---
title: "HR due diligence in 2026: the unfunded pension nobody put on the balance sheet"
lang: en
canonical_url: https://www.papermark.com/blog/hr-due-diligence
last_updated: 2026-08-11
published: 2026-08-11
category: [mergers-and-acquisitions]
author: "Marc Seitz"
summary: "HR due diligence in 2026: the 9 domains, the pension and classification traps, TUPE and works council timing, plus the data room for HR due diligence."
---

# HR due diligence in 2026: the unfunded pension nobody put on the balance sheet

HR due diligence is the review of a target company's people: headcount, employment contracts, compensation, equity, benefits, pensions, payroll, collective arrangements, and open employment disputes. It is the one workstream whose source documents are almost entirely personal data, which makes the review itself a data-protection event.

## Quick recap

- HR due diligence covers 9 domains: headcount, contracts, compensation and equity, benefits and pensions, payroll and classification, collective arrangements, litigation, immigration, and retention risk.
- Unfunded defined-benefit pension schemes hold the largest unbudgeted number, because the liability is actuarial rather than contractual and moves with discount rates.
- Worker misclassification, meaning contractors who are employees in substance, creates back-tax and social-security exposure running backwards over years, not from closing.
- Under TUPE in the UK and the EU Acquired Rights Directive, employees transfer automatically on a business or asset transfer, with terms and continuity of service preserved. A share sale usually does not.
- In Germany, France and the Netherlands, works council information and consultation rights sit on the critical path to signing.
- US deals differ: employment is generally at will, the WARN Act requires 60 days notice for qualifying mass layoffs, and COBRA governs continuation of health coverage.
- Change-of-control terms matter more than the option count: single-trigger acceleration vests on the deal alone, double-trigger needs the deal plus a qualifying termination.
- Employee files are personal data under GDPR and often special-category, so diligence runs on anonymised schedules first and named files only inside a clean team.
- A data room for HR due diligence is built around that staging: anonymised schedules in the main room, named files behind a clean-team link.
- Papermark hosts a data room for HR due diligence with granular file-level permissions, dynamic watermarking, and per-visitor analytics from €99/month.

Buyers tend to treat the people workstream as a soft one, run late and handed to whoever has capacity. Then the actuary's first estimate on the pension scheme arrives in week six and moves the price more than anything commercial diligence found. Meanwhile the seller has emailed a spreadsheet of 620 named employees, with salaries and sickness records, to four advisers.

This guide covers the nine domains, the pension and classification traps, how jurisdiction changes the mechanics, and how disclosure is staged. Because so much of the material is personal data, a **data room for HR due diligence** is not administrative convenience. It is what makes staged disclosure possible. Section 10 covers the setup.

## 1. What is HR due diligence?

HR due diligence is a structured review of a target's workforce and employment obligations, run by a buyer or investor after a letter of intent and delivered as a report quantifying people cost, people liability, and retention risk. It answers three questions: what do these people cost, what is owed to them that is not on the balance sheet, and which of them will still be here in twelve months.

It overlaps with legal diligence and is often bought inside it, but the two ask different things. Employment counsel reads contracts for enforceability and prices open tribunal claims. HR diligence reads the same documents for cost and structure: loaded cost per head, how many people sit on non-standard terms nobody remembers agreeing, whether the bonus scheme is discretionary in the contract but contractual in practice. Our [legal due diligence checklist](/blog/legal-due-diligence-checklist.md) covers the counsel side of the same document set.

What makes HR diligence different is the evidence. An HR reviewer reads employment contracts, payroll files, grievance records, absence data and occupational health reports, all of which identify named individuals and some of which touch health or union membership. Those are personal data in every European jurisdiction, and several categories are special-category data under Article 9 of the GDPR. The review cannot be run as a document dump without creating a compliance problem the seller owns whether or not the deal completes.

## 2. The nine domains of an HR due diligence review

The nine domains below make up a standard scope. Each produces findings that land in one of three places: the price, the disclosure schedule, or the integration plan. A report that does not say which has not finished its job.

