A. Health and safety at work

HASWA requires you to ensure, so far as is reasonably practicable, the health, safety and welfare of your employees and anyone else affected by your work — clients, visitors and passers-by. You must carry out a suitable and sufficient risk assessment, and if you employ five or more people you must record it in writing.

Health and Safety at Work etc. Act 1974 (HASAWA)

The Health and Safety at Work etc. Act 1974 - primary UK workplace health and safety legislation establishing employer and employee duties. Pure data reference.

The Health and Safety at Work etc. Act 1974 (HASAWA 1974) is the primary legislation governing workplace health and safety in the United Kingdom. It establishes the legal framework for protecting the health, safety and welfare of people at work and those affected by work activities.

Legal status: Primary legislation - principal UK health and safety statute
Royal Assent: 31 July 1974
Came into force: 1 April 1975 (in stages)
Geographic scope: Great Britain (separate legislation applies in Northern Ireland)
Applies to: All employers, employees, self-employed persons, and those who control work premises
Primary duty (Section 2): Employers must ensure, so far as is reasonably practicable, the health, safety and welfare at work of all employees
Duty to non-employees (Section 3): Employers must protect persons not in their employment (contractors, visitors, public) who may be affected by work activities
Employee duties (Sections 7-8): Employees must take reasonable care for their own health and safety and that of others, cooperate with employers, and not misuse safety equipment
Enforcement authority: Health and Safety Executive (HSE) and local authorities
Maximum penalties (post-2008 amendments): Unlimited fines in Crown Court; imprisonment up to 2 years for individuals; up to 6 months and/or £20,000 fine in Magistrates' Court
Referenced by regulators: Cited in 31 regulatory documents in the ORDS (Office for Regulatory Delivery and Simplification) dataset
Secondary regulations: Enables creation of health and safety regulations (e.g. Management of Health and Safety at Work Regulations 1999, COSHH, Manual Handling)

Reasonably practicable: The Act uses the term "so far as is reasonably practicable" throughout. This means employers must balance the level of risk against the time, trouble and cost of controlling it. However, the law is weighted in favour of health and safety - employers must demonstrate that control measures would be grossly disproportionate to the risk before they can be considered not reasonably practicable.

Self-employed persons: The Act also places duties on self-employed persons to protect their own health and safety and that of others who may be affected by their work activities.

Health and Safety at Work etc. Act 1974 (legislation.gov.uk)

HSE - Health and Safety at Work etc. Act 1974 guidance

B. Control of substances hazardous to health (COSHH)

Salon chemicals, hair dyes and bleaches, nail acrylates, dry-cleaning solvents, embalming fluids, spa-pool biocides and cleaning products are all substances hazardous to health. Under the Control of Substances Hazardous to Health Regulations 2002 you must assess the risks, prevent or adequately control exposure, provide information and training, and monitor health where necessary. HSE publishes sector-specific COSHH guidance for hairdressing and beauty salons.

COSHH 2002 - Control of Substances Hazardous to Health

Legal requirements for controlling workplace exposure to hazardous substances under COSHH Regulations 2002.

The Control of Substances Hazardous to Health Regulations 2002 (COSHH) require employers to control exposure to hazardous substances in the workplace to prevent ill health. COSHH applies to most substances hazardous to health, but not asbestos, lead, or radioactive materials which have separate regulations.

Legislation: Control of Substances Hazardous to Health Regulations 2002 (as amended)
Applies to: Chemicals, fumes, dusts, vapours, mists, biological agents (bacteria, viruses)
Who must comply: All employers and self-employed persons whose work exposes people to hazardous substances
Risk assessment requirement: Must complete COSHH risk assessment before work with hazardous substances begins
Hierarchy of control measures: 1. Elimination (remove hazard), 2. Substitution (use safer alternative), 3. Engineering controls (ventilation, enclosure), 4. Administrative controls (procedures, training), 5. Personal protective equipment (PPE - last resort)
Workplace Exposure Limits (WELs): Maximum concentrations of hazardous substances in workplace air - must not exceed these limits
Health surveillance: May be required where risk assessment identifies significant risk to health (e.g., for isocyanates, vinyl chloride, hardwood dust)
Monitoring requirement: Air monitoring required in certain circumstances to ensure exposure limits not exceeded
Information and training: Must provide employees with information about risks and precautions
Review frequency: Review COSHH assessments whenever there is reason to suspect they are no longer valid or significant changes occur
Enforcement: Health and Safety Executive (HSE)
Referenced by: 17 regulatory documents in UK regulatory database

