HR policies for UK small businesses: which ones the law actually requires

If you've been told you "need HR policies", you'd reasonably expect a list somewhere in the law of named documents with your name on it. There isn't one. So this guide sorts the pile: what the law actually asks for, what Acas says tribunals will look at, and what's just sensible.

Which HR policies are required by law in the UK?

Very few, by name. That's the honest answer, and it surprises people.

What the law actually asks for is certain information in writing (mostly through the written statement), a written health and safety policy once you have five or more employees, privacy information for your staff, and a couple of notices you have to display or share. There's also a legal duty on sexual harassment where a policy is the usual way of showing you've done the work. Everything else is good practice. Useful, sometimes very useful, but a choice.

I'll go through them in that order and be clear about which is which, because the mix-up is where small businesses end up either panicking or writing a sixty-page manual nobody reads. If you want the list as a table you can fill in, there's a free UK small business policy checklist that goes with this guide.

What has to be in writing from day one

This is the bit that catches people. Employers must give employees and workers a written statement of employment particulars in two parts: a principal statement on the first day, and a wider written statement "within 2 months of the start of employment". The principal statement is due on the first day, not the first week, and it includes holiday entitlement, among other things.

The wider statement must include "disciplinary and grievance procedures". So those two procedures have to exist in writing, whatever else you skip.

Also on day one, you have to give information on "sick pay and procedures", other paid leave and notice periods. Here's the useful part: that information can sit in a separate document, as long as people have reasonable access to it, "such as on the employer's intranet". So your absence and leave rules can live in a policy, and the statement points to it.

If anything in the written statement changes, you have to tell people within one month of making the change. Worth building into whatever you do when you update a policy the statement relies on, rather than remembering it later.

And Acas has a small but handy point: if your statement refers to other documents, it's important to state what they are and where to find them. Name the document, say where it lives. That's it.

Disciplinary and grievance: the Acas Code

Here's where it gets a bit odd. The written statement makes you set out your procedures, but the thing everyone actually points to is the Acas Code of Practice on disciplinary and grievance procedures, and it matters more than its status suggests.

Failing to follow the Code doesn't, on its own, make you liable to proceedings. But "employment tribunals will take the Code into account", and they can adjust awards "by up to 25 per cent". Up if the employer unreasonably failed to follow it. Down if the employee did. That's a real number sitting on the table before anyone's even argued about the facts.

The Code describes itself as "the minimum an employer should follow". Minimum. Not the gold standard, the floor. It says your rules and procedures "should be set down in writing, be specific and clear", and that people should understand "where they can be found and how they are to be used". Acas also says to put the standards of behaviour expected from employees in writing, so nobody is guessing what counts as a problem. In practice, that's your code of conduct.

One thing to flag. The current Code came into effect on 11 March 2015. Acas has consulted on a new draft, and that consultation closed on 23 September 2026, with responses being reviewed. I'm not going to describe the draft, because it's a draft. Keep an eye on the Acas site, and when a new Code lands, check your procedures against it.

Health and safety: the five-employee line

This is the one place in the whole area where headcount flips a switch. Every business must have a policy for managing health and safety, and the HSE is plain about the line: "If you have five or more employees, you must write your policy down." The duty comes from section 2 of the Health and Safety at Work etc Act.

Fewer than five, you still need a policy, you just don't have to write it down. The HSE says it's useful to anyway, and I'd agree. Either way, "You must share the policy, and any changes to it, with your employees."

At five or more, there's a second written bit: you must record the significant findings of your risk assessment. So it's not just the policy, it's the paper trail behind it.

Then the notices, which apply whatever your size. You must display your employers' liability certificate where employees can access it, whether that's in the workplace, on your website or on the intranet. If you don't, you could be fined £1,000. And you must either display the HSE-approved law poster or give each worker the equivalent leaflet.

That's the health and safety set. Short, specific, and actually enforceable.

Data protection: privacy information for staff

Now the one people often forget entirely. You must tell your workers what you do with their personal information. The ICO calls this "privacy information", and it covers your purposes, your lawful basis, how long you keep things, who you share with, and people's rights over their information.

Timing matters: give it at the time you collect the information. The format is flexible, though. A staff privacy notice on the intranet works, and so does a section in a handbook. What isn't flexible is the content. And if you want to use the information for something new, you must bring that to people's attention before you start. Not after.

There are a couple of extra bits worth knowing. If you keep health or other special category records and you're relying on the employment law condition to do it, the ICO says that condition "also requires you to have an appropriate policy document in place". That's not every employer, only those relying on that condition, so check rather than assume.

Monitoring is the other one. Apart from very exceptional cases where covert monitoring is justified, the ICO says "you must inform workers about any monitoring", and if the monitoring is there to enforce a policy, make sure that policy is clearly set out. So if you check email use or log system access, staff need to know, and they need to know what the rules are. So if your IT or acceptable use rules are what the monitoring enforces, write them down properly.

The ICO also says you "should set up a retention policy or schedule". Note the wording, "should". That's guidance on good practice rather than a named legal document, but it's sensible, and it answers the "how long do we keep this" question before someone asks it.