Headcount and structure come first because they calibrate everything else. The reviewer wants a headcount schedule reconciled to payroll, split by entity, location, function and contract type, with spans of control mapped so the org chart can be tested against the cost base. Companies that grew by hiring rather than designing often show a manager-to-contributor ratio that explains much of the overhead the buyer is inheriting.

Employment contracts follow. The question is not whether contracts exist but how many versions exist and what lives inside the exceptions: long notice periods for senior staff, bonus entitlements the company treats as discretionary, guaranteed severance multiples, covenants unenforceable where the employee actually works, and legacy terms carried over from a previous transfer, which in a business that has itself been acquired before are a recurring surprise.

| # | Domain | Documents requested | Typical red flag |
| --- | --- | --- | --- |
| 1 | Headcount and structure | Headcount schedule by entity, org chart, spans of control | Headcount does not reconcile to payroll |
| 2 | Employment contracts | Standard templates, all deviations, senior contracts | Non-standard severance and notice terms |
| 3 | Compensation and equity | Salary bands, bonus plans, option plan and cap table | Single-trigger acceleration on change of control |
| 4 | Benefits and pensions | Scheme rules, actuarial valuations, insurance policies | Unfunded defined-benefit obligation |
| 5 | Payroll and classification | Payroll registers, contractor agreements, invoices | Contractors who are employees in substance |
| 6 | Collective arrangements | Union agreements, works council rules, consultation records | Consultation obligation not yet started |
| 7 | Employment litigation | Claim log, settlement agreements, grievance register | Settlements with non-standard confidentiality |
| 8 | Immigration and right to work | Visa register, sponsorship licence, right-to-work checks | Sponsorship licence tied to the selling entity |
| 9 | Retention risk | Attrition by function, key-person list, engagement data | No contractual hold on named key people |

Requests then arrive in two shapes. Aggregate requests ask for schedules: headcount by grade, payroll cost by entity, bonus accrual. Individual requests ask for files: this employee's contract, that settlement agreement. The first can be answered in the main room from day one, because a properly built schedule holds no personal data. The second cannot, and the seller who treats them alike ends up with named payroll files in front of a lender's analyst.

## 3. Compensation, equity and the change-of-control triggers

Compensation review starts with the run rate and ends with the clauses. The run rate is the straightforward part: base salary by grade and location, variable pay actually paid over the last three cycles against what was accrued, commission plans, allowances, and the employer social-security load, which varies enough across jurisdictions to distort any comparison run on base salary alone.

Equity is where the review turns from arithmetic into contract reading. Pool size matters far less than the terms attached to it, and those sit in the plan rules rather than the cap table the seller circulates first. Single-trigger acceleration vests options on the transaction alone. Double-trigger requires the transaction plus a qualifying termination within a defined window, usually twelve months. Single-trigger means the buyer pays out the pool at closing and then has to build a fresh retention package for people just made whole, while double-trigger keeps the incentive alive through integration.

Phantom equity deserves its own request line. Cash-settled plans that mirror share value do not appear on a cap table at all, which is why they get missed. They crystallise on a change of control and are paid in cash, so they hit the completion accounts rather than the equity waterfall.

## 4. Pensions, classification and the liabilities that arrive unbudgeted

Two domains produce most of the unbudgeted money in HR diligence, and neither is visible in the payroll number.

Defined-benefit pension obligations come first. Where a target sponsors or participates in a defined-benefit scheme, the buyer is not acquiring a monthly contribution line, it is acquiring a promise to pay specified benefits for the rest of members' lives, funded by assets that may or may not cover it. The gap is actuarial, sensitive to discount rate and mortality assumptions, and can move between valuations without anything happening at the company. Multi-employer schemes are worse, because withdrawal can crystallise a share of the whole scheme's shortfall.

