Annual retail compliance checklist

Use this checklist annually to verify your retail compliance is current. Each section covers a key compliance area. If you answer "no" to any item, follow the linked guidance to resolve it.

Consumer Rights - Returns and Refunds

Statutory rights for returns and refunds under Consumer Rights Act 2015

30-day right to reject: Full refund for faulty goods within 30 days
6-month fault presumption: Fault presumed present at purchase for first 6 months
After 6 months: Customer must prove fault was present at purchase
Repair or replace first: After 30 days, one repair/replacement attempt before refund
Final right to reject: If repair/replacement fails, customer can reject
Deduction for use: Reasonable deduction after 6 months for use
Time limit: 6 years to claim (5 years in Scotland)

Price Marking Requirements

Legal requirements for displaying prices

Selling price: Must be clearly visible before purchase
Unit price: Required (per kg, litre, metre, etc.)
Unit price exemption: Products under 50g/50ml or sold by number
Metric units: Must use metric (imperial can be shown alongside)
Sale prices: Must show original price and sale price
Online prices: Same requirements as in-store
Penalty for breach: Unlimited fine

Age-Restricted Products

Minimum ages for purchasing age-restricted products

Alcohol: 18 (penalty: £5,000 fine)
Tobacco and vapes: 18 (penalty: £2,500 fine)
Knives and blades: 18 (penalty: unlimited fine)
Fireworks: 18 for adult fireworks, 16 for caps/sparklers
Aerosol paint: 16
National Lottery: 18
Solvents/lighter fuel: 18 (if suspected of abuse)
Video games (PEGI 18): 18 (advisory rating, not law)

UK General Data Protection Regulation (UK GDPR)

Retailers handling customer personal data must comply with UK GDPR. This covers collecting, storing, and processing customer information including names, addresses, email addresses, purchase history, and marketing preferences.

Seven key principles

Personal data must be:

Lawful, fair, transparent: Clear about what data you collect and why
Purpose limitation: Only use data for stated purposes
Data minimisation: Collect only what you need
Accuracy: Keep data up to date and correct
Storage limitation: Delete data when no longer needed
Integrity and confidentiality: Keep data secure
Accountability: Demonstrate compliance

Lawful bases for processing

You need a lawful basis to process personal data. For retail, common bases are:

Contract: Processing necessary to fulfil customer orders
Legitimate interests: Fraud prevention, business analytics (after balancing test)
Consent: Required for marketing emails and non-essential cookies
Legal obligation: Compliance with tax and accounting laws

Customer rights

Customers have the right to:

Be informed: Know what data you collect and how you use it (privacy notice)
Access: Request copies of their personal data (respond within 1 month)
Rectification: Correct inaccurate data
Erasure: Delete data in certain circumstances ('right to be forgotten')
Restrict processing: Limit how you use their data
Data portability: Receive their data in machine-readable format
Object: Stop certain processing (e.g., direct marketing)

Marketing consent

For marketing communications:

Obtain clear, specific consent (opt-in, not pre-ticked boxes)
Keep consent records
Provide easy unsubscribe options
Honour unsubscribe requests promptly
Only send marketing to those who consented

Data breaches

If customer data is lost, stolen, or accessed without authorisation:

Report to ICO within 72 hours if breach poses risk to individuals
Notify affected customers if breach poses high risk
Keep records of all breaches

ICO registration fee

Most businesses must pay an annual data protection fee to the ICO:

Tier 1 (Micro): £40 - turnover ≤£632,000 and ≤10 staff
Tier 2 (Small/Medium): £60 - turnover ≤£36m and ≤250 staff
Tier 3 (Large): £2,900 - above tier 2 thresholds

Privacy notice: Create and publish a clear privacy notice explaining what data you collect and why
Subject access requests: Implement procedures for responding to subject access requests within 1 month
Marketing consent: Review consent mechanisms for marketing - ensure opt-in (not pre-ticked boxes)
Data security: Implement secure data storage and access controls
Breach response plan: Develop data breach response plan
ICO registration: Pay annual ICO data protection fee
Staff training: Train staff on data protection responsibilities
Impact assessments: Conduct Data Protection Impact Assessments for high-risk processing
Data retention: Review data retention periods and delete data no longer needed

Guide to GDPR for small businesses

CCTV in retail premises - data protection obligations

ICO surveillance camera code of practice requirements for retail CCTV, including signage, data retention, subject access requests, body-worn cameras, and staff monitoring rules under UK GDPR and DPA 2018.

