Beyond Companies House filings and bank accounts, one of the most overlooked legal responsibilities is drafting and implementing mandatory workplace policies. These aren’t just corporate formalities. In the UK, these are company policies required by law. Failing to have them can expose your business to serious compliance risks, tribunal claims, or financial penalties.
Many first-time employers in the UK assume policies like grievance procedures or health and safety rules are optional. They are not. In fact, even if you hire just one employee, certain policies must be written, shared, and kept up to date under UK employment law.
To make things more complex, the requirements vary depending on your company’s size, sector, and hiring plans.
Before you make your first hire or sign your first contract, make sure you are covered. Here are 10 company policies required by law to have in place to operate in the UK, what each one means, and how to stay compliant.
What are the Company Policies Required by Law for UK Businesses?
Setting up in the UK means more than just a registered office and a company number. Once you plan to hire employees, these are the policies you need in place to comply with UK employment law. At the start of 2024, there were nearly 5.5 million private sector businesses operating in the UK, and every employer must have certain written policies in place from day one.
1. Health and Safety Policy
Legal basis: Health and Safety at Work etc. Act 1974
If your business employs five or more people, UK law requires you to have a written health and safety policy. This document isn’t just about fire drills or first-aid kits. It needs to clearly outline how your company identifies, manages, and reduces risks in the workplace.
The policy should be broken down into three parts:
- Statement of intent – your overall commitment to health and safety.
- Responsibilities – who is in charge of what.
- Arrangements – how safety is managed on a day-to-day basis.
Even if you have fewer than five employees, you’re still legally responsible for creating a safe working environment. The written policy just becomes optional in that case, but the duty of care doesn’t.
For remote teams, don’t skip this. You’re still expected to assess risks associated with home working, especially if staff use specialist equipment, handle confidential data, or work long hours.
2. Disciplinary and Grievance Policy
Legal basis: Employment Rights Act 1996 and ACAS Code of Practice on Disciplinary and Grievance Procedures
Every UK employer is legally required to provide employees with written details of the company’s disciplinary and grievance procedures. The disciplinary procedure sets out how you will handle misconduct or poor performance.
It should explain:
- What counts as unacceptable behaviour.
- The steps in the disciplinary process (verbal warning, written warning, final warning, dismissal).
- The employee’s right to be accompanied at hearings.
On the other hand, the grievance procedure covers how employees can raise concerns about unfair treatment, harassment, bullying, or other workplace issues. It must:
- Outline how grievances should be raised.
- Detail the process for investigation and resolution.
- Clarify timelines and escalation options.
Following the ACAS Code of Practice is critical. While it isn’t law in itself, employment tribunals will expect you to comply with it and failing to do so can lead to increased compensation awards if a claim is upheld.
Even if you plan to foster an open culture where issues are addressed informally, a formal, written policy is legally required. And it protects both parties by setting clear expectations from day one.
3. Equal Opportunities Policy
Legal basis: Equality Act 2010
An Equal Opportunities Policy is essential for complying with the Equality Act 2010, which protects individuals from discrimination in the workplace and wider society. While not explicitly required to be written, in practice, having a documented policy is critical, especially if you want to demonstrate compliance during audits, grievances, or tribunal proceedings.
This policy should make clear that your organisation:
- Does not tolerate discrimination based on protected characteristics such as age, race, gender, disability, religion, sexual orientation, or pregnancy
- Provides equal access to opportunities in recruitment, promotion, training, and pay.
- Takes proactive steps to build an inclusive, respectful working environment.
It should also outline what employees should do if they witness or experience discrimination, and how the company will respond to such complaints.
For businesses entering the UK market, this policy isn’t just a compliance document; it’s a clear signal to your workforce and stakeholders that you take equality and fairness seriously. It also helps protect your business from claims of bias or unfair treatment, which can be damaging not just legally, but reputationally.
4. Anti-Harassment and Bullying Policy
Legal basis: Equality Act 2010 and supported by ACAS guidance
While harassment and bullying are covered under broader equality legislation, UK employers are expected to have a clear, written Anti-Harassment and Bullying Policy. This is especially important in protecting employees from unlawful behaviour and shielding your organisation from potential legal claims.
This policy should:
- Define harassment and bullying clearly, including examples of what is and isn’t acceptable behaviour.
- Explain that harassment related to any protected characteristic (such as race, gender, disability, religion, or sexual orientation) is unlawful.
- Outline procedures for reporting incidents confidentially.
- Set out how complaints will be investigated and resolved.
- Emphasise the consequences of breaching the policy.
