Retail & Consumer Goods UK-wide

Annual retail compliance checklist

Quick annual compliance verification for established retailers. Covers consumer rights, pricing, age verification, data protection, Sunday trading, fire safety, worker safety, and environmental obligations.

Updated 19 Feb 2026

Guide summary

Use this checklist each year to check your retail business complies with the law. You must display your returns policy, train staff on consumer rights, show prices with VAT, follow age verification rules, and protect customer data. Pay the ICO data protection fee each year (from £52 to £3,763). Penalties for non-compliance include unlimited fines.

Display statutory rights information at point of sale and online
Train all customer-facing staff on 30-day refund and repair rights
Show prices including VAT and unit prices per kg, litre or metre
Ensure promotional prices were charged for at least 28 days before
Have a written Challenge 25 policy and train staff on age checks
Keep a log of all refused age-restricted sales
Record staff training on age-restricted products every 12 months
Pay the annual ICO data protection fee (£52, £78 or £3,763)
Publish a privacy notice on your website and in store
Put up CCTV signage stating purpose and data controller details

On this page

Health and safety for retail premises

Retail-specific health and safety obligations. Covers lone working, violence prevention, manual handling, display screen equipment, fire safety, first …

Data protection for retail businesses

UK GDPR compliance for retail businesses. Covers customer data handling, CCTV obligations, marketing consent, loyalty programme data, breach …

Retail sector market overview

UK retail market statistics, ecommerce growth trends, and investment opportunities for retailers operating in Great Britain.

Consumer Rights and Returns

Understand consumer rights for returns, refunds, and replacements under the Consumer Rights Act 2015.

Age-Restricted Products

Understand legal requirements for selling age-restricted products including alcohol, tobacco, and knives.

Use this checklist annually to verify your retail compliance is current. Each section covers a key compliance area. If you answer "no" to any item, follow the linked guidance to resolve it.

1

Returns policy displayed and compliant

Statutory rights information visible at point of sale and online. Policy does not claim "no refunds" or restrict statutory rights.
2

Staff trained on consumer rights

All customer-facing staff understand the 30-day refund right, repair/replacement rights, and distance selling cooling-off period.

Consumer Rights - Returns and Refunds

Statutory rights for returns and refunds under Consumer Rights Act 2015

30-day right to reject: Full refund for faulty goods within 30 days
6-month fault presumption: Fault presumed present at purchase for first 6 months
After 6 months: Customer must prove fault was present at purchase
Repair or replace first: After 30 days, one repair/replacement attempt before refund
Final right to reject: If repair/replacement fails, customer can reject
Deduction for use: Reasonable deduction after 6 months for use
Time limit: 6 years to claim (5 years in Scotland)

1

All prices include VAT and are clearly displayed

Selling price and unit price shown for all products. No hidden charges before checkout.
2

Promotional pricing is genuine

Previous ('was') prices were charged for at least 28 consecutive days. No misleading discounts.
3

Unit pricing displayed where required

Price per kg, litre, or metre shown for applicable products. Metric units used (imperial supplementary only).

Price Marking Requirements

Legal requirements for displaying prices

Selling price: Must be clearly visible before purchase
Unit price: Required (per kg, litre, metre, etc.)
Unit price exemption: Products under 50g/50ml or sold by number
Metric units: Must use metric (imperial can be shown alongside)
Sale prices: Must show original price and sale price
Online prices: Same requirements as in-store
Penalty for breach: Unlimited fine

1

Challenge 25 policy in place

Written policy, signage displayed, till prompts active for all age-restricted products.
2

Refusals log maintained

Date, time, product, and reason recorded for each refusal of age-restricted sale.
3

Staff training records current

All staff selling age-restricted products have documented training within the last 12 months.

