Brexit didn’t rip up the rulebook for UK employers. It just made the rulebook harder to follow from a distance.
Most of the core regulations you knew in 2019 are still there. But they’re moving. Slowly, par morceaux, avec des différences qui vont poser problème à ceux qui ne regardent pas le tableau d’affichage.
If you’re an employer in the UK right now, “workplace compliance” is a bit like strength training: you can get away with winging it for a while, but when the load gets heavy – audit, inspection, claim, serious accident – every gap is exposed.
Let’s turn this into something simple, concret, actionnable. No jargon. No fear‑mongering. Just a clear picture of what’s changed, what hasn’t, and what you should actually do in the next 90 days.
What actually changed after Brexit (and what didn’t)
Before Brexit, most UK workplace rules came from EU law: health and safety, working time, data protection, environmental rules, etc. We copied a lot of it into UK regulations.
After Brexit, two key things happened:
- The UK kept most existing EU‑derived rules, re‑badged as “retained EU law”.
- The government gained more power to change or remove these rules over time.
So for now:
- Health and Safety: The Health and Safety at Work etc. Act 1974 and key regulations (like the Management Regs, COSHH, PUWER, Manual Handling, etc.) are still in force. The HSE still expects you to assess risks, train people and keep records.
- Working Time: 48‑hour week, rest breaks, night work limits, paid holiday – still there, but some details on recording hours and holiday pay are evolving.
- Data protection: We now have UK GDPR + Data Protection Act 2018. Very similar to EU GDPR, but with UK‑specific guidance and enforcement through the ICO.
- Environmental rules: Largely preserved, but now diverging slowly: new UK schemes, different reporting demands, and sector‑specific tweaks.
The real change is not “big bang, everything different”. It’s gradual divergence plus more scrutiny on whether you’re actually doing what your policies say.
And that’s where a lot of employers are already offside.
The four pillars of workplace compliance you can’t ignore
If you strip away the legal names, post‑Brexit workplace compliance for UK employers sits on four pillars:
- Health & Safety – people don’t get hurt or made ill at work; you can prove you took “reasonably practicable” steps.
- Employment & working time – fair contracts, correct hours, holidays and pay; no systematic fatigue or exploitation.
- Data & information – you handle personal and sensitive data lawfully, securely and transparently.
- Environment & sustainability – you manage waste, emissions and resources in line with current UK rules and permits.
Every regulation you hear about is just a more detailed version of one of these four.
So instead of trying to memorise laws, build systems around these pillars:
- Clear responsibilities – who owns what (by role, not by name).
- Simple procedures – written, short, findable, used in real life.
- Regular training – short, frequent, job‑specific, not just e‑learning spam.
- Evidence – sign‑in sheets, training records, risk assessments, audits, maintenance logs.
Think of it like your training programme. The law is the “rulebook”. Your compliance system is the “training plan”. Inspections and claims are “game day”.
Where UK employers are slipping up right now
On the ground, here are the mistakes I see most often when I go into workplaces – from gyms and leisure centres to warehouses, offices and construction sites.
1. Health & safety paperwork frozen in 2018
Typical pattern:
- Risk assessments last updated pre‑Brexit.
- New equipment / processes added with no formal review.
- “Near misses” not recorded, so trends are invisible.
- Induction training done once, never refreshed.
If the HSE walks in tomorrow and your manual handling assessment mentions kit you got rid of three years ago, you’re signalling you manage risk on autopilot. That’s hard to defend if something serious happens.
2. Working time and fatigue quietly ignored
In sport, when players are constantly tired, performance drops and injuries spike. Same thing at work.
Common red flags:
- Staff regularly over 48 hours a week with no opt‑out records.
- Training sessions, travel or “voluntary” events not counted as working time.
- Night workers without proper health assessments.
- Holiday requests always “pushed back” because of workload.
Post‑Brexit, the government has tweaked some recording requirements, but if you can’t show a clear picture of hours and rest, you’re exposed. Tribunals still look at fatigue and working time very closely.
