track employee locations against your approved-country list.

Compliance Checklist for Remote International Teams

Who should skip the full remote-compliance framework

Frequently Asked Questions

Does an EOR eliminate permanent establishment risk?

No. EOR separates legal employment from your entity. PE still attaches to commercial activities (contracting authority, sales negotiation, fixed place at your disposal). Restrict role scope and document it.

Who owns GDPR compliance for remote EOR employees?

Shared. The EOR typically processes HR data as a processor or joint controller depending on the contract. Cross-border transfer mechanisms and product/customer data remain yours.

When is a full remote-hiring compliance audit worth it?

Multi-country setups, sales-heavy roles in France/Germany/India, or WFA policies that let employees relocate without notice. A single UK engineer on EOR usually needs a lighter review.

Sources

• Remote: Website, Pricing, Coverage
• Deel: Website, Pricing, Coverage

Related Decision Pages

• EOR Compliance Risks : Detailed compliance risk analysis
• How Does an EOR Work? : Understanding the EOR legal structure
• Contractor vs. Employee Classification : Classification compliance by country
• Hiring in Europe Guide : European compliance specifics
• 5 Ways to Hire Internationally : All hiring models compared
• Compare EOR providers
• Top EOR reviews
• Hiring your first international employee