Although not always enforced by regulators, employment tribunals will assess whether an employer had a clear anti-harassment policy and followed it appropriately. Without one, your legal defence in the case of a complaint will be significantly weaker.
Importantly, this policy also serves as a cultural guide. It helps reinforce your organisation’s values, sets behavioural standards, and shows employees that issues like intimidation, microaggressions, and inappropriate conduct will be taken seriously and addressed promptly.
5. Data Protection and Privacy Policy
Legal basis: UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018
If your business collects, processes or stores any personal data, whether it is employee records, customer details or marketing lists, you are legally required to comply with UK data protection laws. That starts with having a clearly written Data Protection and Privacy Policy.
This policy should:
- Explain what personal data you collect, why you collect it and how it is used.
- Identify your lawful basis for processing data (for example, consent, contract or legal obligation).
- Clarify how long you retain personal data and when it is deleted.
- Outline the rights of individuals (such as access, rectification, erasure and objection).
- Include how data is secured and what happens in the event of a breach.
You will also need to name your Data Protection Officer (DPO) if one is required by law, and set out how people can contact them with concerns or requests.
For employers, this policy should be adapted to cover employee data specifically. That includes payroll, performance records, disciplinary actions and health-related information. Generic templates are unlikely to be sufficient.
UK regulators, especially the Information Commissioner’s Office, expect this policy to be clear, accessible and written in straightforward language. If a complaint is made or an investigation is triggered, this is one of the first documents they will request.
6. Whistleblowing Policy
Legal basis: Public Interest Disclosure Act 1998 (PIDA)
A Whistleblowing Policy is essential for any UK company, particularly those with growing teams, financial oversight responsibilities or involvement in regulated sectors. While not strictly required to be written by law, having a clear and documented policy is strongly advised, especially if you want to demonstrate that your business takes integrity and accountability seriously.
The policy should:
- Explain what counts as whistleblowing, such as reporting fraud, corruption, breaches of law or health and safety risks.
- Clarify that it must be in the public interest (not personal grievances).
- Provide a confidential, structured process for employees to raise concerns internally.
- Reassure employees that they will be protected from retaliation or dismissal.
- Outline how the company will respond and investigate disclosures.
Under PIDA, employees are legally protected when they report wrongdoing in good faith. However, without a clear policy and internal process, concerns may be raised externally, such as to regulators or the press, which could damage your reputation.
For companies entering the UK market, having this policy shows that you welcome transparency and create a culture where concerns are taken seriously and dealt with appropriately.
7. Modern Slavery and Human Trafficking Policy
Legal basis: Modern Slavery Act 2015 (Section 54)
If your annual global turnover is £36 million or more, the Modern Slavery Act legally requires you to publish a Modern Slavery Statement every financial year. While this statement is a public document, it must be underpinned by a clear, written Modern Slavery and Human Trafficking Policy that outlines how your organisation prevents exploitation in its operations and supply chains.
This policy should:
- Define modern slavery and related risks, including forced labour, child labour, bonded labour and human trafficking.
- Describe your due diligence process, such as supplier audits, risk assessments and contract clauses.
- Set out how you train staff, especially those involved in procurement, recruitment or supply chain management.
- Include a process for employees or suppliers to report concerns confidentially.
- Clarify who is responsible for enforcing the policy and reviewing it regularly.
Even if your business falls below the legal threshold, many UK clients and partners now require suppliers to adopt this policy voluntarily as part of ethical sourcing requirements. For foreign-owned companies setting up in the UK, a lack of this policy can be a red flag during procurement or investment reviews.
8. Flexible Working Policy
Legal basis: Employment Rights Act 1996 and Employment Relations (Flexible Working) Act 2023
As of 6 April 2024, every employee in the UK has the legal right to request flexible working from day one of employment. This includes requests for remote work, part-time hours, flexitime or compressed workweeks. In response, employers are required to handle these requests fairly, promptly and in line with statutory procedure.
A written Flexible Working Policy is not only best practice, it is essential for demonstrating legal compliance. Your policy should:
- Set out who can make a request, when and how it should be submitted.
- Describe the assessment process, including the time frame for response (usually within two months).
- List valid business reasons for refusal, as defined by law.
- Clarify the employee’s right to appeal.
- Ensure consistency and transparency across departments and roles.
Employers are no longer allowed to reject requests based on informal preferences or outdated assumptions. Every request must be considered on its individual merits, and decisions must be evidence-based.
For businesses expanding into the UK, especially those with international working models, a formal policy helps prevent misunderstandings and ensures your managers are aligned with UK legal expectations from day one.
