Workplace drug testing: what UK employers need to know

Drug and alcohol testing at work is lawful in the UK, but it is more constrained than many employers assume. Getting it wrong creates exposure under both employment law and data protection law.

This is general information, not legal advice. Anything that could lead to disciplinary action is worth running past an employment solicitor first.

You need consent, and a policy

You cannot test an employee without their consent. In practice consent comes through a drug and alcohol policy that forms part of the employment contract, which employees have seen and agreed to.

A workable policy sets out:

• Why testing happens, and what the business is trying to protect
• Who is covered — everyone, or only safety-critical roles
• When testing occurs: pre-employment, for cause, post-incident, random
• How samples are collected and by whom
• What happens after a positive result, including confirmatory testing
• What support is available, and how the process handles dependency

Introducing testing where none existed is a change to terms and should be consulted on, not imposed.

Proportionality is the test

Under UK GDPR, drug test results are special category health data. Processing them needs a lawful basis under Article 6 and a separate condition under Article 9, and the ICO expects testing to be proportionate to a genuine risk.

That distinction matters. Testing a scaffolder or an HGV driver is easy to justify on safety grounds. Random testing of office staff with no safety-critical duties is much harder to defend, and the ICO has been clear that employers should not collect more health data than the risk warrants.

A data protection impact assessment is the sensible step before starting a testing programme.

Screening results are presumptive

This is where employers most often go wrong.

A rapid on-site test is a screening test. It indicates a substance may be present above a cut-off. It is not evidential and it is not a confirmed result.

Screening tests can produce false positives, including from legitimate prescription and over-the-counter medication. Acting on a screening result alone — dismissing someone, withdrawing an offer — is difficult to defend at tribunal.

The correct sequence is: screen on site, then send any non-negative sample to a UKAS-accredited laboratory for confirmatory testing, with a documented chain of custody. Act only on the confirmed result.

Detection windows

Worth understanding, because they affect what a result actually tells you:

• Alcohol — hours
• Cocaine — typically 2 to 4 days
• Cannabis — several days after occasional use, potentially weeks in regular users, because THC is stored in fat

A positive cannabis result does not mean someone is impaired now. It means they have used at some point within a wide window. If your concern is impairment at work, that gap matters.

Handling a confirmed positive

• Follow your policy consistently — inconsistency is what tribunals seize on
• Meet the employee and hear their explanation, including any prescribed medication
• Consider whether dependency is involved; addiction may be treated as a health issue and, in some circumstances, may engage disability protections
• Keep confidential records of the test, the confirmation, meetings and decisions
• Consider occupational health referral or support before disciplinary action

Practical points

Store kits within date and at the stated temperature. Train whoever administers tests. Keep results out of general HR files and restrict access. Set a retention period and stick to it — indefinite retention of health data is hard to justify.