3. Data protection treated as an IT problem
Most breaches are not hackers. They’re humans:
- Emails to the wrong person.
- Printed lists left on the desk.
- Access shared “just for now”.
- Fitness or medical data used beyond what people agreed to.
Post‑Brexit, UK GDPR is still strict, and the ICO is not shy about fines. But more than that, clients and staff lose trust quickly when personal data is handled carelessly.
4. Environmental duties misunderstood or minimised
For many SMEs, “environmental compliance” is reduced to “we recycle a bit”. In reality, you may have:
- Waste carrier obligations.
- Storage rules for chemicals or fuel.
- Reporting duties for energy use and emissions (especially for larger organisations).
- Local permit conditions (noise, odour, discharge).
Brexit hasn’t cancelled this. In some sectors, it’s tightened. Inspections are increasingly looking at whether your staff actually know what to do with waste, spills and incidents – not just what your policy says.
A simple 90‑day compliance action plan
Let’s treat this like a focused training block. 90 days. Clear sessions. Measurable outcomes.
Goal: Move from “we think we’re compliant” to “we can show we’re compliant” in the four pillars.
Week 1–2: Quick audit – no excuses
Block out 2 × 90‑minute slots with your key people (HR, H&S, line managers, maybe IT / facilities). For each pillar, answer three questions:
- What do we actually do now? (Processes, habits, unwritten rules.)
- What’s written down? (Policies, procedures, risk assessments, contracts.)
- What can we prove? (Training records, logs, signatures, checklists, reports.)
Score each pillar from 1 to 5:
- 1 = We’d be in trouble in an inspection.
- 3 = Basics in place but patchy or outdated.
- 5 = Up to date, used in practice, evidence easy to find.
Write the scores down. No optimism bias. If you don’t know, it’s a 2.
Week 3–4: Fix the obvious red flags
Prioritise the areas where risk is high and effort is low. For example:
- Update three key risk assessments (e.g. manual handling, lone working, use of specific machines).
- Check working time records for the last 3 months; identify staff regularly over 48 hours.
- Review who has access to sensitive data; remove or adjust any “just in case” access.
- Confirm your waste carriers are licensed and your consignment notes are up to date.
Set clear targets:
- “By the end of week 4, we will have updated X, Y, Z document, and briefed all supervisors.”
- “By the end of week 4, all staff working nights will be offered health assessments.”
This isn’t the time for perfect. Aim for “good enough and real”, not “beautiful policy that nobody uses”.
Week 5–8: Turn policies into training
Now we move from paper to practice. Treat training like you’d coach a new exercise:
- Short sessions (20–40 minutes).
- Focused on one or two behaviours.
- Simple language and clear examples from your own workplace.
- A quick check at the end (question, demo or short quiz).
- Record who attended, date, content covered.
For example:
- Health & Safety toolbox talk: “How we lift and move safely in this warehouse / gym / site”. Show correct technique with your actual kit. Set a rule: “If it’s over X kg, we do Y.”
- Working time brief: “How we manage fatigue here.” Explain rest breaks, opt‑outs, how to raise concerns.
- Data protection micro‑session: “The 3 things you must never do with client or staff data here.” Keep it tight and specific.
- Environmental drill: “What to do if there’s a spill.” Walk through the steps, show where the materials are, and get staff to practice.
Build a simple log (spreadsheet or LMS) with:
- Names.
- Date.
- Topic.
- Trainer.
- Outcome (completed / not completed).
That log is your scoreboard.
Week 9–12: Test, adjust, then lock in
In sport, we test at the end of a training block. Same here. Sample a few areas:
- Ask 5 random employees: “What would you do if <scenario> happened?” (e.g. slip, data request, waste mix‑up.)
- Spot‑check two or three processes against the written procedure. Are they aligned?
- Review incident, near miss and sickness records for the last 3 months. Any patterns?
Where there’s a gap between what’s written and what’s done, you have three options:
- Simplify the procedure so it fits reality.
