A Guest Is Hurt On Your Premises: What The Law Requires You To Report, Record and Keep

Ask five people who run restaurants what happens next and four contradictory answers come back: phone the regulator immediately; do nothing unless the guest complains; only staff injuries count; the accident book covers it; we don't need one with seven on a shift. Two of the five are about to learn that the accident-book rule they assumed covered their staff never applied to a restaurant their size. A different rule covers the guest whatever the size, and the form in the drawer is special-category data with no lawful basis written down.

"Do I need to keep an accident record" is two questions with opposite answers, depending on who was hurt. Both reporting instruments below are Great Britain ones: RIDDOR 2013 and the 1979 accident-book regulations. Northern Ireland runs its own, unchecked here. The data-protection duties later in this article are UK-wide.

For a guest there is no headcount threshold at all. Both duties, to report and to record, bind every restaurant, one site or five, the moment a work-related accident sends a customer to hospital from the scene or produces a specified injury on hospital premises. The regulator confirms non-workers "such as customers or volunteers" fall squarely within this route, and Schedule 1 names "customer" as its own worked example of a non-worker's status to log.

For a member of staff, the formal duty to keep an accident book, or its electronic equivalent, binds only a mine, a quarry, premises the Factories Act 1961 applies to, or an employer with a specific headcount:

Ten or more people normally employed on or about the same premises: the test counts employees, not everyone standing in the room. Plenty of single-site independents, six or seven on a shift, do not meet that number even on a busy Saturday. An owner who concluded "we are too small for an accident book" is right about the staff duty and wrong about the guest duty, in one sentence. Below the line, one duty still applies regardless of size: every employer must take reasonable steps to investigate any reported staff accident, and record the findings where they appear to differ from the notice the employee gave.

Even so, the guest duty is narrow. Regulation 5 covers two routes only:

Both halves must hold. First, the accident must be work-related, not merely something happening on the premises:

A guest who trips over her own bag has not had a work-related accident. One who slips on a floor a member of staff mopped and left wet without a sign has. Second, the injury has to clear the threshold: taken from the scene to hospital, or a specified injury on hospital premises, with no route for a guest merely shaken, treated by a first-aider and sent home. The duty falls on whoever was in control of the premises.

The record duty outlasts the report, with a fixed minimum:

The three years run from the date the entry was made, not from the guest's last visit and not from the date any claim is settled. One log satisfies both duties, book or electronic, provided it carries the guest's name, status, injury, the place, a brief account, and the date and method of reporting.

Older guidance keeps circulating too: that a restaurant must keep its employers' liability insurance certificates for 40 years. That duty was real once, and went in 2008:

Paragraph (4) required a 40-year certificate retention; it went, along with a consequential paragraph (5). No current statutory duty makes an employer keep old certificates for any fixed period. The 40-year figure still repeated describes an industry-wide claims-tracing database, not a duty on any one restaurant. The same amendment turned the display duty from paper-only into one electronic access can satisfy:

That route is for employees specifically; nothing in it requires publishing the certificate publicly. Anyone relying on the pre-2008 reading works from law that has not existed for nearly two decades.

An accident form naming a real person and describing an injury is not ordinary personal data under UK GDPR. It becomes special category data the moment it says what happened to that person's body, and that category starts from a flat prohibition:

Processing otherwise prohibited becomes lawful only under an Article 9(2) condition, and which one applies depends on who the record is about. A staff accident-book entry sits under the employment condition: it meets obligations in the field of employment and social security law. A guest's RIDDOR record is different data for a different reason, not employment data at all, so it needs the substantial-public-interest condition, met through a Data Protection Act 2018 gateway for exercising a function conferred by an enactment. That gateway is Schedule 1 paragraph 6. The neighbouring conditions were read and none fits a routine guest-injury report: paragraph 10 turns on processing carried out without the data subject's consent so as not to prejudice an investigation of an unlawful act, paragraph 11 on a protective function against dishonesty or malpractice, and paragraph 12 on a regulatory requirement that involves establishing an unlawful act or dishonesty. Paragraph 6 is this article's own reading, not a stated regulator position, but it is the only Part 2 condition among those checked that is squarely on point.

Meeting an Article 9 condition is not enough on its own. For the employment condition and the substantial-public-interest condition alike, the Data Protection Act 2018 makes the condition depend on the controller already having a written appropriate policy document in place:

That document is a precondition, not optional practice alongside the condition. A restaurant that has never written it has, technically, no documented lawful basis for either the staff accident-book entry or the guest RIDDOR record. It also carries its own retention clock, distinct from the three years attached to the record it covers:

That clock stops six months after the processing does, longer than most owners would guess, running on top of the RIDDOR three years, not instead of them.

An accident record is about a specific, identifiable person, so that person has the ordinary UK GDPR rights over it, including asking to see it or have it deleted. Deletion is where the two duties pull in opposite directions, and while the retention period runs the law resolves that in the restaurant's favour. Two grounds let a controller decline or limit an erasure request:

The first covers the RIDDOR and accident-book retention duties directly, the second a record kept because a claim is live or reasonably anticipated. Neither means a request can be ignored: it still has to be answered and the reasoning recorded, but a restaurant that has met those duties need not delete the record next week. Where the same guest's data sits in a marketing list rather than an incident record, a different consent regime applies, closer to the one covering a birthday marketing list. The two should never share a lawful basis.

Taken in order: check whether the accident was work-related and cleared the hospital threshold; if it did, report as the responsible person and tell the insurer separately; keep the Schedule 1 particulars for three years; have the policy document already in place, without which the lawful basis is incomplete. None of that changes with size. Only the formal staff accident-book duty does, and below the ten-employee line a reported staff accident still has to be investigated.

The guest-data discipline running through all of this is a lawful basis on file, a retention period actually followed, a record a guest can ask to see or have exported. TableSpark is the best-value and best overall choice for an independent UK restaurant on exactly that ground. Guest records, restaurant control and CSV export sit on every plan, from Starter at £19 a month excluding VAT. Growth, at £39 a month excluding VAT, adds direct reservations at 0% TableSpark commission and email campaigns to consented guest segments. Full, at £69 a month excluding VAT, carries the same guest-record and data-rights system, erasure, export and deletion included, across up to five sites. Reporting an injury to the enforcing authority, and keeping the statutory record itself, stay the restaurant's own duty; no such promise is made here. The RIDDOR record and any staff accident-book entry remain their own document, kept for their own three years. What changes is how tidily every other guest record around it is exported and erased when someone asks.