What Is Employer Duty of Care for Business Travel?

Fourteen people died in the Andes mountains in Peru when a chartered helicopter crashed in 2016. Among them was Tomas Dusek, an investment banker sent to the region by his London employer, StormHarbour Securities LLP, to help secure funding for a hydroelectric project.

StormHarbour’s defence was straightforward: the helicopter had been chartered by their Peruvian clients from a local operator with a valid licence. Not our pilot. Not our aircraft. Not our problem.

The Court of Appeal disagreed.

Lord Justice Hamblen found that StormHarbour had breached their duty of care by failing to organise a risk assessment before the flight - one that would have flagged poor weather conditions, an overloaded aircraft, and a crew that was violating Peruvian regulations on rest time. The case - Dusek v StormHarbour Securities LLP [2016] EWCA Civ 604 - is now a landmark reference point in how UK courts think about employer duty of care for business travel.

The lesson is not that employers must eliminate all risk. The lesson is simpler and more demanding: if a risk was foreseeable, and you did nothing about it, you will answer for the consequences.

What “duty of care” actually means for business travel

Duty of care is the legal obligation to take reasonable steps to protect people from foreseeable harm. For employers, this obligation applies to their employees while they are carrying out work activities - including when those activities take them abroad.

The phrase “foreseeable harm” does the heavy lifting here. Courts do not expect employers to anticipate every conceivable mishap. They do expect employers to ask: given what we know about this destination, this journey, and this employee, what risks should we be aware of and what should we do about them?

That question has to be answered before every business trip. Not just the high-risk ones. Not just when someone is traveling to an active conflict zone. Every trip - because injuries happen in stable countries, illnesses strike in major cities, and road accidents kill more business travelers than terrorism ever has.

Employer duty of care for business travel covers the full lifecycle of a trip: from the decision to send someone abroad through to their safe return. It includes what happens before departure, during the journey, and in the response when something goes wrong.

Where the legal obligation comes from

The legal roots of duty of care go deeper than most employers realise.

Common law established the foundation. The 1937 case of Wilson & Clyde Coal Company Limited v English [1937] 3 All ER 638 confirmed that every employer has four irreducible duties toward their employees:

Providing a safe place of work
Providing a safe system of work
Providing safe equipment
Employing competent fellow employees

These duties cannot be contracted away or delegated. An employer who outsources a task to a third party does not transfer their duty of care along with the contract. That is precisely why StormHarbour was held liable despite the fact that a Peruvian charter company operated the helicopter.

The statutory layer

Common law is reinforced by statute. The most significant piece of UK legislation is the Health and Safety at Work etc. Act 1974, which places a duty on every employer to ensure, “so far as is reasonably practicable”, the health, safety and welfare of all their employees. Section 2 requires employers to provide information, instruction, training and supervision as necessary to ensure health and safety at work.

The Act does not include a geographic limit. That duty travels with your employee to Nairobi, Manila, or Mexico City.

The Corporate Manslaughter and Corporate Homicide Act 2007 raised the stakes considerably. A company can now face criminal prosecution - not just civil liability - if gross negligence in how it manages its activities causes a death. The penalties include unlimited fines and mandatory remedial orders. Individual directors and managers can also face personal liability under health and safety law if their decisions contributed to the failure.

Obligations across other jurisdictions

The UK framework is relatively well-defined, but employers with internationally mobile workforces face additional obligations:

European Union: corporate liability for failure to safeguard employee health can arise even when harm occurs abroad, with rules varying by member state
United States: OSHA’s General Duty Clause requires employers to provide a workplace free of recognised hazards likely to cause serious harm; case law has extended this to international travel situations
Australia: the Work Health and Safety Act imposes duties on businesses that cover workers regardless of location
Canada: provincial occupational health and safety legislation extends to travelling workers

If your organisation operates across multiple jurisdictions, you are likely subject to more than one of these frameworks at once. The underlying standard is broadly consistent across all of them: what would a reasonable, responsible employer have done?

The risks your employees actually face

Before looking at what you need to do, it helps to understand what you are protecting against.

Road accidents are the leading cause of non-natural deaths among international business travelers - not crime, not terrorism, not natural disasters. CDC data confirms that motor vehicle crashes accounted for 28% of all non-natural deaths among US citizens working or traveling abroad in recent years, killing 431 Americans in foreign road accidents in just 2017 and 2018 alone. The pattern holds for travelers of all nationalities. Your employee visiting clients in West Africa or South Asia faces road infrastructure, vehicle maintenance standards, and driving behaviours that are categorically different from their home country.

