Who Should Submit a RIDDOR Report? Employer Duties and Responsible Persons in the UK

If you run a small business, dealing with accidents and incidents at work is stressful enough without having to second-guess your legal reporting duties.

RIDDOR (the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013) sets out when certain workplace incidents must be reported to the relevant enforcing authority (often the HSE, but sometimes the local authority).

One of the most searched questions we hear from business owners is who should submit a RIDDOR report.

In this guide, we’ll walk you through who the law expects to report, how dutyholders (“responsible persons”) work in practice, and the key steps to follow so your business stays compliant (and prepared) when something goes wrong.

This article is general information only and not legal advice. If you need advice on a specific incident or workplace setup, get tailored help.

What Is A RIDDOR Report (And Why Does It Matter For Small Businesses)?

A RIDDOR report is a formal notification to the regulator that a reportable workplace incident has happened.

RIDDOR is not about reporting every minor cut or bump. It focuses on more serious incidents and specific categories, including:

• Work-related deaths
• Specified injuries (certain serious injuries defined by the regulations)
• Over-seven-day injuries to workers (when a worker can’t do their normal work for more than 7 consecutive days, not counting the day of the accident)
• Occupational diseases (when diagnosed and linked to certain work activities)
• Dangerous occurrences (near-misses with high potential for harm, such as structural collapses, explosions, certain electrical incidents, etc.)
• Injuries to non-workers (for example, customers or visitors) where they are taken directly to hospital for treatment

For small businesses, the practical risk is simple: if you don’t report when you should, you may expose the business to enforcement action, reputational damage, and complications if an incident later becomes a dispute (for example, an employment claim or an insurance issue).

This is why it’s worth having a clear internal process as part of your broader Health and Safety setup, rather than scrambling after an incident happens.

Who Should Submit A RIDDOR Report? The Legal Dutyholder Explained

In most cases, the duty to submit a RIDDOR report sits with the dutyholder (sometimes described as the “responsible person” in guidance).

Under RIDDOR, the dutyholder is the person or organisation responsible for the work activity or premises where the reportable incident happened. In plain English, this is usually the business that’s running the work (and practically, someone acting on behalf of the business completes the report).

Most Common Scenario: You Employ Staff

If you employ workers, the employer is usually the dutyholder for RIDDOR purposes.

That means your business must ensure the report is made (even if you ask a manager or HR team member to complete it). You generally can’t “outsource” legal responsibility by simply telling someone else to do it and forgetting about it.

If You’re Self-Employed

If you are self-employed, you may have reporting duties under RIDDOR if a reportable incident arises out of or in connection with your work activity.

That said, many self-employed people work on a client site where the client controls the premises and site-wide safety arrangements. This is where things can get tricky, and why it’s important to clarify reporting responsibilities in writing (more on that below).

If You Control Premises (Even If You Don’t Directly Employ Everyone There)

If your business has control of the premises (for example, you occupy a shop, café, warehouse, studio, or office), you may have reporting duties for incidents arising from that workplace, even if the injured person is not your employee (for example, a contractor or visitor).

In practice, “control” can come from factors like:

• who manages day-to-day operations on site;
• who sets the safety rules and procedures;
• who maintains the equipment;
• who directs how work is carried out.

If you’re unsure who “controls” the area where the incident happened (for example, shared spaces in a building or a multi-business site), it’s worth getting specific advice early. These grey areas are exactly where businesses make avoidable mistakes.

What If The Incident Involves Contractors, Agency Workers Or Shared Worksites?

This is where most reporting confusion happens for small businesses. You might think: “They’re not my employee, so it’s not my job.”

But RIDDOR duties aren’t limited to your payroll. They follow who’s in charge of the relevant work activity or premises.

Contractors Working At Your Site

If you hire a contractor to work at your premises (for example, a plumber, electrician, builder, or cleaner), and a reportable incident occurs, the key question is who is the RIDDOR dutyholder for what happened.

• If the incident arises out of or in connection with your undertaking (for example, site conditions you manage, access arrangements you control, or your work activities), your business may need to report.
• If the incident arises out of or in connection with the contractor’s undertaking (for example, the contractor’s own work activity, equipment, or methods), the contractor may need to report.