Age-Restricted Products

Minimum ages for purchasing age-restricted products

Alcohol: 18 (penalty: unlimited fine in England and Wales; up to £20,000 for persistently selling to children)
Tobacco and vapes: 18 (penalty: £2,500 fine)
Knives and blades: 18 (penalty: unlimited fine)
Fireworks and sparklers: 18 for adult fireworks and sparklers; 16 for other category F1 items (caps, party poppers); 12 for Christmas crackers
Aerosol paint: 16
National Lottery: 18
Solvents and butane lighter refills: Butane lighter refills must not be supplied to under-18s; glues and solvents must not be supplied to under-18s where inhalation is suspected
Video games (PEGI 12/16/18): Statutory age ratings — supply to an underage buyer is a criminal offence

1

ICO data protection fee paid

Annual registration fee paid to the Information Commissioner's Office.
2

Privacy notice current and published

Privacy notice on website and in-store reflects current data processing activities.
3

CCTV signage in place

Clear signs at entry points stating CCTV is in operation, its purpose, and data controller contact details.

UK General Data Protection Regulation (UK GDPR)

Retailers handling customer personal data must comply with UK GDPR. This covers collecting, storing, and processing customer information including names, addresses, email addresses, purchase history, and marketing preferences.

Seven key principles

Personal data must be:

Lawful, fair, transparent: Clear about what data you collect and why
Purpose limitation: Only use data for stated purposes
Data minimisation: Collect only what you need
Accuracy: Keep data up to date and correct
Storage limitation: Delete data when no longer needed
Integrity and confidentiality: Keep data secure
Accountability: Demonstrate compliance

Lawful bases for processing

You need a lawful basis to process personal data. For retail, common bases are:

Contract: Processing necessary to fulfil customer orders
Legitimate interests: Fraud prevention, business analytics (after balancing test)
Consent: Required for marketing emails and non-essential cookies
Legal obligation: Compliance with tax and accounting laws

Customer rights

Customers have the right to:

Be informed: Know what data you collect and how you use it (privacy notice)
Access: Request copies of their personal data (respond within 1 month)
Rectification: Correct inaccurate data
Erasure: Delete data in certain circumstances ('right to be forgotten')
Restrict processing: Limit how you use their data
Data portability: Receive their data in machine-readable format
Object: Stop certain processing (e.g., direct marketing)

Marketing consent

For marketing communications:

Obtain clear, specific consent (opt-in, not pre-ticked boxes)
Keep consent records
Provide easy unsubscribe options
Honour unsubscribe requests promptly
Only send marketing to those who consented

Data breaches

If customer data is lost, stolen, or accessed without authorisation:

Report to ICO within 72 hours if breach poses risk to individuals
Notify affected customers if breach poses high risk
Keep records of all breaches

ICO registration fee

Most businesses must pay an annual data protection fee to the ICO:

Tier 1 (Micro): £52 - turnover ≤£632,000 and ≤10 staff
Tier 2 (Small/Medium): £78 - turnover ≤£36m and ≤250 staff
Tier 3 (Large): £3,763 - above tier 2 thresholds (fees uplifted 17 February 2025; £5 direct debit discount)

Privacy notice: Create and publish a clear privacy notice explaining what data you collect and why
Subject access requests: Implement procedures for responding to subject access requests within 1 month
Marketing consent: Review consent mechanisms for marketing - ensure opt-in (not pre-ticked boxes)
Data security: Implement secure data storage and access controls
Breach response plan: Develop data breach response plan
ICO registration: Pay annual ICO data protection fee
Staff training: Train staff on data protection responsibilities
Impact assessments: Conduct Data Protection Impact Assessments for high-risk processing
Data retention: Review data retention periods and delete data no longer needed

Guide to GDPR for small businesses

CCTV in retail premises - data protection obligations

Data protection obligations for retail CCTV under UK GDPR and the DPA 2018, following the ICO's Video Surveillance Guidance — signage, data retention, subject access requests, body-worn cameras and staff monitoring rules.

Retailers using CCTV must comply with UK GDPR and the Data Protection Act 2018, following the ICO's Video Surveillance Guidance. (The separate Surveillance Camera Code of Practice under the Protection of Freedoms Act 2012 binds police and local authorities in England and Wales, not retailers.)