Hierarchy of controls: COSHH requires employers to prevent or adequately control exposure using the hierarchy of controls. Elimination and substitution must always be considered first. PPE should only be used as a last resort or in combination with other measures.

Workplace Exposure Limits: EH40 Workplace Exposure Limits document lists over 500 substances with maximum exposure limits. These are legally binding limits that must not be exceeded.

COSHH guidance (HSE)

EH40 Workplace Exposure Limits

C. Fire safety

The Regulatory Reform (Fire Safety) Order 2005 applies in England and Wales. Scotland has the Fire (Scotland) Act 2005 and the Fire Safety (Scotland) Regulations 2006. Northern Ireland has the Fire and Rescue Services (Northern Ireland) Order 2006 and the Fire Safety Regulations (Northern Ireland) 2010. You are the 'responsible person' for the premises and must carry out a fire risk assessment, maintain escape routes, install fire detection and provide staff training. Salons storing flammable products such as aerosols, acetone and alcohol-based sanitiser must keep quantities controlled and ventilated.

Regulatory Reform (Fire Safety) Order 2005

The 'responsible person' (employer, owner or occupier) must carry out a fire risk assessment for any non-domestic premises and implement appropriate fire safety measures. This applies to all hospitality premises including hotels, restaurants, pubs and nightclubs.

Who is the responsible person?

The responsible person is the employer, owner, landlord, occupier, or anyone with control of the premises. In hospitality, this is typically the business owner or manager.

Fire risk assessment

The responsible person must carry out and regularly review a fire risk assessment covering:

Identification of fire hazards (ignition sources, fuel, oxygen)
Identification of people at risk (employees, customers, vulnerable persons)
Evaluation and reduction of risks
Recording findings and fire safety plan (if 5+ employees)
Regular review and updates

Fire safety measures

Based on the risk assessment, implement appropriate measures including:

Fire detection and warning systems (smoke alarms, fire alarm panels)
Fire-fighting equipment (extinguishers, fire blankets)
Emergency escape routes and lighting
Fire safety signs and notices
Fire doors kept clear and free to close
Staff training on fire procedures
Emergency evacuation plan and drills

Fire Safety Act 2021 (from January 2022)

For buildings containing two or more sets of domestic premises (e.g. hotels, aparthotels), the responsible person must now assess fire risks in external walls, entrance doors to flats, and windows.

Step 1: Appoint a competent person to conduct fire risk assessment (may be yourself if trained)
Step 2: Complete fire risk assessment identifying hazards and persons at risk
Step 3: Implement control measures to reduce fire risk
Step 4: Ensure fire detection systems are installed and maintained
Step 5: Provide adequate fire-fighting equipment (extinguishers) and arrange annual servicing
Step 6: Establish clear evacuation routes with emergency lighting and signage
Step 7: Designate assembly point and ensure staff know evacuation procedures
Step 8: Train all staff on fire safety procedures during induction
Step 9: Conduct regular fire drills (at least annually)
Step 10: Record fire risk assessment findings if you employ 5 or more people
Step 11: Review fire risk assessment annually or after significant changes

Fire safety risk assessment guidance

D. Employers' liability insurance

If you employ anyone — including part-time staff, apprentices and family members — you must hold employers' liability insurance with a minimum cover of £5 million and display the certificate (or make it available electronically). The Employers' Liability (Compulsory Insurance) Act 1969 applies in Great Britain. In Northern Ireland, the equivalent duty is under the Employers' Liability (Defective Equipment and Compulsory Insurance) (Northern Ireland) Order 1972.

