Restaurant allergen rules in the UK: the 14 allergens, Natasha's Law and how to comply

Allergen information is one of those obligations most restaurateurs half know. There is a note at the bottom of the menu, staff say "just ask", and everyone moves on. The problem is that UK law asks for more than that, and the stakes are not theoretical: an FSA-funded study published in 2024 estimated that around 6% of UK adults, roughly 2.4 million people, live with a clinically confirmed food allergy. Every one of them eats out, and they choose the places that take the subject seriously.

This guide covers what the rules actually require of a UK restaurant in 2026: the 14 allergens you must be able to declare, the Food Standards Agency (FSA) requirements for food served at the table, where Natasha's Law and PPDS labelling do and do not apply, the penalties, and a practical compliance routine that survives a busy service.

In short:

• every food business must be able to tell customers which of the 14 regulated allergens are in each dish, including specials and takeaway;
• for food served loose (plated restaurant food), the information can be written on the menu or provided by staff, but a verbal-only approach must be backed by a written notice telling customers where to ask;
• Natasha's Law (October 2021) applies to food packed before it is ordered, like grab-and-go sandwiches. Food plated after the customer orders is not PPDS;
• failure to comply is a criminal offence under the Food Information Regulations 2014, and an allergic reaction caused by wrong information can lead to prosecution;
• an allergy a guest mentions when booking is health data under UK GDPR: use it to serve the meal safely, not for marketing.

What does UK law require from a restaurant on allergens?

Two layers matter for a restaurant: the retained EU food information rules, and the UK regulations that enforce them.

The legal framework: Regulation 1169/2011 and the Food Information Regulations 2014

The foundation is assimilated Regulation (EU) No 1169/2011 on food information to consumers, which remains UK law after Brexit. It requires that customers be informed when any of the 14 regulated allergens is used as an ingredient, and, crucially for hospitality, it applies to non-prepacked food: the plates leaving your pass, the pints at the bar, the takeaway in a box.

Enforcement in England comes through the Food Information Regulations 2014, with parallel regulations in Wales, Scotland and Northern Ireland. Local authority environmental health and trading standards officers check allergen information the same way they check hygiene.

How may the information be provided for food served at the table?

For loose (non-prepacked) food, the FSA's allergen guidance for food businesses sets out two compliant routes:

1. full written allergen information, on the menu, a chalkboard or an information pack the customer can consult; or
2. verbal information from staff, provided a written notice is displayed in a clearly visible position explaining how customers can obtain it (the classic "please ask a member of staff about allergens" sign).

Note the trap: "ask the staff" only works if the sign is actually there, staff genuinely know the answers, and the answers come from a reliable, up-to-date source rather than memory. The FSA's current best practice guidance goes further and recommends that written allergen information, supported by a conversation with staff, works best for consumers. In other words: a written matrix plus a trained team, not one or the other.

This starts before the guest even sits down. Many allergic diners flag their allergy when they book a table, which is exactly where you want the information to surface: a free online booking system for your restaurant that captures notes with the booking gives the kitchen time to prepare instead of improvising mid-service.

The 14 allergens you must be able to declare

The list is fixed by law and identical across the UK. For each dish, you must know whether it contains:

1. Celery, including celeriac: stocks, soups, salads.
2. Cereals containing gluten: wheat, rye, barley, oats, spelt, kamut. Bread, batters, pasta, roux-based sauces.
3. Crustaceans: prawns, crabs, lobster, langoustines. Watch bisques and stocks.
4. Eggs: mayonnaise, fresh pasta, pastries, glazes.
5. Fish: including fish sauce, Worcestershire sauce and fish-based stocks.
6. Lupin: lupin flour and seeds, sometimes in baked goods.
7. Milk: butter, cream, cheese, and the lactose hiding in many prepared products.
8. Molluscs: mussels, oysters, squid, snails.
9. Mustard: dressings, marinades, sauces.
10. Peanuts: peanut oil, satay, many desserts.
11. Sesame: buns, houmous, tahini, sesame oil.
12. Soybeans: soy sauce, tofu, edamame, soya lecithin.
13. Sulphur dioxide and sulphites above 10 mg/kg or 10 mg/litre: wine, dried fruit, some processed meats.
14. Tree nuts: almonds, hazelnuts, walnuts, cashews, pecans, brazils, pistachios, macadamia nuts.