Sexual harassment: a duty, not a document

I want to be careful here, because this is where confusion sets in. Acas says: "By law, all employers must take reasonable steps to prevent sexual harassment of their workers." That's been the case since 26 October 2024. And the law is being strengthened: from 30 October 2026, employers will need to take "all reasonable steps".

Notice what that is. It's a duty to do things. It isn't a duty to have a particular document.

A specific policy is a choice. Acas puts it as "you might decide to create a policy on sexual harassment", and it can sit inside a bullying or discrimination policy rather than stand alone. But Acas's own example of an employer taking all reasonable steps has a manager who "shares the organisation's sexual harassment policy" at induction. So a policy helps show you did something, but the doing is the thing.

If you take one idea from this guide, that's a decent one: the law cares about what you do, and a policy is how you show it.

Good-practice policies worth having

Right, this is the bit where nothing is required by name, and I'll say so for each one so nobody gets the wrong idea.

Whistleblowing. GOV.UK is plain about it: "You are not legally required to have a whistleblowing policy", but "It is a good idea to have a whistleblowing policy so that workers know how to raise concerns and managers know how to respond." Fair enough.

Equality, bullying and harassment. Acas says you "might want to develop specific policies", for example a bullying, discrimination and harassment policy, and an equality, diversity and inclusion policy. There's a free EDI policy template on the Acas site, which saves you starting from nothing. This is also a natural home for your sexual harassment wording.

Flexible working. This sits in a middle spot. The Acas Code on flexible working "must be followed where an employee makes a statutory request for flexible working", and a clear policy and procedure "can be helpful". The policy is optional; following the Code isn't.

Expenses. More practical than legal: "Where employers expect to pay expenses they should have a policy." Without one, employees might be entitled to expenses "through custom and practice". Which is a slightly alarming phrase if you've been paying for train tickets informally for a while.

Absence. Acas says "you should make clear what happens when workers need time off". Since sick pay and procedures have to be covered on day one anyway, an absence policy is often the easiest way to do it.

AI use. Acas says "Employers should develop clear policies regarding the use of AI at work" and should consult workers on its introduction. Worth writing as soon as people start putting company information into AI tools.

IT and acceptable use, social media, homeworking or hybrid working. No law requires any of these by name. They fill real gaps, though, particularly as more people work in more places, and IT rules need to be clearly set out if you monitor to enforce them (see above).

One more thing from Acas: check all your policies to make sure they do not discriminate against anyone, including absence, dress code, flexible working and social media. Easy to overlook when you're copying a template in a hurry.

How to write and run your policies

Short beats long. I'd rather see six one-page policies people have actually read than a manual that's never been opened. If you want them all in one place, that's what an employee handbook is for, and no law requires one of those either.

Each policy needs a named owner and a review date at the top. Not a department, a person. If nobody owns it, nobody updates it.

Keep one current version, in one place staff can find, and link it from the written statement. Then you've covered the Acas point about saying what your documents are and where to find them, without extra effort.

Label each policy as contractual or not. Contract terms can sit "in an employee handbook or on a company notice board", and GOV.UK says an employer should make clear which parts of a contract are legally binding. Acas notes a contract can include policies, for example on social media or data protection. So be deliberate about which ones you're making part of the deal and which you're not.

Start with the required set: the written statement information (including disciplinary and grievance, sick pay and leave), health and safety, and staff privacy information, plus the notices. Then add others as the business actually needs them. Expenses when people start spending company money. AI once people use AI tools. No need to write them all in advance.

And when a policy changes, tell people, and record who's seen the new version (our policy acknowledgement guide covers how). That sounds like admin, and it is, but it's the admin that helps if something ever goes wrong.

Questions people ask

What HR policies are required by law in the UK?

Very few by name. The law requires a written statement (which must include disciplinary and grievance procedures and day-one information on sick pay, leave and notice), a written health and safety policy if you have five or more employees, and privacy information for staff. There's also a duty to take reasonable steps to prevent sexual harassment, which a policy helps you show.

Do small businesses need a written health and safety policy?

Every business needs a health and safety policy, but you only have to write it down once you have five or more employees. You must share it, and any changes to it, with your employees whatever your size.

Is a whistleblowing policy a legal requirement?

No. GOV.UK says you are not legally required to have one, but that it is a good idea so workers know how to raise concerns and managers know how to respond.

Do I have to follow the Acas Code on disciplinary and grievance?

Not following it doesn't, on its own, make you liable. But employment tribunals take the Code into account and can adjust awards by up to 25 per cent where either side unreasonably failed to follow it, so treat it as the minimum.

Do we need a company policy on AI?

No law requires one by name. Acas says employers should develop clear policies on the use of AI at work and consult staff on its introduction, so it's worth writing once people use AI tools.

Can company policies be part of the employment contract?

Yes. Contract terms can sit in a handbook, and a contract can include policies such as social media or data protection. GOV.UK says to make clear which parts are legally binding, so label each policy contractual or not.