Employers' Liability Insurance Requirements

Legally required insurance for businesses that employ staff

Legal requirement: LEGALLY REQUIRED if you employ anyone (even part-time or family members working for you)
Minimum cover: £5 million minimum (most policies provide £10 million)
Penalty for non-compliance: £2,500 fine per day without insurance, plus £1,000 fine for not displaying certificate
What it covers: Compensation claims from employees injured or made ill at work
Exemption: Close family businesses may be exempt

Employers' Liability Insurance

E. Equality

The Equality Act 2010 applies in England, Scotland and Wales. It protects clients, employees and job applicants from discrimination based on nine protected characteristics. In Northern Ireland, the Disability Discrimination Act 1995, the Sex Discrimination (Northern Ireland) Order 1976 and the Fair Employment and Treatment (Northern Ireland) Order 1998 provide equivalent protections enforced by the Equality Commission for Northern Ireland (ECNI).

F. Data protection

If you hold client records — booking details, medical questionnaires, patch-test results, CCTV footage, staff payroll — you process personal data. The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 apply UK-wide. You must register with the Information Commissioner's Office (ICO) unless exempt, identify a lawful basis for each processing activity, keep data secure and respond to subject access requests within one calendar month.

UK GDPR lawful bases for processing personal data

The 6 (now 7) lawful bases under UK GDPR Article 6 for processing personal data.

Under UK GDPR Article 6, you must have a valid lawful basis to process personal data. You cannot process personal data without identifying at least one lawful basis that applies to each processing activity.

1. Consent (Article 6(1)(a)): The individual has given clear, specific, informed consent for you to process their personal data for a specific purpose
2. Contract (Article 6(1)(b)): Processing is necessary to fulfil a contract with the individual, or to take steps at their request before entering a contract
3. Legal obligation (Article 6(1)(c)): Processing is necessary to comply with a common law or statutory obligation under UK law
4. Vital interests (Article 6(1)(d)): Processing is necessary to protect someone's life
5. Public task (Article 6(1)(e)): Processing is necessary for performing a task in the public interest or for official functions that have a clear basis in law
6. Legitimate interests (Article 6(1)(f)): Processing is necessary for your legitimate interests or those of a third party, unless overridden by the individual's interests, rights, or freedoms

Consent requirements: Must be freely given, specific, informed, and unambiguous. Must be as easy to withdraw as to give.

Legitimate interests: Requires a documented Legitimate Interest Assessment (LIA) balancing test. Not available to public authorities for their core tasks.

7. Recognised legitimate interests (NEW - from June 2025): Processing necessary for certain pre-approved purposes without requiring a balancing test (Data Use and Access Act 2025)
Recognised purposes include: National/public security, defence, emergencies, crime prevention/detection, safeguarding vulnerable individuals
Effective date: 19 June 2025

Note: Direct marketing and intra-group data sharing still require a Legitimate Interest Assessment even under recognised legitimate interests.

ICO guide to lawful basis

1

What to do next

If your business dry-cleans with solvents, pierces skin, offers beauty or cosmetic procedures that may need a licence, or operates a spa pool, follow "Meet your personal services regulatory duties" for the registration, permit and licensing duties that apply on top of this universal foundation.

Official sources

Authoritative guidance for personal services workplace duties.

HSE: hairdressing health and safety (opens in a new tab) HSE
HSE: COSHH in hairdressing (opens in a new tab) HSE
Health and Safety at Work etc. Act 1974 (opens in a new tab) legislation.gov.uk
Control of Substances Hazardous to Health Regulations 2002 (opens in a new tab) legislation.gov.uk

Set up and run a safe personal services business

Set up and run a safe mineral products factory

Set up and run a safe veterinary practice

Set up and run a safe metal production plant

Personal services compliance checklist

Scientific research and development: compliance checklist

A. Health and safety at work

B. Control of substances hazardous to health (COSHH)

C. Fire safety

D. Employers' liability insurance

E. Equality

F. Data protection

What to do next

Official sources

Related guides in Compliance & Legal

A. Health and safety at work

B. Control of substances hazardous to health (COSHH)

C. Fire safety

D. Employers' liability insurance

E. Equality

F. Data protection

What to do next

Official sources