Retailers using CCTV must comply with UK GDPR and the Data Protection Act 2018. The Surveillance Camera Code of Practice 2022 (issued under the Protection of Freedoms Act 2012) sets out 12 guiding principles for surveillance camera use.

Data Protection Impact Assessment: Required before installing CCTV; must assess necessity, proportionality, and impact on individuals' privacy
Signage requirement: Clear, visible signs at entry points stating CCTV is in operation, its purpose, and contact details of the data controller (DPO if applicable)
Lawful basis for CCTV: Typically legitimate interests (Article 6(1)(f) UK GDPR); must document a Legitimate Interest Assessment
Data retention period: Typically 30 days unless footage is needed for an incident, investigation, or legal proceedings; must have a documented retention policy
Subject Access Request response: Within 1 calendar month of receipt; can extend by up to 2 further months for complex or numerous requests
Body-worn cameras: Additional safeguards required; staff must be trained, cameras clearly visible, recording indicators displayed, and use governed by clear policy
Staff monitoring via CCTV: Must be transparent, proportionate, and have a legitimate aim; covert monitoring only in exceptional circumstances (e.g., suspected criminal activity) and requires senior management authorisation
Audio recording: Rarely justified in retail; requires stronger justification than video alone due to greater privacy intrusion
Third-party access: Footage should only be disclosed to law enforcement or other third parties where there is a legal basis (e.g., court order, crime prevention)
Code of practice: Surveillance Camera Code of Practice 2022 (12 guiding principles under Protection of Freedoms Act 2012 Section 29)

Sunday Trading Hours (England & Wales)

Sunday trading restrictions for large and small shops

Large shops (over 280 sq m): 6 continuous hours between 10am-6pm
Small shops (280 sq m or less): No restrictions - can trade any hours
Measurement: Internal retail floor space
Penalty for breach: Fine up to £50,000
Christmas Day: Large shops MUST close
Easter Sunday: No special restrictions

Fire safety for retail premises

Fire safety duties for retail premises including responsible person obligations, fire risk assessment, means of escape, detection systems, staff training, and retail-specific fire risks under the Regulatory Reform (Fire Safety) Order 2005.

The responsible person (usually the employer or premises manager) must comply with fire safety legislation. In England and Wales this is the Regulatory Reform (Fire Safety) Order 2005; in Scotland, the Fire (Scotland) Act 2005; and in Northern Ireland, the Fire and Rescue Services (Northern Ireland) Order 2006.

Fire risk assessment: Must be carried out by a competent person; must be recorded if you have 5 or more employees; must be reviewed regularly and after any significant changes to the premises or use
Means of escape: Ensure adequate escape routes and exits; fire exits must never be locked, blocked, or obstructed during trading hours; final exit doors must open outwards
Fire detection and alarm: Install and maintain appropriate fire detection and alarm systems; must be tested weekly (manual call point test) and professionally serviced at least annually
Fire doors: Must be self-closing, properly maintained, and never wedged or propped open; fire door inspections quarterly (Fire Safety (England) Regulations 2022)
Staff training: All staff must receive fire safety training on induction and at regular intervals; training must cover alarm activation, evacuation procedure, assembly points, and fire extinguisher use
Fire safety plan: Display clear evacuation notices; maintain a fire safety logbook recording tests, drills, maintenance, and training
Emergency lighting: Required in escape routes; must activate automatically on mains failure; test monthly and full duration test annually
Fire extinguishers: Appropriate type and number for premises risk; maintain and service annually by competent person; staff trained in use

Retail-specific fire risks

Retail premises must assess and mitigate these sector-specific hazards:

