Technology & Digital UK-wide

Which IT and programming regulations apply to your business

Computer programming, consultancy and IT service businesses share workplace-safety duties with every employer, then carry data protection duties that bite harder given the volume of personal data you handle, and — if you provide a relevant digital service above the NIS threshold — network and information systems security duties.

Guide summary

You must follow workplace health and safety law (HASAWA 1974) for all employees, protect personal data carefully, and check if you provide a digital service above the NIS threshold. If you do, comply with the Network and Information Systems Regulations 2018. Use the compliance checklist for IT and programming businesses to confirm you have covered everything.

  • Follow health and safety law (HASAWA 1974) for all employees
  • Manage risks from display screen equipment, mental health, and lone working
  • Protect personal data – your duties are stricter because you process client data
  • Check if you provide an online marketplace, search engine, or cloud above NIS threshold
  • Follow NIS Regulations 2018 if you are above the NIS threshold
  • Use the compliance checklist for IT and programming businesses
  • Consider the Online Safety Act 2023 if users interact on your platform
  • Check IR35 rules if you work through a personal service company
  • Penalties for health and safety breaches: unlimited fines, up to 2 years prison
On this page

Related guides in Digital & Technology

Structural works compliance checklist

Pre-start checklist for structural works covering demolition notices, asbestos surveys, temporary works design, excavation permits, LOLER examinations, and …

Excavation and foundation safety

HSE requirements for safe excavation and foundation work on construction sites. Covers trench support systems, edge protection, safe …

Running a computer programming, consultancy or IT services business means employing people at desks, screens and in data centres. The workplace health and safety duties under the Health and Safety at Work etc. Act 1974 apply — with display screen equipment, mental health and lone working the particular risks in this sector. The Health and Safety Executive (HSE) regulates in Great Britain and HSENI in Northern Ireland.

You also carry data protection duties that bite harder than in most sectors, because you routinely process personal data on behalf of clients. And if you provide an online marketplace, online search engine or cloud computing service above the NIS threshold, you must comply with the Network and Information Systems Regulations 2018.

What you need to do

  1. 1

    Set up a safe business and employ people

    Start with the universal spine. Follow "Set up and run a safe IT and programming business" for your health and safety, fire safety, employers' liability insurance, equality, data protection and — if it applies — NIS digital service provider duties.

  2. 2

    Confirm you have covered everything

    Finish with the IT and programming business: compliance checklist to confirm your obligations are met.

Other rules that may apply to you

If you run an online service where users interact — a platform, app, marketplace, forum or search service — you may also have duties under the Online Safety Act 2023, regulated by Ofcom.

If you work through your own limited company (a personal service company), check the off-payroll working (IR35) rules, which decide whether you are taxed as an employee for a given engagement — see GOV.UK: understanding off-payroll working (IR35).

Official sources

Authoritative starting points for IT and programming businesses.