Every UK employer has legal training duties, even with one member of staff, but the list is shorter than most owners fear. The law mostly asks for “information, instruction, training and supervision” in proportion to your risks, given at induction and whenever the work changes, rather than named certificates. For most small businesses that means a health and safety and fire safety induction, first-aid arrangements, and training on what your staff actually do: screens, lifting, chemicals or personal data. Sector rules then add specific items for food, care, childcare, construction, money laundering, alcohol and security.
At a glance: Nexis CPD sells CPD-accredited online courses at £9 each, with any three for £18; teams of 5 or more pay £6 a course place, with a portal to assign courses and track completion. This article is general information, not legal advice — check with HSE, Acas or a qualified adviser.
What training does every employer have to provide?
Start here whatever your business does. These duties apply from your first employee, and most apply in the same way to a café with two staff as to a factory with two hundred. What changes with size and sector is how much training the risks demand, not whether the duty exists. Rows 5 to 7 apply only if the activity happens in your business.
Every-employer training checklist
| Duty | Law | What it means for a small business | Our guide |
|---|---|---|---|
| 1. Health and safety information, instruction, training and supervision | HSWA 1974 s.2(2)(c); MHSWR 1999 reg 13 | Train new starters, and anyone whose job, equipment, technology or system of work changes. In working hours, at no cost to staff. | Health and safety training requirements |
| 2. Tell staff the risks and the controls | MHSWR reg 10 | Explain, in terms they understand, what your risk assessment found and what you have put in place. | Risk assessment |
| 3. Fire safety training | Fire Safety Order 2005 art 21 (England and Wales) | Train staff when they start and when risks change, repeat it periodically where appropriate, and do it in working hours. | Fire safety training and the law |
| 4. First-aid arrangements | First-Aid Regulations 1981 reg 3 | Assess your needs. At minimum, appoint someone to take charge; train first-aiders if the assessment says you need them; tell staff the arrangements. | First aid training requirements |
| 5. Screen users | DSE Regulations 1992 reg 6 | Train people who habitually use screens before they become users, and again when their workstation is substantially changed. | DSE assessment |
| 6. Manual handling | MHOR 1992 reg 4 | Avoid risky lifting, assess and reduce what remains. A worker’s knowledge and training is part of that assessment. | Manual handling training |
| 7. Hazardous substances | COSHH 2002 reg 12 | Information, instruction and training on the substances used, their risks and the precautions, including cleaning products. | COSHH training requirements |
| 8. Health and safety law poster | Information for Employees Regulations 1989 reg 4 | Display HSE’s approved poster where staff can read it, or give each worker the matching leaflet. | HSE law poster |
| 9. Required training in writing | Employment Rights Act 1996 s.1(4) | The day-one written statement must list training the worker must complete, including any you will not pay for. | Acas: written statements |
| 10. Data protection | UK GDPR arts 5(2), 24 and 32 | No article says “train staff”, but you must be able to show that people handling personal data do so securely. | What is GDPR? |
Notice how little of this is a certificate. Most rows are satisfied by showing people how to work safely in your premises, telling them what could go wrong and checking they understood. First aid is the row where a practical certificate usually comes in, and only for first-aiders your needs assessment says you need: HSE says an appointed person, who takes charge of the arrangements and calls the emergency services, does not need formal training.
How much health and safety training does a very small business need?
Less than a large one, but never none. There is no small-employer exemption from section 2 of the Health and Safety at Work Act or regulation 13 of the Management Regulations. HSE’s guidance for small firms puts the standard plainly: everyone who works for you needs to know how to work safely and without risk to their health, and that includes contractors and the self-employed.
In practice, a five-person office might need a short induction covering the fire routine, first-aid arrangements, accident reporting, safe screen set-up and who to tell about a problem, plus refreshers when things change. A workshop with machinery needs much more, most of it practical. You can be the “competent person” who organises this yourself if you have the knowledge for your risks; you do not have to hire a consultant.
