The policies needed for tenders are whatever the tender pack asks for. Only a few are required of your business by law, and those depend on your size. This guide separates the two, with the law behind each, so you know which policies you must have and which you can write when a pack asks. It sits alongside our guide on how to win public sector contracts.
Policies needed for tenders: required by law, or asked for by the buyer?
A buyer can ask for something the law doesn’t require. On contracts above the thresholds, it may set a condition if it is a proportionate way of checking your legal and financial capacity or technical ability (section 22(1), (5)). That is why a policy can appear in a pack without being a legal duty.
Rows marked “formerly” come from the government’s standard selection questionnaire (SQ), used under the old rules (PPN 03/24, Annex B). It shows what one government questionnaire asked, not what every buyer asks. Today’s equivalent is the buyer’s own questionnaire, which a buyer may now call the PSQ.
| Policy | A legal duty for your business? | The rule | Where buyers have asked |
|---|---|---|---|
| Written health and safety policy | Yes, if you employ five or more people | HSWA 1974 s.2(3); SI 1975/1584 reg 2 | Formerly the standard SQ's health and safety section |
| Modern slavery statement | Only if you supply goods or services and have turnover of £36 million or more | Modern Slavery Act 2015 s.54; SI 2015/1833 reg 2 | Formerly the standard SQ's modern slavery question |
| Equality policy | Not under s.149, which is a duty on public authorities | Equality Act 2010 s.149 | The buyer's choice; check the pack |
| Data protection | If you process personal data for a buyer, Article 28 sets the terms | UK GDPR art 28 | Formerly the standard SQ's data protection section |
| Carbon Reduction Plan | Not a law for suppliers in general; PPN 006 tells in-scope central government buyers to require one above £5 million a year | PPN 006 paras 2-4, 10 | Central government major contracts |
| Cyber Essentials | Not a policy: a certificate, or equivalent controls | PPN 014 paras 3, 12 | Central government and NHS bodies, on higher-risk contracts |
Health and safety policy
The Health and Safety at Work etc. Act 1974 makes it the duty of employers to prepare “a written statement of his general policy” on the health and safety at work of their employees, and to bring it to their notice (section 2(3)). The duty applies “except in such cases as may be prescribed”.
The prescribed exception covers “any employer who carries on an undertaking in which for the time being he employs less than five employees” (regulation 2). So the written-policy duty starts at five employees.
Below that, a pack can still ask how you manage health and safety. Formerly the standard SQ asked bidders to “describe the arrangements you have in place to manage health and safety effectively” (PPN 03/24, Annex B). Some buyers ask for an SSIP scheme such as CHAS or Constructionline. See SSIP, CHAS and Constructionline.
Modern slavery statement
A commercial organisation that supplies goods or services, and has total turnover of not less than an amount set by regulations, must prepare a slavery and human trafficking statement for each financial year (section 54(1)-(2)). The regulations say: “The amount of total turnover prescribed for the purposes of section 54(2)(b) of the 2015 Act is £36 million” (regulation 2). Commercial organisations include companies and partnerships that carry on a business in the UK (s.54(12)).
The statement sets out the steps taken in the financial year to prevent slavery and human trafficking in the business and its supply chains, or says that no such steps were taken (s.54(4)). A company’s board approves it and a director signs it (s.54(6)). If you have a website, the link goes “in a prominent place on that website’s homepage” (s.54(7)).
Below £36 million it isn’t a legal duty. The standard SQ asked whether you were a relevant commercial organisation under section 54 (PPN 03/24, Annex B), so expect the question and answer it truthfully.
Two pieces of context. “Labour market, slavery and human trafficking offences” is a heading of the mandatory exclusion grounds (Schedule 6), and “labour market misconduct” one of the discretionary grounds (Schedule 7). And PPN 009 (updated 16 October 2025) requires supply chain information on central government and NHS procurements flagged as high risk of modern slavery (paras 2, 11).
Equality and diversity
The public sector equality duty reads: “A public authority must, in the exercise of its functions, have due regard to the need to” eliminate discrimination, advance equality of opportunity and foster good relations (section 149(1)). That is the buyer’s duty, not a duty on you as a supplier. A buyer may still ask for an equality policy, and the pack will say.
