TL;DR
- Section 8 of the Misuse of Drugs Act 1971 is narrower than template wording suggests. It covers knowingly permitting production, supply or offers to supply, preparing opium for smoking, and smoking cannabis, cannabis resin or prepared opium. Possession is not on the list.
- The Transport and Works Act 1992 offences reach railways, tramways and other specified guided transport carrying members of the public, and nothing else. For an office, a warehouse or a haulage operator it is the wrong statute to cite.
- Testing is a data protection decision as well as an employment one. The ICO says testing workers for drugs or alcohol is intrusive and that very few employers can justify testing to detect illegal use rather than on safety grounds.
A drugs and alcohol clause is one of the easiest things to copy into a handbook and one of the hardest to copy correctly. The usual template asserts three things: that the employer commits an offence by permitting drug use on its premises, that it may test anyone at any time, and that being under the influence at work is gross misconduct. The first is drafted far too widely. The second is wrong for most employers. Only the third is in the employer's own hands, and only if the policy said so before the incident.
This is written for the United Kingdom. The health and safety duty, the Equality Act and the transport offences below apply in Great Britain, and Northern Ireland has its own equivalents. It is general information, not legal or medical advice, and it names no testing provider.
A policy only works if the version people were shown is the version being relied on. New Dynamics workflows let you set the stages, participants and approvals once, so what happened and who signed it off is already recorded.

What the law requires of an ordinary employer
HSE's guide states the general duty on its law page: "You have a general duty under the Health and Safety at Work etc Act to ensure, so far as reasonably practicable, the health, safety and welfare of your employees." That is section 2(1) of the Health and Safety at Work etc. Act 1974: "It shall be the duty of every employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all his employees." Section 3(1) extends the same standard to people not in your employment, section 7 puts a matching duty on the employee, and section 2(3) requires a written statement of general health and safety policy. None of that creates a duty to test, to search, or to keep a separate document. It creates a duty to manage a risk.
Three other statutes get cited in templates, and only two usually fit.
Misuse of Drugs Act 1971, section 8. The familiar line about permitting drug use on premises comes from here, and it is narrower than the line suggests. Section 8 applies where a person, "being the occupier or concerned in the management of any premises, he knowingly permits or suffers" one of four activities: producing a controlled drug, supplying or offering to supply one, "preparing opium for smoking", or "smoking cannabis, cannabis resin or prepared opium". Possession is not on the list, and nor is consuming a controlled drug other than cannabis or prepared opium. HSE's own suggested wording is narrower and more usable: say "that you will report drug possession or dealing at work to the police straight away."
Road Traffic Act 1988. HSE names this one alongside the 1971 Act. It reaches anyone who drives for work, including in their own car, and GOV.UK notes one consequence: "if you drive for work, your employer will see your conviction on your licence."
Transport and Works Act 1992. The most often misapplied. Section 27 makes it an offence to work on a transport system as a driver, guard, conductor, signalman or in maintenance while "unfit to carry out that work through drink or drugs" or over the prescribed alcohol limit, and section 28 makes the responsible operator guilty too unless it "has exercised all due diligence to prevent" it. That defence is the real reason rail and tram operators run structured testing. But section 26 limits the chapter, in force since 7 December 1992, to a railway, a tramway or another specified mode of guided transport, and only where the system "is used, or is intended to be used, wholly or partly for the carriage of members of the public." For an office, a shop, a warehouse, a factory or a road haulage operator it is the wrong statute, and citing it invites the question of what else was not checked.
One absence is worth recording. Acas publishes no dedicated guidance on drugs and alcohol at work; a search of its 1,266 published page URLs returns none. What Acas governs is the handling of the incident, through its Code of Practice on disciplinary and grievance procedures, in effect since 11 March 2015, where an unreasonable failure to follow the Code lets a tribunal adjust an award "by up to 25 per cent".
What the guidance says a policy should cover
HSE's guide runs as seven steps. Consult employees, because "You must consult employees or their representatives on health and safety matters." Identify the safety critical parts of your own work, for which HSE's examples are "using machinery", "using electrical equipment or ladders" and "driving or operating heavy lifting equipment". Then write the policy, which HSE gives two jobs that sit awkwardly together, in this order on its policy page: "an effective policy should aim to help and support them rather than lead to dismissal", "But it should also highlight when you will take disciplinary or other action."
