HR policies required by law in the UK: what a small business must have
Most lists of "essential HR policies" run to thirty and do not say which are law and which are habit. The legal list is short. This handbook separates the documents statute requires from the ones that merely protect you, and links a free template for each.
UK law requires an employer to have very few written policies: a health and safety policy (written down at five or more employees), and disciplinary rules and a disciplinary and grievance procedure that staff are told about in writing. Alongside those sit documents that are not policies but are compulsory: the written statement of particulars, privacy information for workers, a recorded risk assessment at five or more employees, a recorded fire risk assessment, pension enrolment letters and an employers' liability insurance certificate. No law requires an employee handbook, an equal opportunities policy or a whistleblowing policy.
Download the handbook PDF · 4 pages · no sign-up
Which policies does the law actually require?
| Policy | The duty | Free template |
|---|---|---|
| Health and safety policy | Every employer must have one. It must be written down, and shared with employees, where there are five or more employees (Health and Safety at Work etc. Act 1974, s.2(3)). | Health and safety policy |
| Disciplinary rules and procedure | A written note of the disciplinary rules and the procedure for disciplinary and dismissal decisions, or a pointer to a document containing them, within two months of starting (Employment Rights Act 1996, s.3). | Disciplinary policy |
| Grievance procedure | The same note must name who a grievance is raised with and how, and who a disciplinary decision is appealed to. | Grievance procedure |
That is the whole list of general policies. The disciplinary and grievance requirement applies to every employer from the first hire; there is no small-employer exemption. Both procedures should follow the Acas Code of Practice, because a tribunal can increase an award by up to 25% where an employer unreasonably failed to follow it.
One further document is a policy in all but name. If you process special category data about your staff, such as health information, relying on the employment condition in the Data Protection Act 2018, the Information Commission (the ICO) says that condition requires you to have an appropriate policy document in place. In practice every employer that records sickness absence is in that position.
Which documents must you give or keep, even though they are not policies?
| Document | Who and when | Source |
|---|---|---|
| Written statement of particulars | Every employee and worker, when they start work. It must state sick pay terms, notice, hours and pay, among others. | Employment Rights Act 1996, s.1. Template |
| Privacy information for workers | Every worker, at the time you collect their personal information. | UK GDPR, Articles 13 and 14; ICO employment guidance |
| Risk assessment | Every employer must assess risks. The significant findings must be recorded at five or more employees. | Management of Health and Safety at Work Regulations 1999, reg 3 |
| Fire risk assessment | The responsible person for the premises, recorded in full whatever the number of employees (England and Wales, since 1 October 2023). | Regulatory Reform (Fire Safety) Order 2005, art 9 |
| Health and safety law poster or leaflet | Display the approved poster or give each worker the leaflet. | Health and Safety Information for Employees Regulations 1989 |
| Employers' liability insurance certificate | Cover of at least £5 million, with the certificate displayed where employees can access it, which may be electronically. | gov.uk: employers' liability insurance |
| Automatic enrolment letters | Write to each member of staff individually within six weeks of your duties start date. | The Pensions Regulator. Guide |
| Right to work check record | A copy of the check for each employee, kept for the length of employment and two years after. | Checklist |
| Working-time records | Records adequate to show the 48-hour and night work limits are met, kept for two years. | Working Time Regulations 1998, reg 9 |
| Accident record | Where 10 or more people are normally employed on the same premises, a record of accidents kept for at least three years. It can be a book or electronic. | Social Security (Claims and Payments) Regulations 1979, reg 25 |
You can be fined £2,500 for every day you are not properly insured and £1,000 for not displaying the certificate or refusing to make it available to inspectors.
What changes when you reach five employees?
Three recording duties begin at five employees. Below that number the underlying duty still exists; only the requirement to write it down is lifted.
- The health and safety policy must be in writing.
- The significant findings of your risk assessment must be recorded, together with any group of employees identified as especially at risk.
- Your health and safety arrangements - how you plan, organise, control, monitor and review - must be recorded.
The fire risk assessment used to share this threshold in England and Wales. It no longer does: since 1 October 2023 it must be recorded in full by every responsible person, including a sole trader with one member of staff.
Which policies are optional but worth having?