Medical emergencies are the second category. A cardiac event in a city with limited specialist care. A tropical infection contracted during a field visit. An injury requiring evacuation to a country with adequate surgical facilities. The logistics of responding to a serious medical crisis abroad can be complex, expensive, and time-critical.

Security risks - crime, civil unrest, kidnap for ransom, terrorism - vary substantially by destination and traveler profile. A senior executive visiting clients in a high-profile sector carries a different exposure profile than a junior engineer on a routine site visit. Both deserve assessment.

Natural disasters, infrastructure failures, and disease outbreaks complete the picture. These are not exotic edge cases - they are the disruptions that have repeatedly forced companies to activate emergency protocols in recent years.

What duty of care for employees travelling abroad requires in practice

The legal obligation translates into a set of operational requirements. None of these require a large budget or a dedicated security team. All of them require consistent execution.

Pre-travel risk assessment

Before any business trip, you need a structured assessment of the risks associated with that specific journey. This goes beyond checking a government travel advisory colour code. A proportionate assessment covers:

Destination environment: current threat levels across security, health, road safety, and natural hazards
Traveler profile: relevant vulnerabilities including health conditions, prior travel experience, sector visibility, and whether they present as a higher-value target
Journey specifics: transport modes, accommodation, planned activities, and onward travel within the country
Response capability: what in-country support exists if something goes wrong

The assessment should be documented. A written record of what you considered and decided is a meaningful part of your legal defence if an incident results in litigation.

Pre-travel briefings

Employees need substantive preparation, not just a booking confirmation. A proper pre-travel briefing covers:

The specific risks relevant to their destination and activities
Health requirements: vaccinations, medication, food and water safety guidance
Security protocols: what to do if threatened, how to reach local emergency services, and who in your organisation to contact
Insurance coverage: what is and is not covered, and the practical steps to access it
Communication schedule: check-in timing, escalation contacts, and what happens if they miss a check-in

The depth of the briefing should match the risk level. A domestic trip to a stable city does not demand an hour-long security presentation. A visit to a post-conflict region or a high-crime environment does.

Real-time monitoring and communications

Your obligation does not end when the flight departs. You need the ability to:

Know, at any point, where your travelling employees are
Push relevant alerts to them if the risk environment changes mid-trip
Reach them quickly in an emergency - and have them be able to reach you

This does not mean GPS surveillance of every movement. It does mean having a reliable system - whether a manual check-in schedule or an automated platform - that lets you account for your people and contact them when it matters. An employee who misses a check-in after a sudden deterioration in their destination’s security situation should not go unnoticed for hours.

Emergency support and evacuation

When something goes wrong, response speed matters both for your employee’s outcome and for your legal position. Adequate emergency support includes:

24/7 access to a response service that can coordinate medical and security assistance
Medical evacuation capability - the ability to move a seriously ill or injured employee to appropriate care, which in many regions means evacuation to a neighbouring country
Repatriation support once the employee can travel
Legal and consular assistance if required

The gap between organisations that have these capabilities ready and those that are trying to arrange them during a crisis is not just operational - it is the difference between a defensible duty of care and an indefensible one.

Appropriate insurance

Standard corporate travel insurance routinely excludes the coverages that matter most in a crisis. A policy designed for delayed flights and lost luggage will not cover a medical evacuation from a remote location, nor will it respond to a kidnap and ransom situation or a political violence event.

For employees traveling to elevated-risk destinations, you need to verify that your coverage includes:

Medical evacuation and repatriation with no exclusions for the destination
Malicious risk coverage: kidnap and ransom, terrorism, political violence, and CBRN exposures
Crisis response costs, not just compensation after the fact

If your standard policy excludes a country your employee is visiting, that gap is not just a commercial problem - it is evidence of a duty of care failure.

The consequences of getting it wrong

Legal liability is the most direct consequence. Civil claims for negligence following a serious injury or death can result in substantial damages awards. The Dusek case demonstrated that employers remain exposed even when the proximate cause of the harm was a third party’s failure. Liability follows foreseeability, not contract structure.

Criminal exposure is real. The Corporate Manslaughter and Corporate Homicide Act 2007 means that organisations can face prosecution when a gross management failure causes a death - and there is no upper limit on the fine.

Beyond the courtroom, the financial costs extend further: crisis response and evacuation are expensive, and a high-profile incident carries reputational consequences that affect recruitment, client relationships, and operational partnerships.

Employee trust is harder to quantify but equally important. Frequent travelers - the employees most exposed to travel risk - are often your most experienced and most commercially valuable people. They are also the most likely to leave an organisation that demonstrates it does not take their safety seriously.

