Running an office administrative, call centre, debt collection, credit reference or other business support operation means complying with FCA authorisation requirements if you carry on credit-related regulated activities, meeting the Ofcom and ICO rules on outbound call centre conduct and electronic marketing, and following consumer protection rules. On top of that, every business that employs people must meet workplace health and safety, fire safety, employers' liability insurance, equality and data protection obligations.

The FCA regulates consumer credit activities UK-wide. Ofcom enforces the silent and abandoned call rules under the Communications Act 2003 UK-wide. The ICO enforces the Privacy and Electronic Communications Regulations (PECR) and UK GDPR UK-wide. Workplace health and safety is enforced by HSE in Great Britain and HSENI in Northern Ireland.

Health and Safety at Work etc. Act 1974 (HASAWA)

The Health and Safety at Work etc. Act 1974 - primary UK workplace health and safety legislation establishing employer and employee duties. Pure data reference.

The Health and Safety at Work etc. Act 1974 (HASAWA 1974) is the primary legislation governing workplace health and safety in the United Kingdom. It establishes the legal framework for protecting the health, safety and welfare of people at work and those affected by work activities.

Legal status: Primary legislation - principal UK health and safety statute
Royal Assent: 31 July 1974
Came into force: 1 April 1975 (in stages)
Geographic scope: Great Britain (separate legislation applies in Northern Ireland)
Applies to: All employers, employees, self-employed persons, and those who control work premises
Primary duty (Section 2): Employers must ensure, so far as is reasonably practicable, the health, safety and welfare at work of all employees
Duty to non-employees (Section 3): Employers must protect persons not in their employment (contractors, visitors, public) who may be affected by work activities
Employee duties (Sections 7-8): Employees must take reasonable care for their own health and safety and that of others, cooperate with employers, and not misuse safety equipment
Enforcement authority: Health and Safety Executive (HSE) and local authorities
Maximum penalties (post-2008 amendments): Unlimited fines in Crown Court; imprisonment up to 2 years for individuals; up to 12 months and/or an unlimited fine in Magistrates' Court in England and Wales (12-month custody powers from 18 November 2024; fines unlimited since March 2015 under LASPO 2012, s.85)
Referenced by regulators: Cited in 31 regulatory documents in the ORDS (Office for Regulatory Delivery and Simplification) dataset
Secondary regulations: Enables creation of health and safety regulations (e.g. Management of Health and Safety at Work Regulations 1999, COSHH, Manual Handling)

Reasonably practicable: The Act uses the term "so far as is reasonably practicable" throughout. This means employers must balance the level of risk against the time, trouble and cost of controlling it. However, the law is weighted in favour of health and safety - employers must demonstrate that control measures would be grossly disproportionate to the risk before they can be considered not reasonably practicable.

Self-employed persons: The Act also places duties on self-employed persons to protect their own health and safety and that of others who may be affected by their work activities.

Health and Safety at Work etc. Act 1974 (legislation.gov.uk) (opens in a new tab)

HSE - Health and Safety at Work etc. Act 1974 guidance (opens in a new tab)

What you need to do

Identify the description that best fits your business, then follow the guides in order.

Every office and business support operation

Start with the universal workplace duties. Follow "Set up and run a safe office or business support operation" for your health and safety, fire safety, employers' liability insurance, equality and data protection obligations.
You carry on credit-related regulated activities, run outbound call centres, or send electronic marketing

You must hold FCA authorisation if you collect debts, administer credit or provide credit references; follow the Ofcom rules on silent and abandoned calls if you run an outbound call centre; and comply with PECR if you send electronic marketing. Follow "Meet your office and business support regulatory duties".
Confirm you have covered everything

Work through "Office and business support compliance checklist" to confirm your obligations are met.

Legal basis

Primary legislation and key regulations

Data Protection Act 2018 Primary 2018 · UK-wide Communications Act 2003 Primary 2003 · UK-wide Financial Services and Markets Act 2000 Primary 2000 · UK-wide Consumer Credit Act 1974 Primary 1974 · UK-wide Health and Safety at Work Act 1974 Primary 1974 · UK-wide Privacy and Electronic Communications Regulations 2003 SI 2003 · UK-wide

Browse UK legislation legislation.gov.uk

Official guidance

FCA: consumer credit firms (opens in a new tab)

FCA

Ofcom: tackling abandoned and silent calls (opens in a new tab)

Ofcom

ICO: direct marketing and PECR (opens in a new tab)

ICO

FCA: consumer credit authorisation (opens in a new tab)

FCA

The case for privacy (opens in a new tab)

ICO

What are PECR? (opens in a new tab)

ICO

Data protection self assessment - medium businesses (opens in a new tab)

ICO

Which office and business support regulations apply to your business

What you need to do

Every office and business support operation

You carry on credit-related regulated activities, run outbound call centres, or send electronic marketing

Confirm you have covered everything

Legal basis

Official guidance

Related guides in Compliance & Legal

Office and business support compliance checklist

Fire safety duties for Northern Ireland businesses

Fire safety duties for Scottish businesses

Set up a limited company

Persons with Significant Control (PSC) register requirements