One nuance. “A person who is not a public authority but who exercises public functions must, in the exercise of those functions, have due regard to the matters mentioned in subsection (1)” (s.149(2)). If your contract has you carrying out a public function, the duty can reach you for that function. Whether a given contract does is a question for the contract documents and, if it matters, a lawyer. This guide doesn’t cover other duties employers have under the Equality Act 2010.
Data protection
If you will process personal data for a buyer, UK GDPR Article 28 sets the terms. The controller must use only “processors providing sufficient guarantees” to implement appropriate technical and organisational measures (art 28(1)), and processing by a processor is governed by a contract (art 28(3)). See Article 28. That is the legal reason a pack may ask about data protection.
Formerly the standard SQ asked bidders to confirm they would “ensure compliance with the UK General Data Protection Regulations” (PPN 03/24, Annex B). The Cabinet Office’s PPN 020, published on 24 April 2025, is guidance on data protection legislation.
Where a central government or NHS contract involves citizens’ personal information, PPN 014 can also bring in Cyber Essentials or equivalent controls (paras 3, 12). See Cyber Essentials for government contracts.
Environmental policy and Carbon Reduction Plans
PPN 006 applies to “all central government departments, their executive agencies and non-departmental public bodies” (para 2), for contracts above £5 million a year including VAT (paras 3-4). In-scope buyers should require a Carbon Reduction Plan “as a condition of participation” (para 10). The plan must confirm the supplier’s commitment to net zero by 2050 for its UK operations and report Scope 1 and 2 emissions and a defined subset of Scope 3 (paras 10-11).
For other buyers and smaller contracts, the pack decides. Formerly the standard SQ’s central-government-only question for contracts above £5 million a year asked bidders to “confirm that you have detailed your environmental management measures by completing and publishing a Carbon Reduction Plan” (Annex B). “Environmental misconduct” is also a heading of the discretionary exclusion grounds (Schedule 7, paragraph 4).
Other policies a pack may name
A pack may also ask about safeguarding, whistleblowing, quality, business continuity or complaints. Treat that as a reminder to read the pack, not as a list of what is required.
The standard SQ also had sections on paying your supply chain (“Please confirm that you have systems in place to pay those in your supply chain promptly and effectively”; see public sector payment terms), skills and apprentices, and steel (Annex B). Check whether a policy question is pass or fail or scored, because that decides whether a gap rules you out. See bid or no bid.
Keeping policies tender-ready
Date each policy, note who approved it, and review it on a schedule you can state. Write it to match what you actually do, because you may be asked to show it in practice. Size it to the business: a six-person firm needs a page or two it follows, not a 40-page manual.
Keep the set together with your other paperwork. Our guide to the documents to have ready lists the rest.
On above-threshold contracts a buyer must have regard to “the nature, complexity and cost” of the contract when deciding whether a condition is proportionate (section 22(5)). If a request looks out of proportion, ask a clarification question. See clarification questions.
Your next step
Tell us your trade and postcode to join the free weekly list of live tenders, starting soon. On Pro (£49/month), notices that fit your trade and area are checked against what each states about insurance, certifications and location, and you get an email each morning on days with new matches.
Questions
Do I need a modern slavery statement to bid?
Only commercial organisations that supply goods or services and have turnover of £36 million or more must prepare one for each financial year by law (Modern Slavery Act 2015 section 54; SI 2015/1833 regulation 2). A buyer may still ask about it, so answer accurately.
Do I need a written health and safety policy if I have fewer than five employees?
The legal duty in section 2(3) of the Health and Safety at Work etc. Act 1974 to prepare a written policy doesn't apply to an employer with fewer than five employees (SI 1975/1584 regulation 2). A tender pack may still ask how you manage health and safety.
Is an equality policy a legal requirement for suppliers?
The public sector equality duty in section 149 of the Equality Act 2010 is on public authorities, and on others only when they exercise public functions. An equality policy in a pack is the buyer's request, so check the pack.
Do I need a Carbon Reduction Plan?
For central government departments, executive agencies and non-departmental public bodies, PPN 006 says to require one as a condition of participation on contracts above £5 million a year including VAT. Other buyers decide for themselves.
What if the pack asks for a policy I don't have?
Check whether the question is pass or fail or scored. On above-threshold contracts, ask a clarification question if the request looks out of proportion to the nature, complexity and cost of the contract (section 22(5)).