The Spreadsheet That's Running Your HR (And the Risk You're Probably Not Seeing)

Spreadsheets have served UK and Irish businesses well for decades — but for growing SMEs HR teams, the question worth asking is whether they're still pulling their weight.

In 2024, reports of employee data breaches to the UK's Information Commissioner's Office hit a six-year high — 3,679 incidents, up 14% on the year before. A significant chunk of those came down to human error: a file sent to the wrong person, a hidden tab left exposed, a salary record that somehow landed in a reply-all. The kind of thing that happens when your people data is held together with spreadsheets, shared drives, and optimism.

You know the setup. The master employee file that lives on someone's desktop. The holiday tracker with the colour-coded tabs that only Sarah in HR fully understands. The onboarding checklist saved as a Word doc and emailed around each time someone new starts. The common denominator is that they're all held together by institutional memory and habit — and they're all quietly creating risks that most SME leaders haven't fully reckoned with.

Your HR team is spending half their week on admin. Literally.

New joiner? Someone manually keys their details into multiple files. Salary change? Three tabs need updating. Manager wants a headcount report? An HR person has to drop everything, stitch together data from four different places, and format it into something that doesn't look like a cry for help.

Research by Deloitte found that HR teams spend 57% of their time on administrative tasks — payroll, leave management, compliance reporting. That's more than half the working week, before anyone's had a chance to actually do HR. The strategic stuff — hiring well, building culture, retaining people.

A senior HR professional spending a day a week on avoidable admin is a day a week of strategic thinking that never happens. And that adds up fast.

One misfired email away from a bad day

Here's the thing about spreadsheets: they're a remarkably good human error machine. A salary file goes to the wrong person. A tab gets left unhidden before a doc is shared. A VLOOKUP pulls the wrong row. None of this is malicious — it's just what happens when sensitive data lives in files that anyone can edit, copy, or forward.

The ICO's own research found that human error was a factor in 70% of personal data breach reports it reviewed. Under GDPR enforced by the Data Protection Commission — a reportable breach has to reach the regulator within 72 hours of discovery. Fines for serious infringements can reach £17.5 million or 4% of global turnover, whichever is higher.

No audit trail. No access controls worth speaking of. No breach detection. Most businesses running HR on spreadsheets are one misfired email away from a regulatory conversation they are not prepared for.

The Employment Rights Act 2025 just made things more complicated

April 2026 brought the biggest shake-up to UK employment law in a generation. Major provisions of the Employment Rights Act 2025 came into force: expanded family rights, changes to statutory sick pay, and new record-keeping obligations — including a requirement to retain holiday pay records for six years. (That's six years of records, in a spreadsheet, maintained accurately...) 

There's more on the way. The unfair dismissal qualifying period drops to six months from January 2027, backdated for anyone employed after July 2026. The CIPD has warned that smaller businesses could unintentionally fall foul of the law given the sheer breadth of reforms — and the government's new employment guidance requires auditable records across a growing list of obligations.

(Again, auditable records - in a spreadsheet that seventeen people have edited since 2021….)

The spreadsheet isn't free. It just doesn't send an invoice.

There's no line item for "HR manager spent Tuesday rebuilding a report that should already exist." No charge for "sensitive employee data with no access controls." The cost is real; it's just invisible until it isn't.

Time cost: HR doing admin instead of HR. Compliance cost: no audit trail, no breach detection, one misfired email from a fine. Opportunity cost: decisions made on stale data, because getting accurate headcount figures out of a spreadsheet takes longer than anyone has time for.

Most growing businesses hit a point where the spreadsheet stops being a workaround and starts being the problem. They usually hit it earlier than they expected.

The best time to ditch the spreadsheet was a year ago. The second best time is now.

Every hour your HR team spends on admin is an hour not spent on the things that actually determine whether your business thrives: hiring the right people, keeping them, and building a culture worth staying for. That's hard to do when you're buried in tabs.

Consolidating your people data into one system doesn't just save time — it changes what your HR team can focus on. Faster onboarding means new starters feel the benefit from day one. Better visibility means managers can spot problems before they become resignations. And when HR has headspace to think strategically, the whole business moves differently.

The SMEs that will look back and wonder why they waited aren't the ones who couldn't afford to move. They're the ones who assumed the move would be harder than it was.

Rippling is built to get you up and running quickly, with your existing data, without the six-month implementation project. (The spreadsheet had a good run). See how easy it is to move on.