Data Protection Impact Assessment: Required before installing CCTV; must assess necessity, proportionality, and impact on individuals' privacy
Signage requirement: Clear, visible signs at entry points stating CCTV is in operation, its purpose, and contact details of the data controller (DPO if applicable)
Lawful basis for CCTV: Typically legitimate interests (Article 6(1)(f) UK GDPR); must document a Legitimate Interest Assessment
Data retention period: Typically 30 days unless footage is needed for an incident, investigation, or legal proceedings; must have a documented retention policy
Subject Access Request response: Within 1 calendar month of receipt; can extend by up to 2 further months for complex or numerous requests
Body-worn cameras: Additional safeguards required; staff must be trained, cameras clearly visible, recording indicators displayed, and use governed by clear policy
Staff monitoring via CCTV: Must be transparent, proportionate, and have a legitimate aim; covert monitoring only in exceptional circumstances (e.g., suspected criminal activity) and requires senior management authorisation
Audio recording: Rarely justified in retail; requires stronger justification than video alone due to greater privacy intrusion
Third-party access: Footage should only be disclosed to law enforcement or other third parties where there is a legal basis (e.g., court order, crime prevention)
Guidance: ICO Video Surveillance Guidance (UK GDPR / DPA 2018) — the applicable framework for retailers

1

Sunday trading hours correct

Large shops (over 280 sq m) trading within permitted 6 continuous hours between 10am-6pm (England and Wales — Scotland has no restrictions; NI large shops 1pm-6pm). Small shops confirmed exempt.
2

Staff Sunday opt-out rights respected

Opted-out workers not scheduled for Sundays. Written opt-out notices retained.

Sunday trading hours restrictions

Legal limits on Sunday opening hours for retail - varies by UK nation

Sunday trading hours are restricted for large retail stores in England, Wales, and Northern Ireland, but not in Scotland. These restrictions do not apply to small shops.

Scotland: No restrictions - stores can open any hours
England & Wales: 6 continuous hours between 10am and 6pm for large stores
Northern Ireland: 5 hours between 1pm and 6pm for large stores
Small stores (all UK): No restrictions on stores under 280 sq metres

What counts as a 'large store': A shop with a relevant floor area exceeding 280 square metres (approximately 3,000 square feet). This is the sales area, not including warehouses or stock rooms.

Legal basis:

England & Wales: Sunday Trading Act 1994
Northern Ireland: Shops (Sunday Trading &c.) (Northern Ireland) Order 1997
Scotland: No Sunday trading restrictions (never had restrictions on shop opening hours)

Penalties: In England and Wales, local authorities can fine retailers up to £50,000 for breaching Sunday trading laws. In Northern Ireland, criminal prosecution is possible.

Official source: gov.uk/sunday-trading-rules

1

Fire risk assessment reviewed within last 12 months

Documented assessment by competent person. Updated after any premises changes.
2

Fire drills conducted

At least one fire drill completed in the last 12 months. All staff participated or received briefing.
3

Fire detection tested weekly

Manual call point test recorded in fire safety logbook. Annual professional service completed.

Fire safety for retail premises

Fire safety duties for retail premises including responsible person obligations, fire risk assessment, means of escape, detection systems, staff training, and retail-specific fire risks under the Regulatory Reform (Fire Safety) Order 2005.

The responsible person (usually the employer or premises manager) must comply with fire safety legislation. In England and Wales this is the Regulatory Reform (Fire Safety) Order 2005; in Scotland, the Fire (Scotland) Act 2005; and in Northern Ireland, the Fire and Rescue Services (Northern Ireland) Order 2006.

