Workation Policy: Rules for Combining Travel and Work Legally

11 min read | Updated September 28, 2026

A workation is a trip where an employee keeps working their normal job while staying somewhere they chose for personal reasons. The laptop comes along, the job carries on, the evenings belong to the destination. Most company policies cap these trips at two to eight weeks.

The employee keeps their normal duties and pay. What changes is the country, and that one change can pull in tax, social security, immigration and data protection rules that never applied at home. A workation is therefore not ordinary remote work, and not a holiday either.

This guide covers what a workation policy must settle before the first request lands: who qualifies, how many days, which countries, who signs off, and what paperwork has to exist first.

Key Takeaways

• A workation is temporary and employee driven: normal hours, normal pay, a location the employee picked.
• The real risks are income tax, social security, permanent establishment, immigration and data protection, and they apply to short trips too.
• Inside the EU an A1 certificate keeps home country social security running. Outside it, coverage depends on a bilateral agreement.
• Day limits, an approved country list and a documented approval trail make the benefit manageable.

What a Workation Is, and What It Is Not

A workation is temporary, employee driven and mostly self funded. Three comparisons fence it in.

A business trip serves the employer. The company sends someone to a client or a trade fair, picks the destination and pays for it. A workation flips that. The employee picks Lisbon because they want to be in Lisbon, and books the flight themselves.

Annual leave means not working. During a workation the employee is on the clock and delivering the same output as any other week. A day cannot be both a rest day and a working day for insurance and payroll purposes, so the two must never be blurred.

A digital nomad arrangement is open ended. Someone moving between countries for months creates a heavier set of obligations. If that is what your people want, a digital nomad policy is the right document, and an employee mobility policy covers permanent relocation.

One rule sits above all three: nothing starts without written approval. An employee who quietly works three weeks from another country has not taken a workation. They have created an undocumented compliance problem.

Why Employers Are Adding Workations to the Benefits List

Staff stretch a trip without burning holiday, and employers get a benefit that costs little cash and signals trust. WorkFlex, a compliance provider that handles workation requests for employers, reports that 42 percent of workation trips go to countries outside the EU. That is vendor data from a company with an interest in the topic, so treat it as an indication rather than a hard number.

The figure matters more than it looks, because a policy written only around EU rules falls silent exactly when the rules get harder. Outside the EU there is no single coordination framework to fall back on.

There is a retention argument too. A rare benefit is one people weigh before resigning, which puts workations alongside a sabbatical policy, a flexible PTO policy and other employee benefits that reward output rather than presence.

The Compliance Risks Behind a Simple Request

An email asking to work from Spain for three weeks looks harmless. Six rulebooks can apply to it.

Immigration. A tourist entry usually does not permit work, even remote work for a foreign employer. Inside the Schengen area, non EU nationals are limited to 90 days in any 180 day period, and that limit is now tracked automatically: the EU Entry/Exit System began a phased rollout on 12 October 2025 and reaches full operation on 10 April 2026. ETIAS, the travel authorisation layered on top, is expected in the last quarter of 2026.

Income tax. Salary can become taxable in the destination country, and the threshold is not simply 183 days.

Permanent establishment. This is the risk most companies underestimate. If the work abroad counts as a fixed place of business, or the employee habitually concludes contracts, the local tax authority can decide the company has a taxable presence there. The consequences are corporate: registration, corporate tax filings, sometimes VAT. A developer writing code from a rented flat is low risk. A country manager closing deals from the same flat is not.

Social security. Contributions can shift to the destination country unless the right certificate is in place.

Labour law. Some destination rules apply to anyone working on that soil, and home country rules usually continue to apply as well. German employers stay bound by the Working Time Act: eight hours a day, extendable to ten if the average balances out, with eleven hours of uninterrupted rest between shifts.

Data protection. Company data travels with the laptop. Moving personal data outside the European Economic Area triggers GDPR transfer rules, and a hotel network is not a controlled environment.

How to Build a Workation Policy That Holds Up

A good policy answers four questions in plain language, in one document rather than five informal email threads.