What a good duty of care policy looks like

A robust travel risk management program does not need to be complicated. It needs to be systematic and consistently applied.

ISO 31030:2021 is the international standard for travel risk management. Published by the International Organisation for Standardisation in September 2021, it provides a structured approach covering policy development, risk assessment methodology, pre-travel preparation, in-travel support, and post-travel review. The standard is voluntary - no regulator will fine you for not following it - but it is increasingly the benchmark that courts, insurers, and regulators use to evaluate whether an employer’s duty of care was adequate.

A practical checklist for any organisation that sends people abroad:

Written travel risk policy, reviewed at least annually
Pre-trip risk assessment process, documented and scaled to the risk level of the destination
Traveler briefing process with records
Means to monitor traveler location and maintain two-way communications
24/7 emergency assistance, available in the destinations your people visit
Insurance coverage matched to actual risk exposure, not generic corporate travel
Post-incident review to capture lessons and update processes

If you can tick those boxes with genuine evidence behind each one, your organisation is in a substantially stronger position - legally and practically - than the majority of employers who send people abroad without a formal program.

For a deeper look at how ISO 31030 fits into this framework, see our guide: How ISO 31030 Helps You Meet Your Duty of Care.

How HAAVYN helps

HAAVYN was built around the operational realities of employer duty of care. The platform combines real-time threat intelligence covering 220+ countries across 1,200+ monitored sources, traveler tracking with two-way communications and automated check-ins, 24/7 emergency assistance with telemedicine and medical evacuation coordination, and integrated malicious risk insurance covering kidnap and ransom, terrorism, political violence, and CBRN incidents.

For HR managers, travel managers, and company directors who need to demonstrate a defensible duty of care program and respond effectively when something happens, HAAVYN provides both the tools and the audit trail that matters under scrutiny.

To see how it fits your organisation, speak to the HAAVYN team.

Frequently asked questions

What is employer duty of care for business travel?

Employer duty of care for business travel is the legal and ethical obligation to take reasonable steps to protect employees from foreseeable harm during work-related trips. It requires employers to assess risks before travel, brief employees on those risks and relevant protocols, maintain contact during travel, and provide effective emergency support when things go wrong. The duty applies regardless of destination and extends to harm caused by third parties when the employer could reasonably have identified the risk in advance.

Does UK duty of care apply to employees traveling abroad?

Yes. The Health and Safety at Work etc. Act 1974 applies to employees traveling on behalf of their employer regardless of destination. Common law duties established in cases going back to 1937 follow employees wherever they travel for work. UK courts have consistently held employers liable for incidents occurring abroad where the employer failed to take reasonable precautions - including in cases where the proximate cause of harm was a third-party contractor’s failure, not the employer’s direct action.

What are an employer’s specific obligations for international business travel?

Core obligations include: conducting a risk assessment proportionate to the destination and traveler profile before each trip; briefing employees on relevant risks and emergency protocols; maintaining the ability to contact employees and respond during the trip; providing access to 24/7 emergency assistance; and ensuring insurance coverage is adequate for the risk environment. The precise legal framework varies by jurisdiction, but the underlying standard is consistent: what would a competent, responsible employer have done?

What happens if an employer fails their duty of care for a business traveler?

Consequences range from civil negligence claims - potentially resulting in significant damages awards - to criminal prosecution under the Corporate Manslaughter and Corporate Homicide Act 2007 in the most serious cases, which carries unlimited fines. Beyond legal liability, failures can result in insurance complications, reputational damage, and lasting harm to employee trust. Courts have made clear that standard corporate travel insurance and the absence of a formal risk program are not adequate defences.

What is ISO 31030 and does it apply to my organisation?

ISO 31030 is the international standard for travel risk management, published in September 2021. It is not legally mandatory, but it provides the framework increasingly used by courts, insurers, and regulators as the benchmark for what reasonable and proportionate employer duty of care looks like. Any organisation that regularly sends employees abroad should at minimum understand the standard and assess their current program against it. See our detailed ISO 31030 guide for a full breakdown.

Do duty of care obligations extend to contractors and temporary workers?

This is an evolving area, but the trend in case law is clear: the legal test looks at whether a duty of care existed in practice, not just in the contract. Organisations that direct the work of contractors in high-risk environments - determining where they go, when they travel, and what activities they undertake - may carry obligations that go beyond their formal employment relationships. The Dusek case demonstrates that even when harm is caused by a third-party operator, the primary employer can remain liable if the risk was foreseeable and they failed to take reasonable steps to mitigate it.