Fire risk assessment: Must be carried out by a competent person; must be recorded if you have 5 or more employees; must be reviewed regularly and after any significant changes to the premises or use
Means of escape: Ensure adequate escape routes and exits; fire exits must never be locked, blocked, or obstructed during trading hours; doors should open in the direction of escape where the number of people or level of risk requires it
Fire detection and alarm: Install and maintain appropriate fire detection and alarm systems; must be tested weekly (manual call point test) and professionally serviced at least annually
Fire doors: Must be self-closing, properly maintained, and never wedged or propped open; check regularly in line with your fire risk assessment
Staff training: All staff must receive fire safety training on induction and at regular intervals; training must cover alarm activation, evacuation procedure, assembly points, and fire extinguisher use
Fire safety plan: Display clear evacuation notices; maintain a fire safety logbook recording tests, drills, maintenance, and training
Emergency lighting: Required in escape routes; must activate automatically on mains failure; test monthly and full duration test annually
Fire extinguishers: Appropriate type and number for premises risk; maintain and service annually by competent person; staff trained in use

Retail-specific fire risks

Retail premises must assess and mitigate these sector-specific hazards:

Stockrooms: Combustible packaging, overloaded shelving, blocked escape routes
Fitting rooms: May be concealed from main floor; ensure detection coverage and clear escape routes
Cooking/food preparation areas: Grease build-up, naked flames, extraction system maintenance
Flammable displays and decorations: Seasonal displays (especially Christmas) using flammable materials; keep clear of heat sources and escape routes
Electrical equipment: Overloaded sockets, portable heaters, faulty wiring, PAT testing
Customer density: Occupancy limits must be set based on means of escape capacity
Shopping centre shared areas: Coordinate fire safety with centre management; shared evacuation procedures

England and Wales legislation: Regulatory Reform (Fire Safety) Order 2005 (SI 2005/1541)
Fire Safety (England) Regulations 2022: SI 2022/547 applies to multi-occupied residential buildings (quarterly communal fire door checks, information for residents) — relevant to a shop only where it forms part of such a building
Scotland legislation: Fire (Scotland) Act 2005 (asp 5); enforced by Scottish Fire and Rescue Service
Northern Ireland legislation: Fire and Rescue Services (Northern Ireland) Order 2006 (SI 2006/1254); enforced by Northern Ireland Fire and Rescue Service
Penalty for non-compliance: Criminal offence; unlimited fine and/or up to 2 years' imprisonment on conviction on indictment (Article 32, Fire Safety Order 2005)

1

Workplace risk assessments current

General risk assessment, lone working assessment, and manual handling assessment reviewed within last 12 months.
2

Lone working procedures in place

Check-in procedures, panic alarms, and safe cash-handling policies documented and communicated to staff.
3

First aid provision adequate

Appointed person or trained first aider in place. First aid kit stocked and accessible.

Retail worker safety obligations

Retail-specific health and safety obligations covering lone working, violence prevention, manual handling in stockrooms, DSE for checkout workers, first aid, and shoplifting incident procedures.

Retail employers must comply with the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999. Retail workplaces present specific risks that must be assessed and controlled.

Lone working: Conduct a specific risk assessment for staff working alone (e.g., early morning, late night, small shops); implement check-in procedures, panic alarms, and safe cash-handling policies (HSE guidance INDG73)
Violence and aggression prevention: Assess risk of work-related violence; provide conflict resolution training, reporting procedures, and post-incident support; do not require staff to physically confront shoplifters
Sexual harassment prevention: Anticipatory duty under Worker Protection (Amendment of Equality Act 2010) Act 2023 (from 26 October 2024); must take reasonable steps to prevent harassment including from customers and third parties
Manual handling (stockroom): Risk assessment under Manual Handling Operations Regulations 1992; provide training, mechanical aids, and safe systems of work for lifting, carrying, and stacking stock
Display screen equipment (DSE): Health and Safety (Display Screen Equipment) Regulations 1992 apply to checkout/till operators who use screens habitually; provide workstation assessments, adjustable seating, and eye tests on request
First aid provision: Health and Safety (First-Aid) Regulations 1981; at least one appointed person and a first aid kit; larger stores may need trained first aiders based on risk assessment
Shoplifting incidents - staff safety: Staff should observe and note descriptions, secure evidence where safe to do, and contact police; employers must not require physical restraint by untrained staff
Slips, trips, and falls: Leading cause of retail workplace injury; maintain clear aisles, clean spillages immediately, ensure adequate lighting, and use appropriate floor surfaces

Key risk factors in retail: Cash handling, customer-facing roles, working alone or at night, heavy or awkward stock, repetitive checkout operations, seasonal peaks with temporary staff who may lack training.