- Re‑train and coach behaviour.
- Change the environment (signage, layout, equipment) so the right action is easier.
Then, decide on your “maintenance plan”:
- Update key risk assessments at least annually or after any significant change.
- Run short refresher training every 6–12 months on key risks.
- Review working time and holiday patterns quarterly.
- Audit data access and environmental controls at least once a year.
How to turn legal duties into effective training sessions
Most employers lose the game at the “training” stage. They confuse “we showed a slide once” with “people know what to do under pressure”.
Think like a coach:
1. Start from the risk, not the regulation
Example in a fitness facility or warehouse:
- Risk: back injuries from poor lifting technique.
- Law: Manual Handling Operations Regulations + duty of care.
- Training: 30 minutes on safe lifting, using the real objects people handle, with clear rules:
- “If it’s over 20 kg and awkward shape, you must ask for help or use equipment.”
- “All lifting belts and aids are checked weekly using this checklist.”
2. Make it measurable
Don’t just say “we train staff”. Define:
- Frequency (e.g. induction + annual refresher).
- Minimum duration.
- Pass criteria (questionnaire, demo, scenario).
- Re‑test period after incidents.
For example:
- “All new starters receive a 45‑minute H&S induction on day 1 and must score at least 80% on the quiz.”
- “Any team involved in a manual handling incident attends a refresher within 7 days.”
3. Use blended methods
A mix works best:
- Online modules for background (law basics, concepts).
- Face‑to‑face practicals for behaviour (lifting, emergency drills, PPE, spill response).
- Micro‑learning (5–10 minute refreshers, toolbox talks).
This is exactly where structured online courses (like health & safety, environmental management or data protection modules) can support you – especially for consistency and record‑keeping. Then you add your real‑world, workplace‑specific layer on top.
Keeping up with post‑Brexit changes without drowning
You don’t need to read every piece of legislation. You do need a simple system to stay current.
Step 1: Nominate a compliance “captain”
Not necessarily a lawyer. Someone organised, with authority to chase others. Their job:
- Track updates in your key areas.
- Schedule annual reviews.
- Coordinate training with line managers.
- Maintain the evidence log.
Step 2: Subscribe to the right updates
At minimum:
- HSE bulletins (for health & safety).
- ICO updates (for data protection).
- Environment Agency or relevant regulator newsletters (for environmental duties).
- Sector body or professional association updates (for industry‑specific rules).
Tell your “captain” to spend 30–60 minutes a month scanning these and flagging anything relevant.
Step 3: Build a simple “change to action” pipeline
When a change pops up, don’t panic. Run it through this filter:
- Does it affect what we do? (Yes / No.)
- If yes, does it affect:
- Our written documents?
- Our day‑to‑day practices?
- Our training content?
Then set a deadline and owner for each action. Example:
- “Working time guidance updated – HR to review contracts and holiday process by <date>.”
- “New HSE note on specific equipment – H&S lead to update risk assessment and run toolbox talk by <date>.”
That’s it. No drama, just a steady update cycle.
Why this matters beyond “avoiding fines”
Compliance often gets sold as “do this or you’ll be punished”. That’s like telling a player “train or you’ll sit on the bench”. It works for a week, then everyone stops caring.
Here’s a better way to look at it:
- Health & Safety done well reduces injuries, absence and churn. That saves money and keeps experience on your side.
- Good working time management means less burnout, better performance and more stable teams.
- Strong data protection builds trust with clients and staff – especially when you handle health, performance or personal data.
- Serious environmental management increasingly influences tenders, partnerships and brand reputation.
Post‑Brexit, the employers who will struggle are the ones who see compliance as a dusty folder. The ones who’ll thrive are those who treat it like a continuous coaching process:
- Clear standards.
- Simple, repeated training.
- Honest feedback.
- Regular adjustments.
Pick one pillar today – the one you scored worst earlier – and schedule that first 90‑minute audit session. Not next month. This week.
Like any good training block, the hardest part is starting. After that, it’s just reps.