It won’t always be “both”. The duty generally sits with the party whose undertaking the incident relates to. The key is not to assume the other party has reported.

As a practical step, build incident escalation and confirmation into your contractor onboarding and documentation (for example, stating who will report what, and who notifies whom). This is the kind of detail that helps your commercial arrangements run smoothly, just like having clear terms around scope of works and risk allocation.

Agency Workers

Agency workers can create a “who’s the employer?” problem. While the agency may employ the worker, your business may control the work and premises day-to-day.

For RIDDOR, what matters is whose undertaking the incident arises out of or in connection with. In many practical situations, the host business will be the right party to report because it controls the work activity and has the immediate details of what occurred.

To avoid gaps, make sure your engagement documentation and internal processes clearly allocate incident reporting steps and notifications. Having the basics right in your workforce documents (like an Employment Contract for direct hires and a consistent onboarding process for non-employees) also makes it easier to manage compliance when an incident occurs.

Shared Premises (Landlords, Co-Working Spaces, Multi-Tenant Buildings)

If you operate from a shared building, responsibility may depend on where the incident happened and who controls that area and activity.

• If the incident happens inside your demised premises and relates to your operations, you may be the dutyholder.
• If it happens in a common area controlled by the landlord or building manager (like a lobby, shared stairwell, or communal corridor), they may have the reporting duty (but you still want to document what happened and confirm reporting has occurred).

From a risk management point of view, it’s smart to treat this as a two-step process: (1) work out who should report, and (2) make sure it actually gets done.

What Are Employers Required To Do Before And After Submitting A RIDDOR Report?

Submitting the report is only one part of your legal obligations. As a business owner, you should think of RIDDOR as sitting inside a bigger compliance picture: health and safety systems, training, record keeping, and incident management.

Before An Incident: Put A Clear Internal Reporting Lead In Place

Many small businesses don’t have a dedicated health and safety officer. That’s fine, but you should still assign responsibility internally so incidents get escalated and assessed quickly.

Usually this means designating someone (for example, a director, operations manager, HR lead, or site manager) to:

• receive internal incident notifications;
• collect initial facts and evidence;
• decide if the incident is RIDDOR-reportable;
• submit the report (or coordinate submission); and
• maintain records and follow-up actions.

This can be built into your internal Workplace Policy documents so staff know what to do immediately after an incident (including who to call, where to record details, and when escalation is required).

After An Incident: Investigate And Record

Even when an incident is clearly reportable, the regulator expects you to have taken it seriously and investigated appropriately.

Good practice usually includes:

• making the area safe and providing first aid;
• preserving evidence where appropriate (for example, keeping faulty equipment aside);
• taking witness statements while facts are fresh;
• reviewing risk assessments and safe systems of work;
• implementing corrective actions (training, signage, maintenance changes, supervision changes, etc.).

If your business processes personal data during the investigation (for example, CCTV footage, medical information, witness details), you should think about privacy compliance too. This is where a clear Privacy Policy (and proper internal handling rules) helps keep you consistent and compliant.

Keep Records For The Required Period

RIDDOR requires you to keep records of reportable incidents for at least three years. Separate rules may also apply depending on the type of record (for example, employment records, insurance requirements, or data protection principles).

What matters most is having a reliable record-keeping system that can produce evidence if you’re later asked:

• what happened;
• what you reported and when;
• what you did to prevent recurrence.

Key Steps: How To Submit A RIDDOR Report (Without Getting Lost In The Process)

When something serious happens at work, it’s easy to panic and either over-report or miss a deadline. A simple checklist can help.

Step 1: Confirm It’s Work-Related And Potentially Reportable

Start with the basics:

• Did it arise out of or in connection with work?
• Does it fall into a RIDDOR category? (death, specified injury, over-seven-day injury, dangerous occurrence, occupational disease, etc.)

If the incident happened at your premises but wasn’t connected to work activity (for example, a customer faints due to an unrelated medical condition), it may not be reportable under RIDDOR (although you should still document it for safety and insurance purposes).

Step 2: Identify The Dutyholder And Your Internal Reporting Lead

Even though the legal duty sits with the dutyholder, someone needs to actually do the task.