Who is eligible. Start with roles that genuinely do not need a fixed workplace. A support engineer who has to be on site with hardware is out. Add a performance condition, so the benefit goes to people whose output is predictable.

How many days. WorkFlex, which says it has reviewed more than 100 employer policies, reports 30 days a year as the most common allowance, with an average trip of about eight days. Thirty days therefore buys three or four trips. Longer stays start crossing tax and social security thresholds, which is why the common cap sits where it does.

Which countries. Three models dominate. EU only is simplest, because social security coordination does most of the work. Global is the most attractive and the most expensive to administer. A middle option, sometimes called EU plus, opens the EU plus each employee’s own home country, which covers the most frequent request of all: visiting family abroad.

What must be true before departure. Written approval, an A1 certificate where needed, proof of insurance, a confirmed working address that is not a beach bar, and a reachable emergency contact.

Income Tax and the 183 Day Rule

Almost every conversation about working abroad reaches the 183 day rule within a minute, and almost every version of it is wrong. Under most double taxation treaties, salary stays taxable at home only if three conditions hold at once:

• They spend no more than 183 days in the destination country in the relevant period.
• Their pay comes from an employer that is not resident in that country.
• Their pay is not borne by a permanent establishment the employer has in that country.

Fail any one of them and the destination country can tax the salary from day one, however short the stay. That is why the rule offers far less protection than people assume.

The counting is its own trap. Many treaties measure any twelve month period that starts or ends in the tax year concerned, not the calendar year. A rolling window like that can pick up days from two calendar years even when neither alone passes 183. Countries also differ on which days count, and arrival and departure days often count in full. Weekends count too, because the test is physical presence, not working time.

So record every trip, date and destination. Without that record you cannot answer a tax authority’s question, and the burden of proof sits with you.

Social Security: A1 Certificates and the EU Framework

Social security follows its own logic, separate from tax. Inside the EU, the EEA and Switzerland, Regulation 883/2004 coordinates it so nobody is insured twice or not at all.

The instrument that makes it work is the A1 certificate, which confirms that the employee stays in their home country’s system while working temporarily in another member state. In Germany it normally comes from the employee’s health insurance fund. Apply before departure, not after, and keep it reachable during the trip.

Since 1 July 2023 there is also a Framework Agreement on cross border telework. It lets employees who habitually work from a different country than their employer stay insured in the employer’s country, provided the remote share stays below 50 percent of working time. Around two dozen countries have signed, including Germany, France, Spain, the Netherlands, Austria and Switzerland, with Estonia joining on 1 February 2026. Several member states have not signed. Two limits matter: it covers employees only, not the self employed, and it deals with social security alone. It says nothing about income tax or permanent establishment.

Outside the EU the picture is patchier. Some countries have bilateral agreements allowing a certificate of coverage that works much like an A1. Where none exists, contributions may fall due in both countries at once, which argues for keeping non EU trips short or routing them through global payroll solutions that already operate locally.

Insurance: What Statutory Cover Does and Does Not Include

Insurance is where policies most often leave a gap: three covers overlap and none is complete.

Statutory accident insurance follows the work, not the person. German statutory cover, for example, generally extends to work related activity abroad during a temporary posting, but not to leisure. An injury at the desk may be covered. The same injury on a hiking trail on Saturday will not be.

The European Health Insurance Card gives access to medically necessary state healthcare in the EU, the EEA and Switzerland on the same terms as a local insured person. That is useful but limited. It does not pay for private clinics, it does not cover planned treatment, and it does not pay for a medical flight home.

Private travel health insurance fills those gaps. Repatriation is the big one, because an air ambulance is the largest single bill a small company can face from a trip gone wrong. Leisure accidents and cover outside Europe usually sit here too. Premiums vary with age, destination and duration, so ask a broker for a quote. Then write into the policy which cover the company pays for and which the employee arranges.