Stockrooms: Combustible packaging, overloaded shelving, blocked escape routes
Fitting rooms: May be concealed from main floor; ensure detection coverage and clear escape routes
Cooking/food preparation areas: Grease build-up, naked flames, extraction system maintenance
Flammable displays and decorations: Seasonal displays (especially Christmas) using flammable materials; keep clear of heat sources and escape routes
Electrical equipment: Overloaded sockets, portable heaters, faulty wiring, PAT testing
Customer density: Occupancy limits must be set based on means of escape capacity
Shopping centre shared areas: Coordinate fire safety with centre management; shared evacuation procedures

England and Wales legislation: Regulatory Reform (Fire Safety) Order 2005 (SI 2005/1541)
Fire Safety (England) Regulations 2022: SI 2022/547; additional duties on fire door checks (quarterly self-inspection) and sharing fire safety information with residents in multi-occupied buildings
Scotland legislation: Fire (Scotland) Act 2005 (asp 5); enforced by Scottish Fire and Rescue Service
Northern Ireland legislation: Fire and Rescue Services (Northern Ireland) Order 2006 (SI 2006/1254); enforced by Northern Ireland Fire and Rescue Service
Penalty for non-compliance: Criminal offence; unlimited fine and/or up to 2 years' imprisonment on conviction on indictment (Article 32, Fire Safety Order 2005)

Retail worker safety obligations

Retail-specific health and safety obligations covering lone working, violence prevention, manual handling in stockrooms, DSE for checkout workers, first aid, and shoplifting incident procedures.

Retail employers must comply with the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999. Retail workplaces present specific risks that must be assessed and controlled.

Lone working: Conduct a specific risk assessment for staff working alone (e.g., early morning, late night, small shops); implement check-in procedures, panic alarms, and safe cash-handling policies (HSE guidance INDG73)
Violence and aggression prevention: Assess risk of work-related violence; provide conflict resolution training, reporting procedures, and post-incident support; do not require staff to physically confront shoplifters
Sexual harassment prevention: Anticipatory duty under Worker Protection (Amendment of Equality Act 2010) Act 2023 (from 26 October 2024); must take reasonable steps to prevent harassment including from customers and third parties
Manual handling (stockroom): Risk assessment under Manual Handling Operations Regulations 1992; provide training, mechanical aids, and safe systems of work for lifting, carrying, and stacking stock
Display screen equipment (DSE): Health and Safety (Display Screen Equipment) Regulations 1992 apply to checkout/till operators who use screens habitually; provide workstation assessments, adjustable seating, and eye tests on request
First aid provision: Health and Safety (First-Aid) Regulations 1981; at least one appointed person and a first aid kit; larger stores may need trained first aiders based on risk assessment
Shoplifting incidents - staff safety: Staff should observe and note descriptions, secure evidence where safe to do, and contact police; employers must not require physical restraint by untrained staff
Slips, trips, and falls: Leading cause of retail workplace injury; maintain clear aisles, clean spillages immediately, ensure adequate lighting, and use appropriate floor surfaces

Key risk factors in retail: Cash handling, customer-facing roles, working alone or at night, heavy or awkward stock, repetitive checkout operations, seasonal peaks with temporary staff who may lack training.

Enforcement: Health and Safety Executive (HSE) and local authority environmental health officers. In Northern Ireland, the Health and Safety Executive for Northern Ireland (HSENI) enforces workplace health and safety.

If you answered "no" to any item, address it promptly. Many of these areas carry criminal penalties for non-compliance including unlimited fines, prosecution, and in some cases imprisonment. See the individual compliance guides for detailed guidance on each area.

Related detailed guides

Consumer rights and returns
Full guide to consumer rights obligations
Price marking for retailers
Price display requirements in detail
Age-restricted products
Age verification and due diligence
Sunday trading rules
Trading hours and exemptions
Trading hours for retailers
GOV.UK guidance on Sunday trading
Accepting returns and giving refunds
GOV.UK guidance on consumer returns

Business Context Testing

Content Graph

Guvnor

Annual retail compliance checklist

Compliance Assistant

🧪 Business Context Testing

◉ Content Graph

Related guides in Health & Safety

Business Context Testing

Content Graph