Enforcement: Health and Safety Executive (HSE) and local authority environmental health officers. In Northern Ireland, the Health and Safety Executive for Northern Ireland (HSENI) enforces workplace health and safety.

1

Carrier bag charge applied correctly

Minimum 10p charge on single-use carrier bags (England). Exempt bags identified.
2

Waste streams separated

Dry recyclables, food waste, and general waste collected separately (workplaces with 10+ full-time-equivalent employees from 31 March 2025; micro-firms by 31 March 2027).

Specialist retail activities

Answer only the items for activities you carry on. Each routes to a dedicated guide with the detail.

1

Food retailing — registration, hygiene and licensing current

Food business registered with the local authority (at least 28 days before trading), hygiene rating displayed where required, allergen labelling in place; premises licence and designated premises supervisor in place if you sell alcohol. See "Which retail rules apply to your business" for the food and alcohol guidance.
2

Fuel retailing — petroleum storage certificate in place

If you store petrol, your petroleum storage certificate conditions are met and forecourt safety procedures are current. See "Run a petrol station or forecourt".
3

Pharmacy or optical retail — registrations current

Pharmacy premises registered (GPhC in Great Britain; Pharmaceutical Society of Northern Ireland in NI) with a responsible pharmacist in charge; optical business registrations in place. See "Run a retail pharmacy or optical business".
4

Firearms dealing — police registration and certificate checks

Firearms dealer registration current (3-year renewal), transaction register maintained, buyer certificates verified — including Scottish air weapon certificates. See "Sell firearms, shotguns and air weapons".
5

Market or street trading — consents held for every pitch

Street trading consent or licence held from each local authority where you trade; food business registration in place if you sell food. See "Specialist retail licences and registrations".
6

Online and distance sales — pre-contract information and cooling-off honoured

14-day cooling-off, refund deadlines and website information requirements met. See "Distance selling and e-commerce".

If you answered "no" to any item, address it promptly. Many of these areas carry criminal penalties for non-compliance including unlimited fines, prosecution, and in some cases imprisonment. See the individual compliance guides for detailed guidance on each area.

Related detailed guides

Consumer rights and returns (opens in a new tab)
Full guide to consumer rights obligations
Price marking for retailers (opens in a new tab)
Price display requirements in detail
Age-restricted products (opens in a new tab)
Age verification and due diligence
Sunday trading rules (opens in a new tab)
Trading hours and exemptions
Which retail rules apply to your business (opens in a new tab)
Route to the right guidance by what you sell
Run a compliant retail business (opens in a new tab)
The universal duties every retailer shares
Trading hours for retailers (opens in a new tab)
GOV.UK guidance on Sunday trading
Accepting returns and giving refunds (opens in a new tab)
GOV.UK guidance on consumer returns

Related guides in Health & Safety

Returns policy displayed and compliant

Staff trained on consumer rights

All prices include VAT and are clearly displayed

Promotional pricing is genuine

Unit pricing displayed where required

Challenge 25 policy in place

Refusals log maintained

Staff training records current

ICO data protection fee paid

Privacy notice current and published

CCTV signage in place

Sunday trading hours correct

Staff Sunday opt-out rights respected

Fire risk assessment reviewed within last 12 months

Fire drills conducted

Fire detection tested weekly

Workplace risk assessments current

Lone working procedures in place

First aid provision adequate

Carrier bag charge applied correctly

Waste streams separated

Specialist retail activities

Food retailing — registration, hygiene and licensing current

Fuel retailing — petroleum storage certificate in place

Pharmacy or optical retail — registrations current

Firearms dealing — police registration and certificate checks

Market or street trading — consents held for every pitch

Online and distance sales — pre-contract information and cooling-off honoured

Related detailed guides