Our guide to health and safety training requirements covers the regulation 13 trigger points, who pays, refresher frequency and training records in depth, so this page will not repeat them. For reporting injuries, see accident book requirements, including whether a small business needs one.
What changes when a business has five or more employees?
At five employees, three things must be written down. None of them is extra training: the threshold is about paperwork.
- A written health and safety policy. Section 2(3) of the 1974 Act requires a written policy statement, and the 1975 exception regulations excuse employers with fewer than five employees. HSE’s policy guidance adds that every business must still have a policy for managing health and safety, and that writing it down is useful even below five.
- Recorded risk assessment findings. MHSWR regulation 3(6) requires employers of five or more to record the significant findings and any group of employees identified as especially at risk. Smaller employers must still do the assessment.
- Recorded health and safety arrangements. Regulation 5(2) requires employers of five or more to record how they plan, organise, control, monitor and review their preventive and protective measures.
One five-employee threshold has gone. When the Fire Safety Order was made, article 9(6) required a written record of the fire risk assessment only where you employed five or more, held a licence for the premises or had an alterations notice. The Building Safety Act 2022 removed those conditions from 1 October 2023, so in England and Wales every responsible person must now record the assessment’s findings and their fire safety arrangements, whatever the headcount. Our five-step fire risk assessment guide covers what goes in the record.
Is data protection training a legal requirement?
Not in so many words, but in practice you cannot meet UK GDPR without it. The regulation has no article that says “train your staff”. Staff training appears only in specialist provisions, such as the tasks of a data protection officer (article 39), a role many small businesses are not required to appoint. What the law does require is accountability: under article 5(2) you must be able to demonstrate compliance; article 24 requires appropriate technical and organisational measures; and article 32(4) requires steps to ensure anyone with access to personal data only processes it on your instructions.
The regulator’s guidance connects those duties to training. The ICO’s guide to data security says organisations “should provide appropriate initial and refresher training”, covering staff responsibilities, checking callers’ identity and recognising phishing. Its accountability guide says to ensure a good level of understanding and awareness of data protection among staff. The ICO became the Information Commission on 30 September 2026; the regulator’s role and powers are unchanged.
See what GDPR is for the principles, cyber security training requirements for whether small businesses need to train staff in cyber security, and how to report a data breach.
Which sectors have extra training rules?
Sector rules sit on top of the every-employer list; they never replace it. A care home still needs fire, manual handling and COSHH training. Use this table to see which add-ons apply, then read the linked guide for the detail.
Sector add-ons checklist
| If your business… | Extra training rule | Source | Our guide |
|---|---|---|---|
| Handles food | Food handlers supervised and instructed and/or trained in food hygiene in line with their work; HACCP training for whoever runs your food safety procedures; staff trained to manage allergies | Reg (EC) 852/2004 Annex II ch XII; FSA guidance | Food hygiene; HACCP |
| Provides CQC-registered care (England) | Training, supervision and appraisal “as is necessary” for each role; learning disability and autism training appropriate to the role | Reg 18, 2014 Regulations; Health and Care Act 2022 s.181 | Care Certificate; Care home training |
| Runs a nursery or childcare (England) | Safeguarding training for all practitioners, renewed every two years; a paediatric first aider on site whenever children are present; induction; in group settings, food hygiene training for staff who prepare food | EYFS framework | Early years training |
| Is covered by the money laundering rules (accountants, tax advisers, estate and letting agents and others) | Staff made aware of the law and regularly trained to spot suspicious activity, with a written record of the training | MLR 2017 reg 24 | AML training requirements |
| Does construction work | Workers have, or are obtaining, the skills, knowledge, training and experience for their tasks; a site induction | CDM 2015 reg 15(7) and (9) | Construction training |
| Has staff who drive for work | Health and safety law applies on the road as on a fixed site; HSE says drivers must be adequately trained at no cost to them. Most professional lorry, bus and coach drivers also need Driver CPC | HSE driving for work | Driving for work; Driver CPC |
| Sells alcohol | England and Wales: a designated premises supervisor with a personal licence, and every sale made or authorised by a personal licence holder. Scotland: prescribed training for all staff who sell or serve alcohol | Licensing Act 2003 s.19; Licensing (Scotland) Act 2005 sch 3 | Check your premises licence conditions |
| Uses door supervisors or security guards | Anyone doing licensable security work, such as door supervision or contract guarding, needs an SIA licence, which requires a licence-linked qualification | Private Security Industry Act 2001 s.3 | SIA licence training |
Food businesses
The food hygiene rule is the one most often overstated. The law requires food handlers to be “supervised and instructed and/or trained in food hygiene matters commensurate with their work activity”. The FSA’s guidance on staff training says food handlers do not have to hold a food hygiene certificate, but you must be able to show staff have the right skills and up-to-date training, and should keep a record to show at inspection. Our guide to whether you need a food hygiene certificate explains why Level 2 became the convention, and our HACCP guide covers HACCP for small businesses.