A policy that does only the second is the common failure. Our post on code of conduct examples covers how specific a conduct rule has to be before it is usable.
Testing needs a lawful basis, not just a clause

A test result is health data. The ICO's guidance Employment practices and data protection: information about workers' health, published on 31 August 2023, lists "the results of an alcohol or drugs test" among the health information employers process, and says that because it "reveals or concerns a person's health, it is a type of special category data with certain extra rules that you must follow." So a lawful basis under Article 6 and a special category condition under Article 9 both have to be settled first: "you must determine your special category condition before you begin the processing. You must document your decision, along with your lawful basis." Testing without them is a data protection failure, whatever happens to any dismissal that follows.
The bar for testing at all is high: "testing workers for drugs or alcohol is intrusive and very few employers can justify testing to detect illegal use rather than on safety grounds." The ICO adds that "Other than in the most safety critical areas, you are unlikely to justify regular drug testing unless there is a reasonable suspicion of drug use that has an impact on safety." Random testing is bounded rather than barred: "You cannot justify collecting personal information by testing all workers in your organisation if, in fact, it is only workers engaged in particular activities or roles that pose a risk." And if you call it random it must be, because leading workers to believe testing is random while using other criteria is "unfair and deceptive".
Two official sources look as though they disagree on consent, and policies usually collapse the difference. HSE's screening and testing page says "employees must consent to screening for practical and legal reasons" and "employees can't be made to take a test but, if they refuse when an employer has good grounds for testing, they may face disciplinary action." The ICO says workers "cannot freely give their consent" because of the power imbalance, and that employers "should avoid relying on consent unless you are confident you can demonstrate it is freely given". They are answering different questions, and the ICO says which: "This guidance does not address consent for any physical intervention involved in taking a sample from a worker in the course of medical testing." Consent to the sample being taken is one thing; consent as the legal justification for processing the result is another, and on the second the ICO governs. So a policy needs a contractual right to require a test in defined circumstances, plus a documented lawful basis and special category condition, rather than one signature doing both jobs. For the record keeping side, see our employee data protection guide.
The guidance carries a standing note that "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change", so check it before relying on the detail.
Misconduct, dependency, and why the line matters
HSE separates the ideas in its first paragraph: "Misuse is not the same thing as dependence." On its support page it adds that "Drug and alcohol dependence are recognised medical problems" and that someone misusing drugs or alcohol "has the same rights to confidentiality and support as they would if they had any other medical or psychological condition."
The risk of treating dependency purely as conduct is stated by HSE itself: "If you dismiss someone because of drug or alcohol misuse without trying to help them, an employment tribunal may find that you've dismissed them unfairly." That is as far as the official sources go. HSE does not say dependency can never lead to dismissal, and choosing between a disciplinary and a capability route is a question of which procedure fits the facts rather than a safe harbour. What the guidance supports is that the employer should have considered support first and be able to show it. For safety critical roles HSE adds an interim step: "it may be necessary to transfer them to other work, at least temporarily." Our posts on gross misconduct and the capability procedure cover the two routes.
No official UK source publishes a workplace prevalence figure for this, so treat confident percentages with caution. Where official figures exist for the wider workforce picture, we collect them in the HR statistics hub.
Is dependency a disability under the Equality Act?
This has a precise answer, and the precision cuts both ways. Regulation 3 of the Equality Act 2010 (Disability) Regulations 2010, in force since 1 October 2010, reads in full:
"(1) Subject to paragraph (2) below, addiction to alcohol, nicotine or any other substance is to be treated as not amounting to an impairment for the purposes of the Act. (2) Paragraph (1) above does not apply to addiction which was originally the result of administration of medically prescribed drugs or other medical treatment."
The addiction itself is excluded, with one exception for an addiction that originally resulted from prescribed drugs or other medical treatment. The regulation excludes nothing else. It says nothing about a physical or mental condition caused by, or coexisting with, an addiction, and it does not disapply the Act from a person who happens to be dependent. So a policy should not assert that dependency "is not a disability". It is more accurate to say the employer will consider whether any underlying condition meets the definition in the Act, leaving the clinical question to occupational health.
