Natasha's Law Three Years On: How Compliant Are UK Food Businesses?
Natasha's Law has been in force for three years. Enforcement data and industry surveys reveal a mixed picture — many businesses still have gaps. Here's what the evidence shows.
October 2024 marked three years since Natasha's Law came into force. Enforcement data from local authorities and industry surveys reveal significant ongoing non-compliance — particularly among small and independent food businesses.
What Enforcement Data Shows
Local authority data published by the FSA shows that allergen labelling remains one of the top non-compliance areas identified during food business inspections. Bakeries, delis, and meal prep operations continue to generate the highest number of non-compliance notices. The most common violations: no ingredient list on PPDS products; allergens not emphasised within ingredient lists; and outdated allergen information that doesn't reflect current recipes.
Why Non-Compliance Persists
Industry surveys identify three main reasons small food businesses haven't fully complied. First, ongoing confusion about the boundary between PPDS and loose food — many businesses aren't sure which of their products require Natasha's Law labels. Second, the practical burden of maintaining accurate ingredient lists across a varied product range with frequent changes. Third, a perception that enforcement won't reach small operators — a misconception that has been corrected by real enforcement actions targeting independent businesses.
The Good News: Larger Businesses Are Largely Compliant
Among medium and large food manufacturers, bakery chains, and national catering operations, Natasha's Law compliance is now broadly achieved. These businesses had the resources to invest in compliance programmes from 2021. The remaining gap is in the long tail of small independent food businesses — many of which remain non-compliant.
Getting Compliant Now
If your business has been deferring Natasha's Law compliance, the risk of continued deferral is now higher than the cost of compliance. The tools to get compliant — allergen management software, label printing services, and online compliance tools — are more accessible and affordable than they have ever been.
Get Natasha's Law compliant today with SaltAI's allergen management tools for Shopify.
What the Enforcement Actions Actually Look Like
Many small food business owners still carry a vague assumption that Natasha's Law enforcement is reserved for large retailers or high-profile incidents. The reality on the ground is quite different. Local authority environmental health officers are conducting routine inspections that explicitly include allergen labelling checks, and PPDS products without compliant labels are generating formal improvement notices at independent bakeries, farm shops, and market traders across the UK. These are not hypothetical scenarios — they are documented enforcement outcomes.
The consequences of receiving an improvement notice extend beyond the immediate administrative burden. Businesses that fail to address a notice within the specified timeframe can face prosecution, and in some cases civil liability exposure if an allergic reaction occurs in the interim. The reputational damage from a public enforcement action — particularly in an era when local authority inspection outcomes are increasingly visible online — can significantly outweigh the cost and effort of achieving compliance in the first place.
It is also worth noting that enforcement activity tends to increase following high-profile allergen incidents in the media. When a serious allergic reaction makes national news, local authorities often face pressure to demonstrate active enforcement within their areas. Small independent businesses operating without compliant labelling are the most visible and easiest targets for improvement notices during these periods of heightened scrutiny. Waiting for a quiet enforcement environment is not a reliable long-term strategy.
Understanding the PPDS Boundary in Practice
One of the most persistent sources of confusion for small food businesses is precisely where the PPDS definition begins and ends. Prepacked for direct sale means food that is packed on the same premises from which it is sold, before a customer orders it — a wrapped brownie in a bakery cabinet, a labelled salad pot in a deli counter, or a portioned meal ready for collection. If a customer can pick it up without any additional preparation or interaction, it almost certainly qualifies as PPDS and requires a full ingredient list with allergens emphasised.
The boundary becomes genuinely complicated for businesses that operate across multiple formats. A café that sells the same traybake slice both loose at the counter and pre-wrapped in a to-go fridge needs to apply different rules to each format. The loose slice at the counter falls under loose food allergen information requirements — verbal or written provision on request. The pre-wrapped slice in the fridge is PPDS and requires a compliant label. Getting this distinction wrong in either direction creates a compliance problem, whether that means under-labelling PPDS products or over-engineering processes for genuinely loose food.