None of these is required by statute. Each exists because, without it, you are either leaving a legal question unanswered or giving up a defence.
| Policy | Why have it | Free template |
|---|---|---|
| Anti-harassment | Employers must take reasonable steps to prevent sexual harassment of employees. A policy is not the duty, but it is hard to show steps without one. | Anti-harassment policy |
| Sickness absence | Sick pay terms must be in the written statement; the policy explains reporting, certification and reviews. | Sickness absence policy |
| Code of conduct | States the disciplinary rules the s.3 note must point to, and supports the Bribery Act adequate procedures defence. | Code of conduct |
| Whistleblowing | gov.uk states that you are not legally required to have one. Workers are protected when they make a disclosure whether you have a policy or not, so a clear route protects you as well. | - |
| Flexible and hybrid working | Requests are a day-one statutory right with a two-month deadline. A policy sets your default. | Hybrid working policy |
| Family leave | The rights are statutory; the policy tells people how to use them. | Carer's leave, neonatal care, parental bereavement |
| TOIL and overtime | No statute governs TOIL at all, so your policy is the only rule there is. | TOIL policy |
| Expenses | Sets what is reimbursed and what evidence is needed. | Expenses policy |
| Data retention | Data protection law sets no fixed periods, so you must decide and record your own. | Retention schedule |
| DBS checks | Only for roles that are eligible; sets levels and re-check cycle. | DBS check policy |
An equal opportunities policy belongs on this list too. The Equality Act 2010 makes discrimination unlawful and makes employers liable for discrimination by their staff unless they took all reasonable steps to prevent it; a policy with training behind it is the usual evidence of those steps. No provision requires the policy itself.
What is changing in 2026 and 2027?
- 30 October 2026. The government's timeline lists two harassment changes for this date: the duty to take reasonable steps to prevent sexual harassment becomes a duty to take all reasonable steps, and employers become obliged not to permit harassment of their employees by third parties. Review the anti-harassment policy and the training behind it now. See the duty to prevent sexual harassment.
- 1 January 2027. The qualifying period for unfair dismissal falls from two years to six months, and the cap on the compensatory award is removed. A disciplinary procedure that was only ever followed for long-serving staff has to work for someone seven months in. See the six-month rule and probation periods in 2027.
- During 2027, dates not yet set. Changes to flexible working refusals, and new rights to guaranteed hours and reasonable notice of shifts for zero-hours and low-hours workers. See guaranteed hours in 2027.
What order should a small business write them in?
- Written statement of particulars for every person. It is due when they start work.
- Disciplinary and grievance procedures. Due within two months and needed the first time something goes wrong.
- Privacy notice for staff. You are collecting their data from the application form onwards.
- Health and safety policy and risk assessment, in writing by your fifth employee, plus the fire risk assessment from the start.
- Sickness absence and anti-harassment policies. The two optional policies most often needed in a hurry.
- The rest, as the question first comes up, gathered into an employee handbook.
Writing a policy is half of it. The other half is being able to show that each person received it. Keep a dated acknowledgement for every policy and every new version.
Frequently asked questions
What HR policies are legally required in the UK?
A health and safety policy, which must be in writing where there are five or more employees, and disciplinary rules with a disciplinary and grievance procedure that staff are told about in writing within two months of starting. Other policies are optional.
Is an employee handbook a legal requirement?
No. No UK law requires an employee handbook. The law requires particular documents, such as the written statement of particulars and a note of disciplinary and grievance procedures, and a handbook is a convenient place to keep the procedures.
Is an equal opportunities policy required by law?
No statute requires one. The Equality Act 2010 makes discrimination unlawful and gives employers a defence where they took all reasonable steps to prevent it, and a policy backed by training is commonly used as evidence of those steps.
Does a small business need a whistleblowing policy?
It is not a legal requirement. Government guidance for employers says you are not legally required to have a whistleblowing policy. Workers who make a protected disclosure are protected whether or not a policy exists.
How many employees before you need written policies?
The disciplinary and grievance note applies from the first employee. The health and safety policy, the significant findings of the risk assessment and the health and safety arrangements must be written down once you have five or more employees.
Sources
Checked against the primary source on 4 October 2026.
- Health and Safety at Work etc. Act 1974, s.2 - the written health and safety policy
- HSE: prepare a health and safety policy - five or more employees must write it down
- Employment Rights Act 1996, s.3 - the note about disciplinary rules, procedures and grievances
- gov.uk: written statement of employment particulars - what must be given when someone starts
- Management of Health and Safety at Work Regulations 1999, reg 3 - recording risk assessment findings at five or more
- Home Office: fire safety responsibilities under section 156 - fire risk assessments recorded in full in all circumstances
- gov.uk: employers' liability insurance - the £5 million minimum, display and fines
- The Pensions Regulator: write to your staff - the six-week deadline
- ICO: conditions for processing special category data - the appropriate policy document
- gov.uk: whistleblowing guidance for employers - no legal requirement for a policy
- Social Security (Claims and Payments) Regulations 1979, reg 25 - the accident record at 10 or more on the same premises
- gov.uk: Employment Rights Act timeline update - the 2026 and 2027 changes
This is general guidance for UK employers and is not legal advice. Take advice on anything contested, unusual or expensive.
Keep reading: All 3 handbooks · Everything for employers · 44 free templates
Every policy, and proof each person has read it
CoDash holds your policies in one library, sends each one to the people it applies to, records the acknowledgement against the version they saw and shows you who is outstanding.
Explore a live, safe sandbox