Manage security staff working time

Working time rules for security staff

Working Time Regulations 1998 as applied to security guarding, including the 48-hour average week, opt-out provisions, night worker limits, rest breaks, and the classification of security guarding as unmeasured working time.

Maximum average weekly hours: 48 hours averaged over a 17-week reference period (Regulation 4)
Opt-out agreement: Workers may voluntarily opt out of the 48-hour limit in writing; opt-out is common in security sector but must be genuinely voluntary with 7 days' minimum notice to cancel (or longer if agreed, up to 3 months)
Night worker limit: 8 hours per 24-hour period on average; where work involves special hazards or heavy physical/mental strain, an absolute 8-hour limit applies
Night worker definition: A worker who normally works at least 3 hours of daily working time during night hours (11pm to 6am by default)
Night worker health assessment: Employers must offer a free health assessment to night workers before assignment and at regular intervals thereafter
Rest break entitlement: 20-minute uninterrupted break when daily working time exceeds 6 hours; break must be taken away from the workstation
Daily rest: 11 consecutive hours' rest in each 24-hour period
Weekly rest: 24 consecutive hours' uninterrupted rest in each 7-day period (or 48 hours in each 14-day period)
Unmeasured working time: Security guarding may qualify as unmeasured working time under Regulation 20 where the worker controls the duration; this disapplies the 48-hour limit, night work limit, and rest break rules
Compensatory rest: Where rest breaks or daily/weekly rest cannot be taken (e.g. continuous security coverage), the employer must allow equivalent compensatory rest within a reasonable period
Enforcement body: Health and Safety Executive (HSE) enforces rest and night work limits; employment tribunals handle 48-hour and holiday disputes

Opt-out agreements

An employee can voluntarily agree in writing to work more than 48 hours per week. The opt-out must be genuinely voluntary; you cannot make it a condition of employment or penalise anyone who refuses or withdraws consent. The employee can cancel the opt-out by giving you written notice (at least seven days, or up to three months if agreed in writing).

Keep a copy of every signed opt-out agreement. Even where an opt-out is in place, you still owe a duty of care to protect the employee from fatigue-related risks.

Lone working

Many security guarding roles involve working alone, particularly on night shifts. You must carry out a specific risk assessment for lone workers under the Management of Health and Safety at Work Regulations 1999.

Lone working requirements for security staff

Lone working risk assessment obligations for security employers under the Management of Health and Safety at Work Regulations 1999, including communication systems, welfare checks, violence risk, and personal safety measures specific to security guarding.

Legal duty: Employer must assess risks to lone workers under MHSWR 1999 Regulation 3 and implement controls under HASAWA 1974 Section 2
Lone worker definition: Anyone working without close or direct supervision, including security officers on solo patrols, night shifts, or static guarding at remote sites
Risk assessment scope: Must consider violence and aggression, medical emergencies, environmental hazards, fatigue, confined spaces access, and site-specific risks
Communication systems: Employer must provide reliable means of communication such as two-way radio, mobile phone, lone worker alarm device, or GPS-enabled personal safety app
Welfare check-in procedures: Regular scheduled check-ins at agreed intervals; if a check-in is missed, escalation procedure must activate immediately
Panic alarm / personal safety device: Lone security workers in high-risk environments should be provided with a personal alarm or man-down device with automatic alert capability
Violence risk assessment: Specific assessment required for roles involving confrontation, public interaction, cash handling, or working in areas with known crime risk
Site familiarity: Lone workers must be briefed on site hazards, emergency exits, first aid locations, and contact details for emergency services before commencing work
Fitness for lone working: Employer must consider whether the individual is medically and psychologically suitable to work alone, particularly for extended shifts
Recording requirement: Risk assessment findings must be recorded if the employer has 5 or more employees
Review trigger: Reassess lone working arrangements after any incident, near miss, change in site conditions, or change in personnel

There is no specific lone working legislation. Obligations derive from the general duty under HASAWA 1974 Section 2 and the risk assessment requirement in MHSWR 1999 Regulation 3. Security guarding frequently involves lone working in environments with elevated risk of violence, trespass, and medical emergency. Employers must ensure that control measures are proportionate to the assessed risk and that lone workers are never placed in situations that cannot be safely managed by one person.

Violence and conflict risks

Security staff are at higher risk of workplace violence than most occupations. You must assess the risk of violence as part of your health and safety obligations and put control measures in place.

Violence at work requirements for security roles

Violence at work risk assessment and management obligations for security employers, including HSE guidance, conflict management training, RIDDOR reporting for violent incidents, body-worn cameras, and physical intervention policies.

HSE definition of work-related violence: Any incident in which a person is abused, threatened, or assaulted in circumstances relating to their work
Risk assessment obligation: Employer must assess the risk of violence to security staff under MHSWR 1999 Regulation 3 and implement control measures under HASAWA 1974 Section 2
Conflict management training: Security staff must receive training in conflict avoidance, de-escalation techniques, and disengagement; SIA requires conflict management as part of the licence-linked training programme
Physical intervention policy: Employers must have a clear written policy on the use of reasonable force; physical intervention is a last resort and must be proportionate, necessary, and lawful
Body-worn cameras: Where used, employers must comply with the ICO's Surveillance Camera Code of Practice, conduct a Data Protection Impact Assessment, display signage, and manage footage retention
Incident reporting (internal): Employer must maintain a system for recording all incidents of violence, threats, and verbal abuse, including near misses
RIDDOR reporting: Physical violence resulting in specified injuries (fractures, loss of consciousness, hospitalisation for over 24 hours) or incapacitation for more than 7 consecutive days must be reported to HSE under RIDDOR 2013
RIDDOR reporting deadline: Specified injuries must be reported without delay; over-7-day incapacitation must be reported within 15 days of the incident
Post-incident support: Employer should provide access to counselling, debriefing, and welfare support following violent incidents
Safe systems of work: Control measures may include staffing levels, site lighting, CCTV, restricted access, communication devices, and emergency response procedures
Enforcement: HSE and local authorities enforce workplace violence risk management; failure to assess and control violence risk can result in improvement or prohibition notices and criminal prosecution

Security workers face a significantly elevated risk of violence compared to most occupations. HSE guidance emphasises that employers cannot simply accept violence as part of the job. The duty to assess and control the risk of violence applies regardless of the sector in which the security operative is deployed. Where security staff are provided to a client site, both the employer and the client have duties under HASAWA 1974 to cooperate on risk control measures.

Record-keeping

You must keep working time records for at least two years. Records should include:

Hours worked each week by each employee (including overtime)
Night work hours and any health assessments offered
Rest breaks taken
Signed opt-out agreements and any withdrawals
Lone working risk assessments and review dates
Violence risk assessments and incident reports

Manage security staff working time

SIA employer compliance checklist

Security staff onboarding checklist

Environmental compliance for construction sites

Working time and rest breaks in hospitality

Structural works compliance checklist

Opt-out agreements

Lone working

Violence and conflict risks

Record-keeping

Official guidance

Related guides in Employee Rights

Opt-out agreements

Lone working

Violence and conflict risks

Record-keeping

Official guidance