Compliance checklist · Hospitality

What your website and marketing must show to stay compliant in hospitality

The rules that apply to a UK hospitality business, turned into what your site, ads and social posts must show, or must not say. Each point links to the regulator or the legislation it comes from.

General guidance, not legal advice. Rules change and depend on your circumstances; check the linked source or take advice from a qualified adviser before relying on any point.

Hospitality rules

Food Standards Agency: food hygiene

FSA Food Safety Act 1990

Also covers: EHO inspection routine.

Show your food hygiene rating accurately; displaying it is mandatory in Wales and Northern Ireland and good practice in England.

Source: Food Standards Agency: food hygiene

Food allergen information rules

FSA Allergen Information Regulations 2014

Menus and online ordering must give allergen information for the 14 regulated allergens, or say clearly how customers get it before they order.

Source: Food allergen information rules

Licensing Act 2003

Licensing Act 2003

Alcohol promotions must not encourage irresponsible drinking, and online alcohol sales need age checks.

Source: Licensing Act 2003

Health and Safety at Work etc. Act 1974

Health and Safety at Work Act 1974

Safety claims in marketing ("fully compliant", "zero incidents") must be evidenced; show accreditations only while they are current.

Source: Health and Safety at Work etc. Act 1974

Music licensing (PPL PRS)

PRS PPL music licensing

Music in your premises, videos and social posts needs the right licence; platform libraries do not always cover business use.

Source: Music licensing (PPL PRS)

Equality Act 2010

Equality Act 2010 accessibility

Make the site usable for disabled visitors (keyboard access, alt text, readable contrast) and describe physical access honestly.

Source: Equality Act 2010

UK GDPR and the Data Protection Act 2018

GDPR customer booking data

Publish a privacy notice that names who you are, what you collect on every form, why, how long you keep it and how people use their rights; link it from every form.

Source: UK GDPR and the Data Protection Act 2018

PCI DSS (card payments)

PCI DSS card payments

Take card details only through a compliant payment provider; never ask for card numbers by email or a plain web form.

Source: PCI DSS (card payments)

National Minimum Wage and tips

Minimum wage and tronc

Job adverts must state pay that meets the minimum wage, and say how tips are shared if you mention them.

Source: National Minimum Wage and tips

Modern Slavery Act 2015 s.54

Modern Slavery Act statement thresholds

If annual turnover is 36 million pounds or more, publish a modern slavery statement with a link in a prominent place on the homepage.

Source: Modern Slavery Act 2015 s.54

Every UK business site

Whatever the sector, these apply to almost every business website.

Company and trading details

A limited company's site must show its registered name, company number, place of registration and registered office address.

Source: Company and trading details

Privacy notice

Say who you are, what each form collects, why, how long you keep it and how people use their rights.

Source: Privacy notice

Cookie consent

Non-essential cookies and analytics wait for consent, and refusing is as easy as accepting.

Source: Cookie consent

Honest claims

Every claim, review and comparison is true, evidenced and not misleading (CAP Code).

Source: Honest claims

Genuine reviews

No fake, bought or selectively hidden reviews (DMCC Act 2024).

Source: Genuine reviews

See how your site measures up

The free grader checks your site against the visible signals buyers, search engines and AI assistants look for, including several of the points above.

Grade my website Hospitality websites