Understanding Your Legal Duties as a Small Business Owner

Your duties as a director or owner

When you run a small business in the UK, whether as a sole trader or a limited company, the law treats you as responsible for how it operates. If you are a limited company director, you have specific duties under the Companies Act 2006: to act within the company's constitution, promote its success, exercise independent judgement, and avoid conflicts of interest. Sole traders are personally liable for everything the business does. Understanding these foundations helps you see why the other duties below matter.

You do not need to be a legal expert. But you do need to know where your obligations lie and to put sensible systems in place. This guide walks through the main areas that catch small business owners out, with practical steps to stay on the right side of the rules.

Health and safety: not just for factories

Even if you work from a home office or run a shop with two staff, health and safety law applies. The Health and Safety at Work etc. Act 1974 requires you to protect employees, customers, and anyone else affected by your business. For most small businesses, the first step is a written risk assessment if you have five or more employees. Identify hazards, decide what could go wrong, and record what you will do to reduce the risk.

You must also:

• Have employers' liability insurance as soon as you employ anyone – it is a legal requirement and you can be fined for not having it.
• Display the health and safety law poster or give staff a leaflet.
• Report certain accidents, injuries, and dangerous occurrences under RIDDOR.
• Provide first aid equipment and a trained first aider if your risk assessment says so.

The Health and Safety Executive (HSE) offers free tools for small businesses, including example risk assessments. Do not wait for an incident; a few hours of planning now can prevent a prosecution later.

Data protection: handle personal information with care

If you hold any personal data – customer email addresses, employee records, supplier contact details – you must comply with the UK GDPR and the Data Protection Act 2018. Most businesses need to pay an annual data protection fee to the Information Commissioner's Office (ICO), unless they are exempt. Check the ICO's self-assessment tool to see if you are exempt; many small businesses are not.

Key duties include:

• Having a lawful basis for processing data (consent, contract, legal obligation, etc.).
• Providing a clear privacy notice explaining what you do with people's data.
• Keeping data secure and only retaining it as long as necessary.
• Reporting certain data breaches to the ICO within 72 hours of becoming aware of them.

You also need to respond to individuals who ask for a copy of their data (a subject access request) within one month. A simple data audit – listing what you collect, why, where it is stored, and who can access it – is a practical first step.

Employment law: get the basics right from day one

Taking on your first employee is a big step, and the paperwork matters. You must:

• Check that the person has the right to work in the UK and keep a copy of the evidence.
• Provide a written statement of employment particulars on or before day one.
• Pay at least the National Minimum Wage or National Living Wage.
• Enrol eligible staff into a workplace pension under automatic enrolment rules.
• Give statutory holiday (at least 5.6 weeks per year) and follow rules on rest breaks, sick pay, and family leave.

If you need to dismiss someone, you must follow a fair process, usually involving investigations, warnings, and a right to be accompanied. Acas provides a free code of practice and helpline. Getting employment contracts and policies right from the start saves expensive tribunal claims later.

Tax, record-keeping, and making tax digital

HMRC expects you to keep accurate records of income and expenses. As a sole trader, you report this through self assessment. As a limited company, you file accounts with Companies House and a corporation tax return with HMRC. If your turnover exceeds the VAT threshold (currently £90,000), you must register for VAT. Many businesses also need to operate PAYE for employees.

Making Tax Digital (MTD) for VAT requires digital records and compatible software. MTD for Income Tax is being rolled out, so keep an eye on your start date. Practical habits: separate business and personal bank accounts, keep receipts, and use accounting software. You must keep records for at least six years after the relevant accounting period. Late filing or payment triggers automatic penalties, so diarise your deadlines.

Contracts, insurance, and consumer law

Every business makes contracts, whether written or verbal. Clear written terms and conditions protect you: they set out payment terms, delivery, liability, and what happens if things go wrong. If you sell to consumers, you must comply with the Consumer Rights Act 2015, which implies terms like goods being of satisfactory quality and services being performed with reasonable care. Distance selling and online sales have extra rules on cancellation and delivery.

Insurance is not just a legal requirement for employers' liability; consider public liability, professional indemnity, and product liability. Check what your policy actually covers – many small businesses assume they are protected when they are not. Finally, if you handle client money or need a licence (for example, for food, alcohol, or waste), make sure you have the correct permit before trading.