9. Parental Leave and Pay Policies
Legal basis: Employment Rights Act 1996, Shared Parental Leave Regulations 2014 and Maternity and Parental Leave etc. Regulations 1999
If you’re hiring in the UK, you must provide employees with clear, written information about their statutory rights relating to maternity, paternity, adoption and shared parental leave. These policies are not optional. They are legal entitlements and your employees have the right to know exactly where they stand.
A compliant set of Parental Leave and Pay Policies should include:
- Statutory Maternity Leave and Pay: Up to 52 weeks’ leave, with at least 39 weeks of statutory pay (or company-enhanced pay, if offered).
- Statutory Paternity Leave and Pay: One or two weeks, taken within 56 days of the birth or adoption.
- Adoption Leave and Pay: Similar entitlements to maternity, but applies to one primary adopter.
- Shared Parental Leave (SPL): Allows eligible parents to split up to 50 weeks of leave and 37 weeks of pay between them.
- Parental Leave: Up to 18 weeks of unpaid leave per child, available to parents with at least one year’s service.
These policies must also detail eligibility requirements, notice periods, pay arrangements, and procedures for returning to work.
Even if you don’t offer enhanced benefits beyond statutory minimums, your policies must still be documented and easily accessible. Not only does this ensure legal compliance, it also helps build trust and demonstrates that your business is family-friendly from the outset.
10. Written Statement of Employment Particulars
Legal basis: Section 1 of the Employment Rights Act 1996
From the very first day of employment, every employee in the UK is legally entitled to receive a Written Statement of Employment Particulars. While it is not a policy in the traditional sense, it is a legal requirement and one of the most critical documents you will issue as an employer.
This statement outlines the essential terms of employment and forms the foundation of the employer and employee relationship. It must be provided on or before the first working day, regardless of whether the employee is permanent, temporary or part-time.
The written statement must include:
- Job title and start date.
- Pay and payment intervals (weekly, monthly etc.).
- Working hours, including days and any variation conditions.
- Holiday entitlement and public holiday details.
- Place of work and whether remote or hybrid arrangements apply.
- Notice periods for both parties.
- Sick leave and pay terms.
- Any probationary period, benefits or training entitlements.
If any of this information is missing, incomplete or delayed, you may be in breach of the Employment Rights Act. In the event of a dispute or tribunal, failure to provide this document can result in additional penalties, including compensation of up to two weeks’ pay per affected employee.
For new businesses entering the UK market, creating company policies required by law is not just a compliance task. It is an opportunity to set clear expectations, build trust and demonstrate your commitment to good employment practice from the outset.
Need Help Staying Compliant from Day One?
Establishing a UK entity involves far more than incorporation documents. From day one of hiring, you’re entering a highly regulated employment environment where policies aren’t just guidelines, they are legal obligations.
At EMS, we help international brands set up and scale their UK operations with full legal, HR and payroll support. From drafting your first employment contracts to implementing all ten of the mandatory policies outlined above, our UK-based compliance experts ensure you meet every legal requirement with confidence and precision.
Conclusion
When expanding into the UK, failing to put the right policies in place can be a huge compliance risk. Employment tribunals, data protection complaints and workplace disputes often stem from missing or poorly communicated policies. And when regulators ask for documentation, you will need more than good intentions.
The ten policies covered in this guide are not optional. Some are required by statute, others by best practice enforced through case law and tribunal standards. All of them reflect what it means to be a responsible UK employer.
Treat them as part of your foundation. When these policies are handled properly, they do more than keep you compliant. They create clarity, consistency and trust across your workforce, whether you’re hiring your first employee or your fiftieth.
FAQs
1. Which are UK Company Policies Required by Law?
Key mandatory policies include: Health and Safety (if 5+ employees), Disciplinary and Grievance Procedures, Data Protection, Equal Opportunities, and a Written Statement of Employment Particulars.
2. How does the Health and Safety at Work Act influence required policies?
It requires employers with 5 or more staff to have a written Health and Safety Policy outlining responsibilities and safety procedures.
3. What are the risks of not implementing an Equal Opportunities Policy in the UK?
You may face discrimination claims, reputational damage, and lack of legal defence if challenged under the Equality Act 2010.
4. How do privacy and data protection shape company policies required by Law in the UK?
UK GDPR and the Data Protection Act 2018 require clear policies explaining how employee and customer data is collected, used and stored.
5. Do all UK companies need a Modern Slavery Policy?
Only if your annual turnover is £36 million or more. However, many smaller companies adopt it to meet client or supply chain expectations.
6. What happens if a company fails to provide these required policies?
You may face fines, tribunal claims, loss of investor trust or enforcement action from regulators like ACAS or the ICO.