Worker classification is the second. Every business that scaled quickly has contractors, and some are employees in substance: fixed hours, company equipment, a named manager, no substitution right, three years of it. Reclassification creates back exposure for income tax and social-security contributions the company should have withheld, plus entitlements to holiday pay and notice, running backwards over the limitation period rather than starting at closing. That is why classification findings become indemnities rather than price adjustments: the exposure is real but unquantified until an authority takes a view. Insured benefits carry a smaller version of the same problem, since group life and medical policies are written for a named policyholder and may need replacing rather than transferring.

| Finding | How it surfaces | Commercial remedy |
| --- | --- | --- |
| Defined-benefit deficit | Actuarial valuation updated to the deal date | Price adjustment sized to the deficit, or escrow |
| Multi-employer scheme participation | Participation agreement and withdrawal terms | Specific indemnity, withdrawal cost is uncapped |
| Contractors employed in substance | Agreements read against actual working practice | Indemnity covering back tax and social security |
| Single-trigger acceleration | Change-of-control clause in the equity plan rules | Deducted from consideration, replaced with retention |
| Phantom or cash-settled plan | Board resolutions and accruals, not the cap table | Completion accounts adjustment |
| Discretionary bonus paid every year | Three cycles of actual payment against plan wording | Working capital normalisation, not a one-off |
| Consultation not yet started | Works council agreement read against the timetable | Condition precedent, with the timetable rebuilt |

## 5. Jurisdiction decides the mechanics

The same finding produces a different plan depending on where the people are, and this is the part buyers used to single-jurisdiction deals get wrong most often. Structure matters as much as geography, because the rules turn on whether the deal is a share sale or a business and asset transfer.

In the UK, TUPE gives employees assigned to a transferring undertaking an automatic transfer to the buyer on their existing terms, with continuity of service preserved. The buyer inherits the contracts as they are, including the non-standard ones, and dismissals connected to the transfer are hard to defend. The EU Acquired Rights Directive sets the same baseline across member states. A share sale usually does not trigger a transfer, because the employing entity is unchanged and only its ownership moves, but that does not make it a people-free event: the contracts, the pension scheme and the disputes all come with the entity.

Continental Europe adds a collective layer with real timing consequences. In Germany, France and the Netherlands, works councils hold information and consultation rights, and the employer sometimes cannot take certain steps before the process has run. Consultation is usually a process obligation rather than a veto, but it takes calendar time, cannot be compressed by paying for it, and cannot start until the deal is advanced enough to describe honestly.

The United States runs on different assumptions. Employment is generally at will, so the buyer has flexibility European buyers do not, but two federal rules bite. The WARN Act requires 60 days advance written notice of qualifying plant closings and mass layoffs, with state mini-WARN statutes sometimes stricter, so a day-one headcount reduction has to be planned two months ahead rather than announced. COBRA governs continuation of group health coverage, and that obligation does not disappear because a business changed hands.

![Link-level permissions restricting the pension and payroll folders in an HR due diligence data room](https://assets.papermark.io/upload/file_P9F42XX8yNuBCfvGS8A61i-link-permissions.png)

_Jurisdiction folders carry different rules, so local counsel sees only the entity they advise on._

## 6. Employee data is personal data: staged disclosure and the clean team

Every other workstream can, in principle, be run by putting documents in a room and letting reviewers read them. HR cannot, because the seller remains the controller of its employees' personal data throughout. Disclosing named files is a processing activity needing a lawful basis, a documented rationale for why that data was necessary, and an answer to why less would not have sufficed.

So HR diligence runs in two stages. The first is anonymised. The seller builds schedules carrying what the buyer needs to model the business, with names replaced by reference numbers: employee 0142, grade 6, Hamburg, permanent, joined 2019, base salary, bonus, notice period, on long-term absence yes or no. Be precise about the terms. Pseudonymised data is still personal data under the GDPR, since the key exists. Only genuinely anonymised data falls outside the regime, and in small populations a job title plus a location plus a hire date can identify someone as reliably as a name.