As a small business, your internal lead might be:

• you (the owner-director);
• a store manager;
• an operations manager;
• an HR lead; or
• a health and safety coordinator.

The key is that they have enough authority to gather information and implement corrective action, not just fill out a form.

Step 3: Report Within The Relevant Timeframe

Different incidents have different statutory deadlines.

• Fatalities and specified injuries must be reported without delay.
• Dangerous occurrences must be reported without delay.
• Over-seven-day injuries must be reported within 15 days of the accident.
• Occupational diseases must be reported when you receive a diagnosis and the disease is linked to specified work activities.
• Injuries to non-workers must be reported if the person is taken directly to hospital for treatment and the accident is work-related.

If you’re ever unsure about timing, treat it as urgent and get advice. It’s generally easier to correct an over-cautious approach than to explain a missed report later.

Step 4: Submit Via The Correct Channel

In most cases, reporting is done online to the relevant enforcing authority (usually via the HSE reporting portal, unless a local authority is the enforcing authority for your premises/activity). You’ll typically need to provide:

• business details;
• details of the injured person (where relevant);
• date/time/location;
• a clear description of what happened;
• the injury outcome and any immediate response.

Accuracy matters. Don’t guess. If you don’t know something, say so, and keep an internal note to follow up.

Step 5: Communicate Internally And Follow Up

Once you’ve submitted the report:

• save a copy of the submission/confirmation;
• notify relevant internal stakeholders (for example, senior management, HR, site leads);
• review whether you need to update training, signage, or procedures;
• consider whether the incident triggers any contractual notifications (for example, to a client, landlord, or principal contractor).

If the incident may lead to a dispute (for example, an employee complaint or claim), it’s worth making sure your documentation is consistent with your broader employment approach and contracts, including the expectations you’ve set in your Employment Contract.

Common Mistakes Businesses Make When Deciding Who Should Submit A RIDDOR Report

Most RIDDOR issues aren’t caused by bad intentions. They happen because businesses are busy, incidents are chaotic, and responsibility is unclear.

Here are common pitfalls (and how to avoid them).

1. Assuming The Injured Person Will Report It

RIDDOR reporting is not typically the employee’s job. The duty is on the dutyholder (often the employer or the person in control of the work activity or premises).

2. Assuming The Agency/Contractor/Landlord Will Report It

In shared environments, it’s common for everyone to assume “someone else will do it”. A simple fix is to put a written incident escalation process in place, and to confirm by email who is submitting the report.

3. Reporting Too Late Because You Wait For “All The Facts”

It’s sensible to be accurate, but some incidents must be reported quickly. You can still investigate and update your internal records as facts become clear.

4. Treating The RIDDOR Report As The Only Action Needed

The report is just one piece. You still need to investigate, record, and implement corrective action to reduce risk going forward.

5. Over-Sharing Personal Data During Investigations

When incidents happen, businesses sometimes circulate sensitive details (for example, medical information or CCTV footage) too widely internally. Make sure you limit access to those who genuinely need it, and that your privacy practices align with your documented approach (including your Privacy Policy where relevant).

Key Takeaways

• In most cases, the duty to submit a RIDDOR report sits with the dutyholder (usually the employer, or the person in control of the relevant work activity or premises).
• RIDDOR duties aren’t limited to employees; incidents involving contractors, agency workers, and visitors can still be reportable depending on whose undertaking the incident arises out of or in connection with.
• Small businesses should nominate an internal reporting lead and document an incident process in a clear Workplace Policy so reporting doesn’t get missed during stressful events.
• Submitting the report is only one step; you should also investigate, keep records, and implement corrective actions to reduce the risk of the incident happening again.
• Be mindful of privacy when collecting and sharing incident information, especially where it involves medical details or identifiable CCTV/witness statements, and keep your approach consistent with your Privacy Policy.
• If responsibility is unclear (for example, shared premises or overlapping contractor control), it’s worth getting specific advice early so you don’t end up with a reporting gap.

If you’d like help putting the right workplace policies and compliance foundations in place (or you’re dealing with an incident now and want to make sure you handle it correctly), you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.