Care and early years
Regulation 18 requires care staff to receive “such appropriate support, training, professional development, supervision and appraisal as is necessary” for their duties. It does not name the Care Certificate, but the Care Certificate is the induction standard care employers in England widely use to show new staff have been trained. Early years settings have the most precise rules of any sector here: the EYFS framework in force from September 2026 requires safeguarding training for all practitioners, renewed every two years; a full paediatric first aid certificate holder on the premises whenever children are present; and, in group and school-based settings, food hygiene training for staff who prepare food. For other settings, see safeguarding training requirements.
How do I build a simple training plan for a small business?
A plan for ten people fits on one page. HSE’s leaflet Health and safety training: a brief guide (INDG345) uses a similar five-step approach and ends with checking the training worked.
- List every role. Include part-timers, weekend staff, temporary and agency workers, apprentices, managers and yourself. Note anyone under 18, because young workers need their own risk assessment.
- Map duties to roles. Run each role against the two tables above and your risk assessment. The person who opens up needs the fire routine; the person who orders the cleaning chemicals needs COSHH; the person who takes card details needs data protection.
- Choose the delivery. Practical skills need practical training: first-aid certificates, safe lifting technique, fire drills, equipment and food handling. Knowledge can be delivered online, such as the law, the risks and what to do. Your own site walk-round is always part of it.
- Set refresh points. The law fixes few intervals. Some are set: two-yearly early years safeguarding, three-yearly paediatric first aid, “regularly” for money laundering training. Everything else is due when roles, equipment or systems change, plus a refresher interval you can explain.
- Keep the record. Who, what, when, how it was checked and when it is next due. Our HR guide on building a training matrix that survives scrutiny shows a simple layout and why each topic should be tied to the duty behind it.
What training mistakes do small businesses make?
Treating an online course as a first-aid certificate. Where your needs assessment says you need first-aiders, HSE expects them to be trained by a competent provider in emergency first aid at work or first aid at work, which includes practical skills. An online awareness course explains the role and priorities; it does not make anyone a first-aider. The early years framework is stricter still, requiring a full paediatric first aid course.
No records. Few laws demand a training record outright; the Money Laundering Regulations do, and so do Scotland’s alcohol licensing rules. But if an inspector asks how you met regulation 13, or an environmental health officer asks about food hygiene training, the record is your answer.
Training once and never again. Regulation 13 and the Fire Safety Order both say training must be “repeated periodically where appropriate”, and the ICO talks about initial and refresher training. A three-year-old induction and nothing since is hard to defend.
Forgetting temporary and agency staff. Fixed-term staff are your employees, so regulation 13 applies to them in full. Regulation 15 also requires you to tell fixed-term workers, and agency workers placed with you, about any qualifications or skills needed to work safely. HSE says employers have obligations towards agency workers who are new starters “just as they do towards employees”, and that day-to-day responsibility during an assignment lies with the business directing the work.