The second stage is named, narrow and late. By then the buyer should be able to say which individuals it needs files on and why: the twelve senior contracts carrying non-standard severance, the four open tribunal claims, the sponsored visa holders. That is a few dozen files, not the whole payroll.

| Material | Stage 1, anonymised | Stage 2, clean team | Why |
| --- | --- | --- | --- |
| Headcount and cost schedule | ✔️ | - | Reference numbers answer every modelling question |
| Standard contract templates | ✔️ | - | No individual is identified by a template |
| Senior executive contracts | - | ✔️ | Terms are individual and cannot be aggregated |
| Payroll register | ✔️ | - | Aggregate by grade and entity, never by name |
| Absence and occupational health records | - | ✔️ | Health data, minimum necessary only |
| Grievance and disciplinary files | - | ✔️ | Named only where a live claim is priced |
| Settlement agreements | - | ✔️ | Redacted first, named if terms are unusual |
| Right-to-work register | ✔️ | ✔️ | Counts in stage 1, certificates in stage 2 |

### The clean team

A clean team is a small, named, closed group permitted to see material the wider deal team is not, on terms recorded in writing before anyone opens a file. It exists in HR diligence for data-protection reasons and in commercial diligence for competition reasons, with the same mechanics in both.

Three things define it. Membership is explicit and short: typically the buyer's employment counsel, a pensions specialist, and one or two named people from the buyer's HR function, with the deal principals excluded. The output is constrained, because the team reads named files and reports conclusions rather than documents, so the wider team receives an assessment of severance exposure across twelve senior contracts rather than the contracts. And the arrangement is documented in a protocol setting out membership, scope, reporting limits, retention, and what happens if the deal fails. Where the target has EU or UK employees, that protocol should also record the lawful basis and the minimisation rationale.

Technical enforcement matters as much as the paper. A clean team defined in an agreement but implemented as a shared folder everyone can open is not a clean team. The named-file material needs its own access boundary, its own reviewer list, and a record of who opened it.

![Dynamic watermark showing viewer email, IP address and timestamp on a named employment file](https://assets.papermark.io/upload/file_Ks2dtpU7UXaoreiAAtXr54-watermarked-document.png)

_Named employee files carry a per-viewer watermark, so any copy leaving the room is traceable to one reviewer._

## 7. Worked scenario: acquiring Halvorsen Logistik

A mid-market private equity fund agrees to acquire Halvorsen Logistik, a €84M revenue contract logistics group headquartered in Hamburg with sites in Germany, the Netherlands and the UK. The workforce is the asset and the liability at once, so HR diligence sets the price rather than confirming it. The anonymised schedule delivered in week one shows 620 workers: 431 permanent employees, 128 fixed-term or agency workers in the two German warehouses, and 61 independent contractors, mostly drivers and yard supervisors.

The clean team reads the 61 contractor agreements against actual working practice and concludes that 24 are employees in substance: fixed shifts, company vehicles, a named supervisor, no right of substitution, an average engagement over three years. Employment counsel prices the back exposure for income tax and social-security contributions at roughly €1.1M, and because an authority could take a different view of the period, it becomes a specific indemnity rather than a price reduction.

The pension work produces the larger number. A legacy defined-benefit scheme closed to new members in 2008 still covers 84 deferred and pensioner members, and the actuary's estimate at the deal date puts the shortfall at €4.2M against the triennial valuation the seller disclosed. The fund takes that off the equity value.

Two findings shape the timetable. The German works council has consultation rights that have not been engaged, so signing is conditioned on that process running its course. And three of the four site managers hold single-trigger acceleration, so the fund strips that payment out of consideration and puts a retention pool in its place, sized at 1.5 percent of equity value and paid at twelve and twenty-four months. All of it runs through a room of 240 HR documents, with anonymised schedules open to the deal team and the lender, and the named files behind a clean-team link.

## 8. From findings to price: retention, indemnities and the day-one plan

An HR finding is worth nothing until someone decides which instrument carries it, and there are four. A quantified, one-off shortfall becomes a price adjustment, which is why the pension deficit came off the equity value above. An exposure that is real but unquantified becomes a specific indemnity, capped separately from the general warranty limits, which is where classification findings and multi-employer withdrawal risk belong. A liability that is quantified but contingent becomes escrow. An obligation that must be discharged before the deal proceeds becomes a condition precedent, the home for outstanding works council consultation.

Retention runs on different logic, because it is forward-looking spend rather than backward-looking liability. Key-person identification should be narrow: not the top two layers of the org chart by default, but the people whose departure would damage what the buyer is paying for. Stay bonuses only work when the terms bind. A single instalment at twelve months buys twelve months, while two or three instalments over eighteen to thirty-six months, forfeited on resignation but preserved on redundancy, give the buyer time to transfer knowledge.