IT Security and Data Protection While Working Abroad

A workation moves company data onto a network you do not control, in a country whose privacy rules may differ from your own. The controls are not exotic, but they have to be written down. Require a company managed device with disk encryption and multi factor authentication, and the company VPN for anything touching internal systems. Set an explicit rule for public Wi-Fi: a hotel lobby is not the place to open a screen full of customer records. The discipline that keeps cybersecurity in remote work workable at home applies here with less margin for error, and a zero trust approach assumes exactly this kind of untrusted network.

Define acceptable working environments in the policy: a private flat, a hotel room, a coworking desk, a client office. That one sentence prevents most accidental disclosure. If the destination lies outside the European Economic Area and personal data will be accessed, GDPR transfer rules apply, and a transfer impact assessment may be needed first.

Employees also need a reporting path that works across time zones if a laptop is stolen or a login looks wrong. Trips are also when people quietly reach for unapproved tools, so pair the policy with your rules on shadow IT in remote work, your BYOA policy and your approach to data privacy at work.

The Request and Approval Workflow

Requests should arrive in one format and travel one path, or the compliance file cannot be reconstructed later. The form captures the destination country and city, the dates, the number of working days, the working address, the time zone and an emergency contact. Ask for nationality too, because immigration answers depend on the passport, not the employer.

The manager then decides the work questions: is the performance record solid, is the team covered, can the person attend the meetings that matter. HR checks the compliance questions: eligibility, the remaining day budget, whether the country is approved, whether an A1 or certificate of coverage is needed, whether insurance is in place, and whether the immigration route is legal.

Set a service level for the answer, five working days for example, and stick to it, because people book flights. Then keep the record: who requested what, who approved it, when, and which documents were attached. If an authority asks two years later, that file is the whole defence.

Working Hours, Availability and Time Zones

The compliance side can be perfect and the arrangement still fail, because nobody agreed what the working day looks like. Settle availability before departure.

A Dutch employee in Provence has no meaningful time difference. The same employee in Bali is several hours ahead, which means either early meetings for them or late ones for everyone else. Write down the overlap hours, the expected response time on messages, and which recurring meetings are non negotiable. Teams that already work well asynchronously handle this almost automatically, and follow the sun scheduling shows the deliberate version.

Manage output rather than hours. Agree the deliverables, then judge the trip on whether they arrived, the discipline that makes any cross border team work.

Protect recovery. Working days and holiday days must be labelled separately in the calendar and in payroll. A month that quietly becomes half work and half holiday leaves nobody rested and raises the risk of burnout instead of lowering it. Weeks of laptop use at a kitchen table is a health issue in Berlin and in Bali alike, so a desk in one of the local coworking spaces is often the better answer.

The Country Matrix: Where You Say Yes, and Where You Say No

The most useful artefact you can build is a table of countries. It turns each new request into a lookup rather than a research project. For each country, record whether it is approved, conditional or blocked, the immigration route that makes remote work lawful, the day threshold at which tax duties start, the social security treatment, and any local labour rules that bite. Give blocked entries a reason, so nobody reopens them every quarter.

Keep the list short at first. Ten countries covering most requests, reviewed once a year, beat a global matrix nobody maintains.

Anyone with signing authority or in a revenue facing role should still get a case by case review, whatever the destination. Where employees keep asking for months rather than weeks, the honest answer may be a different arrangement, whether that is a digital nomad visa or a local employment contract.

Conclusion

A workation policy is not really about beaches. It is about deciding once, in writing, how far your company will let work travel, and making that decision easy to apply.

The parts that matter are unglamorous: eligible roles, a day budget, a list of approved countries, a request form, a named approver, and a file that proves what was decided. Get those right and most trips become routine.

Keep two cautions in view. The 183 day rule protects far less than its reputation suggests. And insurance rarely covers what people assume, particularly leisure accidents and the flight home. Both are cheap to check before departure and expensive to discover afterwards. Done well, this benefit costs almost nothing and is genuinely valued, and it forces a useful conversation about whether your company measures work by output or by attendance, the question underneath the work from anywhere economy in the first place.