For businesses that sell online or through click-and-collect models, the picture is more complex still. Food prepared and packed at the business premises before the customer arrives to collect it will typically be PPDS. Food assembled and packed at the point of the customer's arrival — where the packing happens in response to the order — may fall outside the PPDS definition. The FSA's published technical guidance covers these scenarios, but many small business owners have not worked through the guidance in detail. Taking an hour to map your product range against the PPDS definition is one of the most valuable compliance exercises a food business can undertake.
How Recipe Changes Create Hidden Compliance Risks
A frequently overlooked dimension of ongoing non-compliance is the dynamic nature of food production. A business that achieved full allergen labelling compliance in October 2021 may have quietly drifted out of compliance since then through routine recipe changes, supplier substitutions, or the introduction of new product lines. An ingredient list that was accurate three years ago may now be incorrect if a supplier reformulated a base ingredient, a new allergen was introduced to a shared production environment, or a recipe was adjusted without a corresponding label update.
This is particularly acute for businesses using multi-ingredient bought-in components — spice blends, sauce bases, pastry mixes, and similar products where reformulation by the supplier does not always generate a proactive notification to the customer. A small food business relying on a bought-in curry paste, for example, may not realise that the supplier has introduced a new ingredient containing one of the 14 major allergens until they happen to check the packaging. If the business's own product labels are derived from an older version of the supplier's specification, those labels are now non-compliant regardless of original intent.
Building a review process into your operations — where ingredient lists are checked against current supplier specifications at regular intervals, and whenever a recipe or supplier changes — is the practical solution to this problem. Allergen management software that links product labels to ingredient records makes this process significantly more manageable, because a change to an ingredient record automatically flags every affected product for review. Manual systems of spreadsheets and printed label templates tend to fail precisely because the link between the ingredient record and the output label is only as strong as the operator's memory and discipline.
Selling Online and Natasha's Law
For food businesses selling through an online channel — whether their own website, a third-party marketplace, or a Shopify store — Natasha's Law compliance has a digital dimension that is often overlooked. The physical label on the product must be compliant, but the product listing itself also needs to carry accurate allergen information so that customers can make informed decisions before purchasing. A customer with a severe nut allergy ordering online cannot inspect the physical label before the product arrives — the online listing is their only point of allergen information at the moment of purchase.
The FSA's guidance on distance selling makes clear that allergen information must be provided before the purchase is completed, either on the product listing page or through a clearly signposted mechanism. For Shopify merchants selling PPDS or packaged food products, this means allergen information needs to be embedded into the product page in a form that is accessible, accurate, and kept up to date. A text note at the bottom of a product description that hasn't been reviewed since launch is not a robust approach, particularly if the recipe has changed since that description was written.
Tools like Allergen Matrix are built specifically to address this gap for Shopify merchants. By managing allergen data at the product level within Shopify, they allow food businesses to display accurate, formatted allergen information on every product page — reducing both the compliance burden and the risk of customer harm. For small food businesses building or growing an online sales channel, integrating allergen management into the Shopify store from the outset is considerably easier than retrofitting it after a range has grown to dozens of products.
What Good Compliance Looks Like in a Small Business
Good allergen compliance in a small food business is not a one-time project — it is an ongoing operational discipline. It means having a clear, documented list of every product you sell and its current ingredients. It means knowing which products are PPDS, which are loose, and which are pre-packaged in a conventional sense. It means having a process for reviewing that information when recipes change, when suppliers change, and when new products are introduced. And it means producing physical labels and digital listings that accurately reflect the current ingredient record.
For most small food businesses, this level of discipline is achievable without significant investment, provided the right systems are in place. The businesses that struggle with ongoing compliance tend to be those managing allergen information across disconnected tools — one spreadsheet for recipes, a separate template for labels, and no formal link between the two. Bringing these into a single system, even a simple one, dramatically reduces the likelihood of labels drifting out of sync with actual recipes.
Three years in, Natasha's Law compliance is no longer a new obligation that businesses are adjusting to — it is an established baseline expectation. The businesses that have not yet achieved full compliance are not facing a new challenge; they are carrying an accumulated risk that grows with every inspection cycle and every recipe change made without a corresponding label update. The cost of getting compliant today is lower than it has ever been.
Try Allergen Matrix free at saltai.app — no credit card required.
SaltAI Team
SaltAI builds focused Shopify apps for food merchants and general merchants. Every app is tested in production at a real food store — including Vanda's Kitchen — before it ships.