The day-one people plan turns this into something an integration team can execute: the employment position confirmed for every population, the communications sequence agreed with the seller, the payroll cutover dated, benefits continuity arranged so nobody finds on the first Monday that their cover lapsed, and notice obligations calendared. Our guide to [acquisition integration](/blog/acquisition-integration.md) covers how the people workstream sequences against the first hundred days, and the [M&A due diligence checklist](/blog/m-and-a-due-diligence-checklist.md) shows where HR sits against the financial and commercial reviews.

## 9. Common mistakes, and what the review costs

The most common mistake is running HR diligence last. The pension and classification findings are the ones most likely to move the price, and they take longest to produce, because one needs an actuary and the other needs someone to read contracts against how people actually work. A finding that lands after the price is agreed is one the buyer will struggle to reflect anywhere except goodwill.

The second is accepting the seller's headcount number. Schedules routinely disagree with payroll registers, and the gap is where the interesting populations live: people on long-term absence, people who have resigned but not left, contractors paid through accounts payable, and staff employed by a group entity but working in the target. The third is reading equity plans as arithmetic, when only the plan rules tell you what happens on closing.

The fourth is disclosing named employee data because a reviewer asked for it. The seller carries the data-protection consequence whether or not the deal completes, and a request for the full payroll file is almost always one an anonymised schedule would have satisfied. Our [data room checklist](/blog/data-room-checklist-2026.md) covers how to structure disclosure so the answer is easy to give.

On cost, HR diligence is usually scoped inside legal and operational diligence rather than bought standalone, and operational reviews run $15,000 to $30,000 for a small company, $30,000 to $75,000 mid-market, and $75,000 to $200,000 for a large enterprise. Two things push HR beyond that envelope: a defined-benefit scheme needs an actuary priced separately by scope, and multi-jurisdiction targets need local counsel wherever headcount is meaningful. Expect roughly 3 to 6 weeks once the room is populated.

## 10. Data room for your HR due diligence

A **data room for HR due diligence** is a different artifact from the one finance uses, and the difference is not sensitivity in the general sense. Financial documents are commercially confidential, and disclosing them badly is embarrassing. Employment files are other people's personal data, and disclosing them badly is a compliance failure the seller owns whether or not the deal closes.

So the room has two jobs a generic one does not. It has to enforce a boundary between anonymised and named material, and prove afterwards who crossed it. When a former employee exercises a subject access right two years after a failed deal, the seller needs a per-visitor record of what was opened, by whom, and when.

[Papermark](/data-room.md) is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available).

![Papermark data room for HR due diligence with anonymised schedules separated from named employee files](https://img.papermarkassets.com/upload/file_35DtVER7SdS1G6unRE8unv-papermark-data-room.png)

_An HR due diligence room with one folder per domain and the clean-team folders held separately._

### Why you need a data room for HR due diligence

Most HR diligence still runs over email and shared drives, and it is the workstream where that habit carries legal consequence rather than just risk. There are four reasons a dedicated data room for HR due diligence earns its place. If you are choosing a platform, our comparison of the [best virtual data rooms](/blog/best-virtual-data-rooms.md) covers pricing, bidder management and compliance across the main providers.

**The documents are personal data, and the seller stays responsible for them.** A payroll register emailed to four advisers now sits in four inboxes, four laptops and four backup regimes, and the seller can neither locate those copies nor delete them, while remaining the controller of every one. A room where files are viewed rather than distributed keeps the copy count at one.

**Staged disclosure needs a technical boundary, not a convention.** On a shared drive the line between anonymised and named material is a folder name and an agreement that people will respect it. A data room for HR due diligence makes it a permission: the clean-team folder is attached to a link with four named reviewers, and nobody outside that list can open it, URL or no URL.

**Five reviewer types need five different views.** The HR lead needs cost schedules and org structure. Employment counsel needs contracts and the claim log. The actuary needs the pension file and nothing else. The lender needs the aggregate cost base. The clean team needs the named files none of the others should see.

