Remote Working and Occupational Risk Prevention: New Employer Obligations

The consolidation of remote working requires companies to adapt their prevention systems to a different working environment

Remote working has evolved from a temporary solution into a structural component of the organisational model of many companies. This transformation has changed team management, working time organisation and the way professional services are delivered, but it has also required companies to reconsider how they ensure the health and safety of employees working outside their premises.

Occupational risk prevention does not disappear or become less relevant when work is performed from home or another remote location. Physical distance does not alter the employer’s duty of protection. On the contrary, it introduces specific considerations —particularly ergonomic, psychosocial and working-time factors— that must be incorporated into the company’s prevention system.

The Law 10/2021 of 9 July on Remote Working expressly establishes that employees working remotely have the right to appropriate protection in terms of occupational health and safety, in accordance with the general occupational risk prevention framework.

For companies, therefore, the challenge is not simply to allow remote working. It is to build a model that combines flexibility and business organisation with appropriate prevention measures, while also respecting privacy, the right to digital disconnection and the limits of employer monitoring.

The legal framework for remote working and occupational risk prevention

Remote working in Spain is primarily regulated by the Law 10/2021 of 9 July on Remote Working and the Law 31/1995 of 8 November on Occupational Risk Prevention.

The former adapts certain employment rights and obligations to this form of work. The latter remains the general framework governing employee health and safety protection.

Article 15 of Law 10/2021 establishes that remote workers are entitled to appropriate protection in terms of occupational health and safety. Article 16, in turn, requires risk assessments and preventive planning to take into account the specific risks associated with remote working, with particular attention to psychosocial, ergonomic and organisational factors.

Occupational risk prevention in remote working must therefore form part of the company’s general prevention system and be adapted to the actual conditions in which the work is performed.

Risk assessment at home and protection of privacy

Risk assessment is one of the main challenges when remote working takes place from an employee’s home.

The company needs sufficient information about the actual working environment to identify potential risks. However, this obligation must be balanced against the employee’s right to privacy and, where the workplace is the employee’s home, the inviolability of the home.

Article 16 of Law 10/2021 establishes that the assessment must be limited to the area of the home or location specifically designated for work and cannot extend to the rest of the property. The company must obtain the necessary information through a methodology that provides sufficient confidence in the results.

Where a visit to the remote workplace is necessary and that workplace is the employee’s home, the law requires a written report explaining why the visit is necessary and the employee’s consent to the visit.

If consent is not granted, preventive activities may be carried out using the information provided by the employee in accordance with the instructions of the prevention service.

This framework requires companies to design assessment systems that are sufficiently effective from a preventive perspective while respecting employees’ fundamental rights.

A preventive assessment that does not intrude into private space

In practice, this makes self-assessment questionnaires, ergonomic guidance and information-gathering systems designed by occupational risk prevention services particularly relevant.

The company does not need to turn an employee’s home into an extension of its physical premises in order to comply with its preventive obligations. What it needs is sufficient information about the space and conditions in which the work is actually performed.

Psychosocial risks, working time and digital disconnection

Remote working can also change the relationship between working time and personal time.

The absence of a physical separation between the home and the workplace can facilitate hyperconnectivity, increase expectations of availability and make it more difficult to disconnect at the end of the working day.

The Law 10/2021 itself requires the risk assessment for remote working to take into account working time arrangements, availability periods and the guarantee of rest periods and digital disconnection.

Article 18 of Law 10/2021 specifically recognises the right to digital disconnection for remote workers and refers to the conditions established in Article 88 of Organic Law 3/2018.

Article 88 of Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights establishes the right to digital disconnection outside working hours and requires companies, following consultation with employee representatives, to establish an internal policy defining how this right may be exercised and the training and awareness measures necessary to prevent digital fatigue.

Digital disconnection should therefore not be treated solely as an HR issue. It is also part of the preventive management of risks associated with new working models.

Companies should consider, among other factors, expected availability, communication channels, contact times and management practices that may encourage permanent connectivity.

These factors should also be coordinated with the assessment of psychosocial risks in the workplace.

Work equipment and the means required for remote working

Remote working also raises a practical question: who must provide and maintain the equipment and resources required to perform the job?

The Law 10/2021 establishes employees’ right to the appropriate provision and maintenance of the means, equipment and tools required to carry out their remote work.

In addition, Article 17 of Law 10/2021 provides that the use of electronic means and the monitoring of work must respect privacy and data protection, and that companies cannot require employees to install programmes or applications on their personal devices or require them to use personal devices to perform their remote work.

Companies should therefore clearly establish which equipment they provide, who is responsible for its maintenance, what happens in the event of a technical failure and what procedures should be followed when technical resources do not allow the work to be performed normally.

The remote working agreement should address these matters with sufficient precision.

