Compliance training is not a box-ticking exercise: it protects your staff, your customers and your business. Whether you run a care agency, a construction firm or an online shop, you must make sure employees understand the laws and standards that apply to their roles. This guide explains the difference between statutory and mandatory training, sets out your responsibilities as a UK employer, and highlights the core topics every training plan should cover.

What is statutory and mandatory training?

Statutory training is training that an organisation is legally required to provide. It is driven by legislation such as the Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations 1999 and the Equality Act 2010. If the law says staff must be trained, competent or informed, that training is statutory.

Mandatory training is training that an organisation decides is essential for safe and effective operations, even where the law does not explicitly require it. It is usually set out in internal policies, professional codes or contract terms. In practice, the two categories overlap: many statutory topics also appear on a mandatory training list, and both must be completed.

The exact mix depends on your sector. Health and social care employers, for example, typically follow the Skills for Care Core Skills Training Framework or Care Quality Commission expectations, covering manual handling, infection prevention and control, and safeguarding. Food businesses must meet food hygiene requirements under the Food Safety Act 1990 and the Food Hygiene (England) Regulations 2013. Office-based employers still need health and safety, data protection and equality training.

Health and safety

The Health and Safety at Work etc. Act 1974 is the foundation of workplace safety in Great Britain. It places a duty on employers to ensure, so far as is reasonably practicable, the health, safety and welfare of employees and others affected by their work. The Management of Health and Safety at Work Regulations 1999 require employers to assess risks and put in place appropriate control measures, including information and training.

Key areas include:

• Fire safety. The Regulatory Reform (Fire Safety) Order 2005 requires a fire risk assessment, suitable precautions and clear emergency procedures in England and Wales. Similar duties apply in Scotland and Northern Ireland through the Fire (Scotland) Act 2005 and the Fire and Rescue Services (Northern Ireland) Order 2006.
• Hazardous substances. The Control of Substances Hazardous to Health Regulations 2002 (COSHH) require risk assessments, controls and emergency planning for chemicals, dusts, fumes and biological agents.
• Manual handling. The Manual Handling Operations Regulations 1992 require employers to avoid hazardous manual handling where possible and train staff in safer techniques.
• Homeworking and DSE. Employers remain responsible for the health and safety of remote workers, including working from home and display screen equipment assessments.

Keep written records of training and risk assessments; they are your evidence of compliance if an incident occurs. For more on embedding a safety culture, see our guide to owning health and safety at work.

Safeguarding

Safeguarding means protecting children and adults at risk from abuse, neglect or harm. It is central to health and social care, education, childcare, charities and any organisation that works with vulnerable people.

In England, safeguarding children is governed by Working Together to Safeguard Children and the Children Act 2004, while safeguarding adults draws on the Care Act 2014. Scotland, Wales and Northern Ireland have their own frameworks, but the principle is consistent: organisations must have clear policies, trained staff and robust reporting routes. DBS checks, safer recruitment and regular refresher training are standard expectations.

Training should be role-specific. Frontline staff need to recognise signs of abuse and know how to escalate concerns, while managers need to understand their statutory duties and multi-agency procedures.

Data protection

Since Brexit, UK organisations must comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The Information Commissioner’s Office (ICO) enforces the rules and can issue fines of up to £17.5 million or 4% of global annual turnover for the most serious breaches.

Staff training should cover:

• the lawful bases for processing personal data;
• privacy notices, transparency and individuals’ rights;
• data minimisation, accuracy and retention;
• reporting personal data breaches within 72 hours;
• direct marketing rules under the Privacy and Electronic Communications Regulations 2003 (PECR), including consent and opt-outs;
• basic cyber-security awareness to keep data safe from cyber-attacks.

Marketing teams should note that the UK GDPR generally requires a clear, affirmative opt-in for electronic marketing, and individuals must be able to withdraw consent easily. PECR adds extra rules for emails, texts and calls. For full guidance, see GOV.UK data protection.

Equality and diversity

The Equality Act 2010 is the main anti-discrimination law in Great Britain. It protects people with protected characteristics including age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation. Employers must not discriminate, harass or victimise staff, job applicants or service users because of these characteristics.

From October 2024, the Worker Protection (Amendment of Equality Act 2010) Act 2023 introduces a new duty on employers to take reasonable steps to prevent sexual harassment at work. Training is a key part of meeting that duty. Equality and diversity training should also cover unconscious bias, inclusive leadership and how to handle complaints fairly.

Making training work in practice

Good compliance training is relevant, up to date and recorded. Start with a training needs analysis that maps legal requirements and organisational risks to each role. Choose providers carefully: accredited or sector-recognised courses are preferable where competence must be demonstrated. Schedule refresher training at least annually, or sooner if legislation or guidance changes.

Maintain a training matrix or individual records showing who has been trained, on what topic, when, and when renewal is due. This helps you spot gaps, satisfy insurers and regulators, and demonstrate due diligence.

Statutory and mandatory training is an investment in a safer, fairer and more resilient business. Keep it current, keep it specific to your sector, and keep records to prove it.