**The disclosure record has a long tail.** Employment claims surface years after a deal, limitation periods for tax exposure run backwards, and subject access requests arrive unannounced. A per-visitor audit log and an immutable archive of the room as it stood at closing answer questions an inbox cannot.

### Step 1: separate anonymised from named before anything is uploaded

Build the folder tree around the nine domains, then split every domain that will hold named files into two: the schedule folder and the file folder. Headcount schedules, salary bands and equity plan rules go in the first. Senior contracts, settlements, occupational health records and visa certificates go in the second. Do the anonymisation before upload, because replacing names inside a live room is rework.

**Automatic file indexing** on the Data Rooms Plus plan keeps the index current as the second wave of requests arrives, which in HR diligence it always does.

### Step 2: set permissions per reviewer group

This is where an HR room differs most from a financial one, because five parties need five different views of the same documents, and one of them is deliberately invisible to the others.

| Reviewer | Folders granted | Rights |
| --- | --- | --- |
| Buyer HR lead | Anonymised schedules, org structure, retention | View and download |
| Employment counsel | Contracts, collective agreements, claims, clean team | View and download |
| Benefits actuary | Pensions and benefits only | View and download |
| Clean team | Named employee files, senior contracts, settlements | View only, watermarked |
| Lender | Aggregate cost schedules only | View only |

**Granular file-level permissions** are set per link rather than per user, so each party gets its own link with its own folder scope, **email allowlist or domain restriction**, and download rule. Access is link-based, so no reviewer creates an account, which matters when the actuary opens the room four times and never again.

![Granular folder-level permissions applied per reviewer link in a Papermark data room](https://assets.papermark.io/upload/file_LkU4BNY6MKUKMgDucSzzFg-papermark-granular-permissions.png)

_Permissions are set per link, so the lender sees aggregate cost schedules while the clean team sees named files._

### Step 3: run the clean team as its own link

Create the clean-team link with the named reviewers on an email allowlist, turn **email verification** on so access requires a code sent to that address, and set the folder to view-only. Turn on **dynamic watermarking**, which renders the viewer's email, IP address and timestamp onto every page, and add **screenshot protection** on the folders holding health and disciplinary material.

Set **link expiration** to the date the protocol says the review ends. A downloaded file is legally treated as read and no platform can recall it, which is why download is disabled here, not merely discouraged.

### Step 4: keep the second wave of requests out of email

HR requests arrive in waves by design, because stage two only becomes specific after stage one has been read. The reviewer reads the anonymised schedule, spots eleven people on notice periods longer than three months, and asks for those eleven contracts. Over email, that thread splits across the CFO, the HR director and two advisers.

The **Q&A module** attaches each question to the document that prompted it, with permissions controlling which group sees which threads, so the lender never sees the clean team's questions. Where a request needs a new document, **request files from visitors** brings it into the room.

### Step 5: read the analytics, then close the room properly

**Page-level analytics** show which reviewer opened which document, when, and for how long. In HR diligence that is an early-warning signal: an actuary who has spent an hour in the scheme rules has found something, and you will hear about it before the report lands.

![Per-visitor analytics across HR due diligence documents in a Papermark data room](https://assets.papermark.io/upload/file_YVZLbYwELYa8SxfjBg3mGe-virtual-data-room-analytics-.png)

_Per-visitor analytics show which employee files each clean-team reviewer opened, which is the record a subject access request needs._

After closing, **data room freeze** makes the room immutable and exports it as an archived ZIP with a certificate. With the **audit log**, that archive records what personal data was disclosed, to whom, and when.

### What it costs

The [Data Rooms plan](https://www.papermark.com/pricing.md?view=datarooms) is **€99/month** with a 7-day free trial and includes 3 team members, unlimited data rooms, unlimited documents, custom domain, dynamic watermarking, NDA agreements, and granular file-level permissions. **Data Rooms Plus at €249/month** adds 5 team members, the Q&A module, the audit log, automatic file indexing, and SOC 2 Type II. **Premium at €549/month** adds 10 team members, the public API, SSO, and white-labelling. In an auction, unlimited data rooms under one subscription means one room per bidder with no per-project fee.