Charging staff for legally required health and safety training. Section 9 of the 1974 Act forbids it. For other mandatory training, Acas says it must be in the written statement, its cost can only be deducted from pay if the contract allows it, and no deduction may take pay below the minimum wage.
Which online courses cover the core training for a small business?
Three Nexis CPD courses match the knowledge side of duties almost every small employer shares. Introduction to Health and Safety covers health and safety law, hazards and risk assessment, health and safety hazards, and controlling risk. Fire Safety Awareness covers fire safety legislation, how fire starts and spreads, prevention, the five-step fire risk assessment and emergency procedures. Data Protection and GDPR Awareness covers UK GDPR principles, lawful grounds, people’s rights, staff responsibilities and what to do after a breach. Together they cost £18, because any three courses trigger the pay-for-2-get-3 offer.
£9 per course. CPD accredited, 100% online, verifiable e-certificate. Pay for 2, get 3 — any 3 courses for £18. Teams of five or more staff can buy course places at business rates on our for business page. These are CPD-accredited awareness courses. They do not replace a first aid at work certificate, practical manual handling training, a fire drill in your building, food hygiene practice in your kitchen, SIA licence training or a regulated qualification.
Training a team? From 5 staff, Nexis CPD course places cost £6 each, however many you buy. Places last 12 months. You pay once by card, then get your own portal to add staff, choose their courses and track who has finished. Fewer than five staff? Every course is £9, with any three for £18. See team pricing.
Frequently asked questions
Is staff training a legal requirement for a small business?
Yes. Every employer must provide the information, instruction, training and supervision staff need to work safely, under section 2 of the Health and Safety at Work Act 1974, with fire safety training and first-aid arrangements on top. How much training you need depends on your risks, not your size.
Do I need a written health and safety policy with fewer than five employees?
No. Employers with fewer than five employees do not have to write down their health and safety policy or their risk assessment findings, though HSE says doing so is useful. In England and Wales the fire risk assessment must now be recorded whatever your headcount.
Do my staff need training certificates?
Mostly not. The law usually requires adequate training, not a named certificate, and food handlers do not need a food hygiene certificate. The exceptions include first-aiders your needs assessment calls for, paediatric first aiders in early years, SIA licence holders and personal licence holders for alcohol.
Is GDPR training mandatory for small businesses?
UK GDPR has no article that says “train your staff”, but you must be able to demonstrate compliance and keep personal data secure. The ICO’s security guidance says organisations should provide appropriate initial and refresher training, so in practice it is expected.
Do I have to train agency and temporary workers?
Yes. Fixed-term staff are employees, so the normal training duties apply. For agency workers, HSE says employers have the same obligations towards them as new starters as towards employees, and you must tell the agency what skills and qualifications the job needs to be done safely.
Can I make staff pay for their training?
Not for health and safety training the law requires: section 9 of the Health and Safety at Work Act forbids charging employees for it. For other mandatory training, Acas says it must be in the written statement, and deductions must not take pay below the minimum wage.
This article is general information about staff training duties for UK small businesses, not legal advice. It reflects the Health and Safety at Work etc. Act 1974 and regulations made under it, the Regulatory Reform (Fire Safety) Order 2005, UK GDPR, the Employment Rights Act 1996 and the sector rules named above as we found them on legislation.gov.uk, HSE, ICO, GOV.UK and Acas on 16 October 2026. Most health and safety rules cited apply in Great Britain; the Fire Safety Order and Licensing Act 2003 apply in England and Wales, and the CQC and EYFS rules apply in England. Northern Ireland, Scotland and Wales have their own rules in places. For your business, check with HSE, Acas, your local authority or a qualified adviser. Nexis CPD courses are CPD-accredited awareness training, not regulated qualifications, first aid certificates or licence training.