Journey
Set up an IT and programming business
Learning path for new IT, programming and consultancy businesses. Work out which rules apply, set up a safe business with your health and safety, fire safety, insurance, equality, data protection and NIS duties in place, and verify everything with a compliance checklist.
What this journey is for
Running an IT, programming or consultancy business means employing people who spend long hours at screens, often working remotely or across client sites. You carry the workplace health and safety duties every employer shares, with display screen equipment, mental health and lone working as the particular risks. On top of that, you handle personal data routinely — often as a processor on behalf of clients. If you provide a relevant digital service above the NIS threshold, you must comply with the Network and Information Systems Regulations 2018. This journey walks you through that path in the order you will live it, from working out which rules apply through to checking you have everything in place.
It does not give you the step-by-step instructions or the figures — those live in the guides it points to. This map shows you where you are, why each stage matters, and which guide to open next.
-
Work out which regulations apply to you
Start by getting the picture right. An IT consultancy that processes personal data on behalf of clients carries heavier data protection duties than one that does not. A cloud computing provider above the NIS threshold carries network security duties that a bespoke software house does not. Working this out first tells you whether the NIS regime applies to what you provide. Use the router guide to find your position before you commit.
Which IT and programming regulations apply to your business
Work out which rules apply to what you do. A reference guide that routes you from the shared workplace-safety foundation to the data protection and NIS duties.
-
Set up your safe-business foundations
Whatever services you provide, this is the universal spine. Risk-assess display screen equipment workstations and manage stress and mental health risks under the Health and Safety at Work etc. Act 1974. Carry out your fire risk assessment, hold employers' liability insurance and meet your equality duties. Handle personal data lawfully under the UK GDPR and Data Protection Act 2018. If you provide a relevant digital service above the NIS threshold, put your network and information systems security measures in place. Build this in from the start rather than retrofitting it.
Set up and run a safe IT and programming business
The duties every employer shares — general health and safety, fire safety, employers' liability insurance, equality, data protection — plus the NIS digital service provider regime if it applies to you.
-
Verify you have covered everything
Once things are underway, review everything to confirm it holds together. A compliance checklist lets you confirm, in one place, that each obligation is genuinely met rather than assumed. That covers workplace, employment, data protection and NIS. Use it as your readiness review before you take on clients, and come back to it as your services change.
IT and programming business: compliance checklist
Verify you have covered everything — the universal workplace and employment duties, data protection processor obligations, and NIS digital service provider duties.
You will also need the general business set-up duties
Alongside the sector-specific path above, every business carries general obligations that are not unique to IT but are just as compulsory. As you build the business you will also need to:
- protect the people who work for you — meet your workplace health and safety duties, including the display screen equipment assessments that bite hard in office and remote-working environments.
- hold employers' liability insurance once you take anyone on.
- handle personal data lawfully — most businesses must complete data protection registration with the ICO, and as an IT business you may also be a data processor.
- meet your fire safety duties for the premises you work from.
These general duties run in parallel with the sector path rather than after it, so set them up as you establish the business. The spine and the compliance checklist bring the core duties together so you can confirm they are covered.
Where this leaves you
You now have the shape of the whole task. Work out which rules apply. Set up a safe business with your health and safety, data protection and NIS duties in place. Verify the lot. Work the guides in order and you will have a clear, defensible position from your first client engagement onwards.