HR policy management: which policies are legally required
Not all HR policies are legally required — some are good practice, some are contractually important, and some are actually mandated by statute. Knowing which is which helps HR teams prioritise their policy work, particularly in organisations that are growing and building their HR function from scratch.
Policies that are legally required
Health and safety policy — all employers with five or more employees must have a written health and safety policy setting out general arrangements and responsibilities. Under the Health and Safety at Work Act 1974.
Disciplinary and grievance procedures — the Employment Act 2002 and ACAS Code require employers to have written disciplinary and grievance procedures. Failure to follow the ACAS Code does not make a dismissal automatically unfair, but tribunals can adjust compensation by up to 25% where the Code is not followed.
Equality policy — while not explicitly named in statute as a stand-alone requirement, the Equality Act 2010 requires employers to prevent and address discrimination. Having a written equality policy demonstrates the commitment required. Large employers (250+ employees) must publish gender pay gap data, which effectively requires supporting policies.
Anti-harassment policy — from ERA 2025, the duty to prevent sexual harassment is proactive. ACAS guidance is clear that having a written policy is one of the "reasonable steps" required. For most employers, this policy is now effectively required.
Data protection policy — under UK GDPR, employers must demonstrate that personal data (including employee data) is processed lawfully. A written policy documenting the legal basis, retention periods, and data subject rights is evidence of compliance.
Whistleblowing policy — for regulated employers and all public sector organisations, a whistleblowing policy is required. For private sector employers generally, it is strongly recommended: employees who raise public interest concerns are protected from detriment, and demonstrating you take the right seriously reduces exposure.
Tipping policy — from ERA 2025, any business that receives tips must have a written tipping policy accessible to all workers.
Policies that are strongly recommended (not strictly required)
Flexible working policy — required to be clear given the day one flexible working right under ERA 2025. Remote working and hybrid working policies — practically required for hybrid workforces. Sickness absence policy — must be clear about notification, fit notes, and SSP. Parental leave policy — all types: maternity, paternity, shared parental, neonatal, adoption. Social media policy — reduces risk of conduct issues. Expenses policy — required for tax purposes if expenses are reimbursed.
For policies to be effective, they must be accessible. Stored in a staff handbook that no one reads, they offer limited protection. Published on a system that employees actively use, acknowledged by signature or digital confirmation, they are far more valuable evidence of culture and compliance.
See our ERA 2025 compliance checklist for which ERA 2025 changes require new or updated policies, and GDPR for employers for the data protection policies specifically.
Mellow's policy hub stores, distributes, and tracks acknowledgement of every policy across your workforce. [Start a free trial →](https://mellowhr.com/register)