Business policy questions, answered.

Start with five facts: where you operate, who you employ, what work you do, whose personal data you handle, and what your contracts or regulator require. Make a short list of the risks and decisions people need help with. Check legal requirements first, then add useful operating policies. A small office, a building contractor and a care provider will need different arrangements. Use our policy library to explore topics; it is not a personalised legal assessment.

Review safety arrangements, personal-data handling, employee procedures if you employ people, and how you handle customer complaints. Depending on your work, consider cybersecurity, business continuity, equality and harassment prevention, environmental management and quality. Prioritise the risks you actually face. This is a planning list, not a universal compulsory pack.

Working alone does not remove every business responsibility. Your work activities, premises, customers, personal-data use and contracts still matter. Employee-focused procedures may be unnecessary if you have no employees, while practical arrangements for safety, privacy, complaints and continuity may remain relevant. Check the duties for your circumstances rather than buying an employee handbook you will not use.

A policy states your commitment, scope and responsibilities. A procedure explains the steps people follow. A risk assessment considers hazards, who could be affected and the controls needed. They support each other but are not interchangeable. See our worked policy and procedure example.

There is no single law that prescribes one complete policy pack for every business. Check the relevant duties under health and safety law, employment law, equality law, data protection law, fire safety rules and sector-specific rules. Policies can help explain how you meet a duty; writing one does not by itself meet it. HSE and Acas guidance generally covers Great Britain; Northern Ireland has separate employment and safety arrangements. Fire safety rules also differ between UK nations. Confirm the jurisdiction and current requirements with the relevant regulator or a suitably qualified adviser.

HSE says employers with five or more employees must have a written health and safety policy. A smaller employer still needs a policy, although HSE says it does not have to be written down. It should explain the approach, responsibilities and practical arrangements, and be shared with staff and kept current. A policy does not replace risk assessments or safe working arrangements. HSE: preparing a health and safety policy.

GOV.UK says disciplinary rules must be in the employment statement or clearly written elsewhere, such as a staff handbook. Procedures should reflect the Acas Code, including a fair process and an appeal route. Treat grievance handling as a practical process people can access, with appropriate confidentiality. Check GOV.UK’s written disciplinary arrangements and the Acas disciplinary and grievance Code. For Northern Ireland, check the Labour Relations Agency and applicable local rules.

No. An internal policy describes how your organisation handles personal information. A privacy notice tells people about the use of their information, including relevant purposes, retention and sharing. UK GDPR transparency duties apply when you process personal data, subject to the applicable rules and exceptions. Check the ICO: the right to be informed. The ICO flags that this guidance is under review following the Data (Use and Access) Act, so use its current guidance when preparing your information.

No. A policy alone is not certification and does not prove compliance with an ISO management-system standard. Environmental or quality policies may support your operating arrangements, contractual requirements or a wider management system. Only make certification claims you can substantiate for the correct organisation, activities and scope.

A document alone is insufficient. Acas explains that employers must take reasonable steps to prevent sexual harassment. Assess relevant risks, communicate expectations, train people, offer workable reporting routes and respond to concerns. Keep arrangements under review. See Acas prevention guidance and its guidance on law changes for current and forthcoming requirements.

Check your responsibilities for any business premises you control, including shared premises. GOV.UK explains the responsible person’s duties in England and Wales, including a fire risk assessment, suitable measures and information for staff, and links to different rules for Scotland and Northern Ireland. A general policy is not a replacement for those arrangements. Check fire safety responsibilities.

Assign an owner, check the draft against real working practices, resolve gaps, obtain approval and publish one controlled version. Brief the people affected and make sure the equipment, training, reporting channels and time promised in the policy exist. Check how it works after rollout. Follow our step-by-step implementation guide.

Do not assume one universal rule. Approval, signatures and review intervals depend on the document, applicable requirements, contracts and your management arrangements. Record who approved it and when. Set a sensible review date and review earlier after relevant changes, incidents or feedback. See our review checklist.

No. Policy Logic currently builds drafts for health and safety, environmental, quality, and training and competence policies from your answers. Other library topics are marked as planned. Your organisation must check the scope, missing details and practical arrangements, obtain any specialist advice needed, and approve the final document. You can add your business logo through a business profile.