Prescription and over the counter medication

A policy aimed only at illegal drugs misses the risk it was written for. HSE's definition includes the rest: "Drug and alcohol misuse is the use of illegal drugs and misuse of alcohol, medicines and substances such as solvents." The ICO agrees on where the employer's interest lies: "This can arise from drugs that are legal as well as illegal. You should not test merely to find evidence of the use of illegal drugs." It warns that over the counter test kits "may fail to differentiate between an illegal drug and a legitimate pharmaceutical, or between a pharmaceutical that causes impairment and one that does not."
For driving, GOV.UK's Drugs and driving: the law says it is "illegal in England, Scotland and Wales to drive with legal drugs in your body if it impairs your driving", and lists nine prescription drugs to discuss with a doctor, among them diazepam, methadone and opiates such as codeine and tramadol. There is a defence for prescribed use where the person has "followed advice on how to take them by a healthcare professional" and they "are not causing you to be unfit to drive even if you're above the specified limits". That law does not cover Northern Ireland.
The workable clause does three things. It asks a person in a safety critical role to tell their manager where a medicine may affect their ability to do that work safely, without naming the condition or the medicine. It routes the question to occupational health or the prescriber rather than the line manager, because HSE and the ICO both leave clinical interpretation to qualified people. And it says what happens next, which is a temporary adjustment or redeployment while the question is open. A clause requiring staff to declare every medicine they take collects health data the employer has no basis for and cannot interpret.
Frequently asked questions
Does an employer need an alcohol and drugs policy by law?
No statute requires a separate document. The Health and Safety at Work etc. Act 1974 requires the employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of employees, and section 2(3) requires a written statement of general health and safety policy. HSE says all organisations can benefit from an agreed policy on drug and alcohol misuse, and suggests including it in that statement.
Can my employer drug test me in the UK?
Only where it can justify doing so, and after documenting a lawful basis and a special category condition under data protection law. The ICO says testing workers for drugs or alcohol is intrusive and that very few employers can justify testing to detect illegal use rather than on safety grounds. HSE adds that employees cannot be made to take a test, but that refusing where the employer has good grounds may lead to disciplinary action.
Is random drug testing at work lawful?
It is not prohibited, but it is hard to justify broadly. The ICO says an employer cannot justify testing all workers if only those in particular activities or roles pose a risk, and that random testing should be limited to safety critical roles. Testing after an incident where there is reasonable suspicion is easier to justify than random testing.
Is being drunk at work gross misconduct?
Not automatically. It becomes a dismissible matter because the employer's own rules say so, the rules were clear in advance, and the procedure followed the Acas Code of Practice on disciplinary and grievance procedures, in effect since 11 March 2015. HSE warns that dismissing someone for drug or alcohol misuse without trying to help them may be found unfair by a tribunal.
Is alcohol dependency a disability under the Equality Act 2010?
Regulation 3 of the Equality Act 2010 (Disability) Regulations 2010 provides that addiction to alcohol, nicotine or any other substance is to be treated as not amounting to an impairment for the purposes of the Act, unless the addiction was originally the result of administration of medically prescribed drugs or other medical treatment. The exclusion covers the addiction itself. A separate condition is still assessed on the Act's own definition.
Your next step: fix the clauses that usually fail
- Replace any claim about the Misuse of Drugs Act 1971 with what section 8 actually covers. Delete the Transport and Works Act 1992 unless you run a railway or tramway carrying the public.
- Write down which roles are safety critical, from your own risk assessment rather than a job title list, because every testing justification rests on it.
- Before a testing clause goes live, record the purpose, the lawful basis, the special category condition, who may be tested, what for, how often, and the consequence of a result.
- Add the support half of the policy: who an employee can tell, what happens to that information, and the temporary redeployment option for safety critical roles.
- Add a medication clause that asks about effect on safe working rather than diagnosis, then set a review date and record who was consulted.
For the data protection side of all this, read and download our employee data protection guide. The guide is free to read, and the PDF uses our short download form. For where the clause sits, see our post on the employee handbook.
Want the policy version people acknowledged, the consultation record and the decision trail to exist already rather than be rebuilt for a hearing? Book a New Dynamics demo and bring your current handbook. You can also email contact@new-dynamics.com.




