Accredited drug and alcohol testing at work: what UK employers need to know
Drugs of Abuse/Alcohol · 7 min read
Drug and alcohol testing at work is lawful in the UK, but it is more constrained than many employers assume. Getting it wrong creates exposure under both employment law and data protection law.
This is general information, not legal advice. Anything that could lead to disciplinary action is worth running past an employment solicitor first.
You need consent, and a policy
You cannot test an employee without their consent. In practice consent comes through a drug and alcohol policy that forms part of the employment contract, which employees have seen and agreed to.
A workable policy sets out:
- Why testing happens, and what the business is trying to protect
- Who is covered — everyone, or only safety-critical roles
- When testing occurs: pre-employment, for cause, post-incident, random
- How samples are collected and by whom
- What happens after a positive result, including confirmatory testing
- What support is available to employees
Introducing testing where none existed is a change to terms and should be consulted on, not imposed.
Proportionality is the test
Under UK GDPR, drug test results are special category health data. Processing them needs a lawful basis under Article 6 and a separate condition under Article 9, and the ICO expects testing to be proportionate to a genuine risk.
That distinction matters. Testing a scaffolder or an HGV driver is easy to justify on safety grounds. Random testing of office staff with no safety-critical duties is much harder to defend, and the ICO has been clear that employers should not collect more health data than the risk warrants.
A data protection impact assessment is the sensible step before starting a testing programme.
Pre-employment, random and for-cause testing
Pre-employment testing is the easiest to justify when it is disclosed during recruitment and tied to the role. For-cause testing, after an incident or where there are reasonable grounds to suspect impairment, is usually proportionate if your policy allows it. Random testing is the hardest to defend and is generally limited to safety-critical roles, because it collects health data with no individual suspicion behind it.
Can an employee refuse a test?
You cannot force anyone to be tested. If testing is a term of a policy the employee has agreed to, refusal may be treated as a breach, but whether action is fair depends on the policy wording and the circumstances. Take advice before acting on a refusal.
Screening results are presumptive
This is where employers most often go wrong.
A rapid on-site test is a screening test. It indicates a substance may be present above a cut-off. It is not evidential and it is not a confirmed result.
Acting on a screening result alone — dismissing someone, withdrawing an offer — is difficult to defend at tribunal.
The correct sequence is: screen on site, then send any non-negative sample to a UKAS-accredited laboratory for confirmatory testing, with a documented chain of custody. Act only on the confirmed result.
Using on-site screening kits
Rapid kits suit initial screening where your policy allows it: cannabis drug test kits and cocaine drug test kits for urine screening, and disposable alcohol breath tests for alcohol. A standard urine drug screen does not normally include alcohol, which is tested separately. Treat every non-negative result as presumptive until a UKAS-accredited laboratory confirms it. See the full drug and alcohol testing range.
Handling a confirmed positive
- Follow your policy consistently — inconsistency is what tribunals seize on
- Meet the employee and hear their explanation
- Take advice on any health or disability-related issues the situation raises
- Keep confidential records of the test, the confirmation, meetings and decisions
- Consider what support your policy provides before any disciplinary action
Practical points
Store kits within date and at the stated temperature. Train whoever administers tests. Keep results out of general HR files and restrict access. Set a retention period and stick to it — indefinite retention of health data is hard to justify.
Common questions
Can an employer test staff for drugs or alcohol without consent?
No, testing requires the employee's consent, which in practice comes through a drug and alcohol policy that forms part of their employment contract and that they've seen and agreed to.
Is a positive on-site drug test result enough to take disciplinary action?
Not on its own. An on-site test is a screening result, not a confirmed one. Any non-negative screening result should go to a UKAS-accredited laboratory for confirmatory testing before any action is taken.
Do workplace drug tests also test for alcohol?
A standard urine drug screen does not normally include alcohol, which is tested separately, for example with a breath test.
What does UK GDPR say about storing drug test results?
Drug test results count as special category health data, so they need a lawful basis and a separate Article 9 condition under UK GDPR, and the ICO expects testing and data retention to be proportionate to an identified risk.
Do all employees need to be tested in the same way?
Not necessarily. Testing safety-critical roles is easier to justify than testing staff with no safety-critical duties, and a proportionate, documented policy that reflects genuine risk is what data protection law expects.