Resources
Compliance glossary
Plain-English definitions of the terms that tend to arrive without explanation, usually in a letter. These say what a term means. They do not tell you what to do about it.
- ACOP (Approved Code of Practice)
- Guidance with a special legal status. You may depart from it, but if you do you have to be able to show you achieved the same result another way.
- Appointed person
- Someone who takes charge of first-aid arrangements — calling an ambulance, looking after the equipment — without holding a first-aid qualification.
- Competent person
- Somebody with the training, knowledge and experience to do a particular thing properly. Some duties can only be discharged by one, and the level of competence needed varies with the risk.
- Controlled document
- A document with a version history, a named approver and a review date, where the version in force is a fact rather than whichever file was uploaded last.
- Controller
- Under data protection law, the organisation that decides why and how personal data is processed. Your staff records make you a controller.
- DPIA
- Data protection impact assessment. Required before processing likely to result in a high risk to individuals.
- DSAR
- A subject access request — an individual asking for a copy of the personal data you hold about them. Usually one calendar month to respond.
- Duty holder
- Whoever the law puts an obligation on. It follows control rather than ownership, which is why a lease can move it.
- EICR
- Electrical Installation Condition Report. Records the condition of a fixed electrical installation and any observations, coded by severity.
- Enforcement notice
- A formal notice from a regulator requiring something to be put right, usually by a stated date. Failure to comply is generally an offence.
- Evidence pack
- A dated compilation of the documents and records that show a duty was met, assembled so somebody else can follow it.
- HACCP
- Hazard Analysis and Critical Control Point. The risk-based approach a food safety management system is built on.
- Improvement notice
- A health and safety notice requiring a contravention to be remedied within a period, which can be appealed.
- Processor
- An organisation that processes personal data on a controller's behalf. DutyHub is your processor for the data you put into it.
- Prohibition notice
- A notice stopping an activity that involves a risk of serious personal injury. It takes effect immediately or on a stated date.
- RIDDOR
- The regulations requiring certain work-related deaths, injuries, diseases and dangerous occurrences to be reported.
- ROPA
- Record of processing activities. The Article 30 record of what personal data you process and why.
- Responsible person
- Under fire safety law, whoever has control of the premises — commonly the employer or occupier. The fire risk assessment duty sits with them.
- Risk assessment
- A structured look at what could cause harm, who could be harmed, and whether existing precautions are enough. Significant findings are recorded where five or more people are employed.
- Statutory excuse
- A defence created by carrying out a check in the way the law prescribes — most commonly used about right to work checks.
- Thorough examination
- A statutory examination of lifting equipment by a competent person, at set intervals. Not a service and not maintenance.
- Transfer note
- The record accompanying a transfer of waste, describing it and identifying who took it. It has to be kept for a set period.