Every workplace in England and Wales maintains emergency contact records for its employees. These records tell the employer whom to notify in the event that an employee is involved in a serious accident, suffers a medical emergency at work, or cannot be contacted through normal channels. Collecting this information is a routine part of the onboarding process in virtually every organisation — from a small business with five employees to a multinational corporation with thousands of staff.

An employee emergency contact form is the document used to collect this information from employees. It captures the name, relationship, and contact details of one or more persons whom the employee designates to be contacted in an emergency. It may also record relevant medical information — such as serious allergies, long-term conditions, or current medications — that first aiders or emergency services may need to know when responding to an incident.

In England and Wales, the obligation to maintain a safe working environment is imposed on employers by the Health and Safety at Work etc. Act 1974 (HSWA 1974). Section 2 of the HSWA 1974 places a general duty on employers to ensure, so far as is reasonably practicable, the health, safety, and welfare at work of all their employees. The Management of Health and Safety at Work Regulations 1999 require employers to make appropriate arrangements for the management of health and safety, including emergency procedures. Maintaining up-to-date emergency contact information is an important element of those arrangements.

However, collecting emergency contact information is not simply a health and safety issue. It involves the collection and processing of personal data about employees and, importantly, about third parties — the emergency contacts themselves, who have not directly consented to having their details held by the employer. This makes emergency contact forms a data protection issue as much as a health and safety one.

The UK General Data Protection Regulation (UK GDPR), which was retained in UK domestic law after Brexit and is given effect by the Data Protection Act 2018, applies to all personal data processed by employers in England and Wales. Under the UK GDPR, personal data must be collected lawfully, fairly, and transparently. Any emergency contact form must therefore include a data protection notice — a clear explanation of why the data is being collected, what it will be used for, how long it will be retained, and what rights the data subjects (both the employee and the emergency contacts) have.

Where the form collects medical information — such as allergies, conditions, or medications — that information is classified as special category personal data under Article 9 of the UK GDPR. Special category data attracts a higher level of protection and requires a specific legal basis for processing. In the employment context, the most relevant legal basis for processing health data is Article 9(2)(b) — processing necessary for obligations and rights in the field of employment law — supplemented by Schedule 1, Part 1 of the Data Protection Act 2018.

A properly drafted UK employee emergency contact form therefore needs to do two things simultaneously: collect the information that the employer needs to protect its employees in an emergency, and do so in a manner that fully complies with UK data protection law.

Employers in England and Wales should collect emergency contact information from all employees as part of the standard onboarding process. The form should be completed before or on the employee's first day of work, ensuring that emergency contact details are on file from the very start of the employment relationship.

The need for up-to-date emergency contact information is most acute in workplaces where employees face physical risks — such as construction sites, manufacturing facilities, warehouses, and healthcare settings. But the obligation to maintain a safe working environment applies equally to office-based employers, retailers, hospitality businesses, and any other workplace, no matter how low-risk it appears. A medical emergency can occur in any environment, and the ability to contact an employee's family or chosen person quickly can make a critical difference.

An emergency contact form is also needed whenever an existing employee's contact details change. Employees should be encouraged — and ideally required by HR policy — to update their emergency contact information whenever there is a change in circumstances: a new partner, a change of address, a change in medical conditions, or a change in the designated contact person. Stale emergency contact information is next to useless in a genuine emergency. Best practice is to ask employees to review and update their forms at least annually.

For employees who travel for work — particularly those who travel abroad or work in remote locations — having comprehensive emergency contact information, including next-of-kin details and medical information, is especially important. Employers who routinely send employees on business travel should consider whether their standard emergency contact form captures sufficient information to assist in an overseas emergency, including whether the employee has a valid travel insurance policy and the insurer's emergency contact number.

Employers who engage contractors, temporary agency workers, or self-employed workers on their premises face a more complex picture. The Health and Safety at Work etc. Act 1974 extends the employer's duty of care to non-employees who are affected by the employer's undertaking. While a formal employee emergency contact form may not be appropriate for short-term contractors, employers should consider what emergency contact arrangements they have in place for anyone working on their premises for a significant period.

New parents returning from maternity, paternity, or shared parental leave should also be asked to complete or update their emergency contact form. Caring responsibilities often change significantly around new parenthood, and the person an employee would want contacted in an emergency may change accordingly. Similarly, any employee who discloses a new long-term health condition or disability as part of a reasonable adjustments conversation should be invited to update their medical information on the form.

A well-drafted UK employee emergency contact form should include the following key elements to ensure it is operationally effective, legally compliant with UK GDPR, and consistent with best employment practice in England and Wales.

Data protection notice: This is the most legally critical element of the form in the UK GDPR era. The notice must be provided before or at the point of data collection, and must identify the employer as data controller, state the purpose for which the data is collected, explain the lawful basis for processing (Article 6(1)(c) for ordinary personal data; Article 9(2)(b) for health data), specify the retention period, identify who will have access to the data, and explain the data subject's rights under the UK GDPR including the rights of access, rectification, erasure, and restriction. The notice should also address the position of the emergency contacts as third-party data subjects, noting that the employee is responsible for informing their contacts that their data will be held.

Employee personal details: The form must clearly identify the employee by name, job title, department, and employment start date. Contact information — including work telephone, work email, personal mobile, and home address — should also be captured, as this information is used to contact the employee directly in a non-emergency situation where they may be absent from work.

Primary emergency contact: The primary contact section should capture the full name, relationship to the employee, and at least two telephone numbers (mobile and landline or alternative) for the primary emergency contact. An email address is also useful as a backup. The relationship column is important as it helps the employer understand the nature of the contact and how to approach them sensitively in an emergency.

Secondary emergency contact: A secondary contact is the person to be reached if the primary contact is unavailable. Providing a secondary contact is optional but recommended, particularly for employees who live alone or have complex personal circumstances.

Medical information: The optional medical section allows employees to disclose any health information that could be relevant in an emergency — for example, a severe food or drug allergy (particularly anaphylaxis), diabetes, epilepsy, a heart condition, or a mental health condition. This is special category data under Article 9 of the UK GDPR and must be handled with the highest degree of confidentiality. Access should be restricted to authorised first aiders and HR personnel, and the information should not be accessible to line managers or colleagues without the employee's consent. The form should make clear that providing medical information is entirely voluntary.

GP details: Including the employee's GP's name and surgery address is useful where a medical emergency results in hospital admission, enabling the hospital to obtain the employee's medical history through the NHS. This should be an optional field.

Employee declaration: The form should be completed by the employee and include a declaration confirming that the information provided is accurate, that the employee has informed their designated contacts that their data will be held by the employer, and that the employee consents to the employer contacting those persons in a genuine emergency. The declaration should be signed and dated.

HR review section: A section for HR use — recording when the form was received, who received it, and when it was entered into the personnel records — creates an audit trail demonstrating compliance with data protection obligations and health and safety best practice. An annual review date prompt ensures the information is kept current.

Data security: Emergency contact forms contain sensitive personal data and potentially special category health data. They must be stored securely — whether in locked physical filing systems or encrypted digital personnel records — and access must be restricted to authorised personnel only. Forms should not be stored in shared drives or locations accessible to colleagues.