_No credit card required._

## FAQ

### What is HR due diligence?

It is the review of a target's workforce and employment obligations before a transaction. A standard scope covers 9 domains: headcount, contracts, compensation and equity, benefits and pensions, payroll and classification, collective arrangements, litigation, immigration, and retention risk.

### What is included in an HR due diligence checklist?

A headcount schedule reconciled to payroll, contract templates plus every deviation, salary bands and bonus plans, equity plan rules, pension documents and the latest actuarial valuation, contractor and works council agreements, the claim log, and the visa register. Expect 200 to 400 documents on a mid-market deal.

### How long does HR due diligence take?

Typically 3 to 6 weeks for a mid-market target once the data room is populated, in parallel with financial and legal diligence. It runs longer where a defined-benefit scheme needs an actuarial valuation updated to the deal date, or where works council consultation sits on the path.

### Who performs HR due diligence?

The buyer's HR function leads it, supported by employment counsel for contracts and claims and by an actuary where a defined-benefit scheme is involved. Multi-jurisdiction deals add local counsel wherever headcount is meaningful, so expect 4 or 5 reviewer types.

### How much does HR due diligence cost?

It is usually scoped inside legal and operational diligence rather than bought standalone, and operational reviews run $15,000 to $30,000 for a small company, $30,000 to $75,000 mid-market, and $75,000 to $200,000 for a large enterprise. An actuarial review is priced separately.

### What are the biggest red flags in HR due diligence?

An underfunded defined-benefit scheme, contractors who are employees in substance, single-trigger acceleration, headcount that does not reconcile to payroll, and phantom equity that appears nowhere on the cap table. Each of the 9 domains has its own red flag, listed above.

### Do employees transfer automatically when a business is sold?

On a business or asset transfer in the UK, TUPE transfers employees assigned to the undertaking automatically on their existing terms, with continuity of service preserved, and the EU Acquired Rights Directive sets the same baseline across member states. A share sale usually does not trigger a transfer, but the contracts and disputes still come with the entity.

### Can you share employee files in a data room under GDPR?

Yes, but disclosure has to be minimised and staged. Run stage one on anonymised schedules carrying grade, location, contract type and cost without names, then release named files only to a clean team of 3 to 5 people with a documented lawful basis. Pseudonymised data is still personal data under the GDPR.

### What is a clean team in HR due diligence?

A small closed group, usually 3 to 5 named people such as employment counsel, a pensions specialist and one or two buyer HR staff, permitted to read named employee files the wider deal team cannot see. They report conclusions rather than documents, under a written protocol.

### How much notice is required for layoffs after an acquisition in the US?

The federal WARN Act requires 60 days advance written notice for qualifying plant closings and mass layoffs, and several states have stricter mini-WARN statutes. Any day-one headcount reduction therefore has to be planned two months ahead, and separated employees need a COBRA offer of continued health coverage.

### Do I need a data room for HR due diligence, or is a shared drive enough?

A shared drive gives you one permission set, and HR diligence needs five: the HR lead sees schedules, counsel sees contracts and claims, the actuary sees pensions only, the lender sees aggregate cost, and the clean team alone sees named files. A data room for HR due diligence enforces that per link and produces the per-visitor record a subject access request needs. Papermark starts at €99/month with 3 team members.

## Related resources

- [Best virtual data rooms in 2026](/blog/best-virtual-data-rooms.md)
- [Legal due diligence checklist](/blog/legal-due-diligence-checklist.md)
- [M&A due diligence checklist](/blog/m-and-a-due-diligence-checklist.md)
- [Operational due diligence](/blog/operational-due-diligence.md)
- [Acquisition integration](/blog/acquisition-integration.md)
- [Financial due diligence](/blog/financial-due-diligence.md)

---

_Markdown version of [this article](https://www.papermark.com/blog/hr-due-diligence) for AI agents and LLMs._
_More Papermark content: [llms.txt](https://www.papermark.com/llms.txt) · [full index](https://www.papermark.com/llms-full.txt)._