Employer monitoring and privacy protection

The fact that an employee works from home does not eliminate the employer’s organisational and monitoring powers.

Companies may adopt monitoring measures to verify compliance with employment obligations, but these measures must remain within the limits established by law.

Article 22 of Law 10/2021 expressly recognises employer monitoring powers, including the use of electronic means, but requires the dignity of the employee and their personal circumstances to be respected when those measures are adopted and implemented.

In addition, Article 17 establishes specific safeguards concerning privacy and data protection.

Activity monitoring tools, device-control systems, productivity systems and other forms of employee monitoring should therefore be assessed from the perspective of necessity, proportionality and respect for employees’ rights.

Suárez de Vivero advises companies on Technology and Work Organisation in Spain, including remote working, employer monitoring, corporate devices, data protection, digital policies and the right to digital disconnection.

What happens when a technical issue prevents remote working?

One of the issues most likely to generate disputes is what happens when a technical problem temporarily prevents an employee from working remotely.

Law 10/2021 requires the remote working agreement to establish a procedure for dealing with technical difficulties that may prevent the normal performance of remote work.

Companies should therefore have a sufficiently clear procedure establishing how technical incidents should be reported, who should intervene, how the incident should be recorded, what technical support will be provided and what alternatives are available when work cannot continue normally.

In certain circumstances, organisational alternatives may need to be considered, including working from the company’s premises, provided that this is consistent with the remote working agreement and the applicable legal framework.

The company’s response should avoid both an indefinite interruption of work and the automatic imposition of solutions that could disproportionately alter the agreed working arrangement.

Remote working prevention in international companies

Multinational companies often have global corporate policies concerning Smart Working, wellbeing and occupational risk prevention.

However, the application of these policies in Spain must be adapted to the specific requirements of Spanish law.

An international corporate standard does not replace the risk assessment required under Spanish legislation or the obligations relating to the remote working agreement, consultation with employee representatives, equipment, digital disconnection or data protection.

Coordination between central management, international teams and local managers is particularly important to ensure that global policies remain compatible with the Spanish legal framework.

Remote working and employment compliance

Remote working should form part of a broader employment compliance strategy.

Managing a remote working model simultaneously affects occupational risk prevention, working time, availability, equipment, data protection, employer monitoring, digital disconnection, equality and, in certain cases, employee representation rights.

It should therefore not be managed solely through a generic remote working policy.

Companies need coherent procedures that allow the model to be applied consistently and relevant decisions to be properly documented.

Suárez de Vivero advises national and international companies on internal employment policies, including remote and hybrid working policies, working time, attendance monitoring, corporate devices, data protection, occupational risk prevention and digital disconnection.

What liabilities can the company face?

Failure to comply with occupational risk prevention obligations in remote working may result in different forms of liability, as with other forms of work.

The Law 31/1995 on Occupational Risk Prevention establishes the employer’s duty to provide effective protection against occupational risks and requires prevention to be integrated into the company’s general management system.

Depending on the circumstances, a breach of preventive obligations may result in administrative liability, a Social Security benefit surcharge, civil liability or, in certain cases, criminal liability.

These consequences do not arise automatically simply because an incident related to remote working has occurred. The specific breach, the harm caused and the relevant causal relationship must be assessed.

Proper assessment and documentation of risks are therefore particularly important.

How should a company prepare to manage remote working?

Prevention in remote working should begin before the model is implemented and continue throughout its operation.

Companies should ensure that their individual remote working agreements properly regulate equipment, expenses, working time, availability, monitoring, technical difficulties and the other elements required by law.

They should also verify that the risk assessment reflects the actual conditions of remote work and that procedures are in place to manage ergonomic, organisational and psychosocial risks.

The digital disconnection policy should be properly defined and communicated, while employer monitoring systems must respect privacy, data protection, necessity and proportionality.

Finally, where significant changes occur in the organisation, the tools used or the way services are delivered, companies should assess whether their policies and preventive measures need to be updated.

Remote working requires prevention adapted to the new working environment

The consolidation of remote working does not eliminate employers’ health and safety obligations. It transforms them.

Companies must be able to protect employees in an environment that they do not physically control in the same way as an office, but which nevertheless remains part of the employment relationship.

This requires the integration of occupational risk prevention, work organisation, technology and the protection of employee rights.

A properly designed remote working policy should not simply establish how many days employees can work from home. It should also address occupational risk prevention, digital disconnection, equipment, privacy, employer monitoring and procedures for dealing with technical incidents.

At Suárez de Vivero, we advise national and international companies on Occupational Risk Prevention in Spain, including prevention in remote working, risk assessment, psychosocial risks, ergonomics, preventive policies and employer liability.

We also advise companies on the legal structuring of remote and hybrid working models and on adapting their policies to Spanish employment legislation.

Frequently Asked Questions About Remote Working and Occupational Risk Prevention