The legal declaration duty covers allergens deliberately used as ingredients in the recipe. Cross-contact in a small kitchen (the shared fryer, the one bread board) is a separate food safety question: where you cannot rule out a real risk, tell the customer honestly and let them decide. Guessing, or reassuring someone to close the conversation, is how incidents happen.

Natasha's Law: does PPDS labelling apply to your restaurant?

Natasha's Law is the rule restaurateurs ask about most, and the one most often misunderstood. It followed the death of Natasha Ednan-Laperouse, a teenager who suffered a fatal reaction to undeclared sesame in a pre-packed baguette.

What counts as PPDS food

Since 1 October 2021, food that is prepacked for direct sale (PPDS) must carry a full label. The FSA's introduction to allergen labelling for PPDS food defines PPDS as food "packaged at the same place it is offered or sold to consumers and is in this packaging before it is ordered or selected". The label must show the name of the food and a full ingredients list with the 14 allergens emphasised within it (bold, italics or a contrasting colour). In England the requirement was introduced by the Food Information (Amendment) (England) Regulations 2019, with equivalent regulations in Wales, Scotland and Northern Ireland.

Typical PPDS examples in hospitality:

• sandwiches, salads and cakes you wrap or box before customers order them, for a grab-and-go fridge or counter;
• fast food packed before it is ordered, such as a wrapped burger kept under a hot lamp;
• items you prepack for sale at your own market stall or food truck.

What is not PPDS: your plated food

The reassuring part: food plated and served after the customer orders it is not PPDS and needs no label. Neither is takeaway food packed after the order (that curry going into a container when the ticket comes in), nor food a customer asks you to wrap at their request. For all of that, the loose-food rules above apply instead: accurate allergen information, available in writing or through informed staff plus a written signpost.

So a classic sit-down restaurant may have zero PPDS items. But the moment you add a lunchtime fridge of pre-wrapped sandwiches or sell boxed brownies at the till, those specific items need full ingredient labels, even though the rest of your menu does not.

What happens if you get it wrong?

Let's be honest: nobody inspects every menu every week, and plenty of non-compliant signs survive for years. The risk structure is still very real, on two levels.

Enforcement. Failing to provide allergen information as required is a criminal offence under regulation 10 of the Food Information Regulations 2014. On summary conviction the penalty is a fine at level 5 on the standard scale, and since 2015 level 5 fines in England and Wales are unlimited. In practice, officers usually start with an improvement notice; ignoring it escalates to prosecution.

An actual reaction. This is the scenario that ends businesses. If a customer suffers a serious allergic reaction after being given wrong or missing information, you face potential prosecution under food safety law, civil liability, and in the worst cases manslaughter charges against individuals. Your best legal protection is the same as your best moral one: a written, up-to-date allergen record, a trained team, and a culture of checking with the kitchen rather than guessing.

There is also an upside worth stating plainly: allergic diners, and the families and groups who book around them, are intensely loyal to places that handle the subject well. Getting this right wins tables, not just inspections.

How to comply in practice: a routine that survives service

The law demands a result, not a specific format. Four building blocks cover almost every restaurant, and they combine.

An allergen matrix per dish

The core document: a grid of your dishes against the 14 allergens, built from your actual recipes and supplier labels, updated every time the menu or a supplier changes. The FSA publishes a free downloadable matrix template with its allergen guidance. An out-of-date matrix is worse than none: an allergic customer will trust it.

Menu notes or a visible written signpost

Either mark allergens dish by dish on the menu (works well for short menus that rarely change) or display the "please speak to our staff about allergens" notice prominently and make sure the written matrix backs it up. Remember the FSA's best practice: written information plus a conversation, not a shrug towards the kitchen.

A QR code that never goes stale, free with LFAllergenes

Full transparency: LFAllergenes is our own sister tool, built by Ludovic Frank, the author of this blog, because the restaurateurs around us were still managing allergens in a printed spreadsheet from three menus ago. You enter your dishes, tick the relevant allergens among the 14, and it generates a printable poster plus a QR code linking to your always-current allergen page. Change a dish online and every printed QR code stays valid. It is completely free, with no hidden paid tier, and the customer-facing page displays in English, French, German, Spanish and Italian, which is handy for tourist trade. Honest limitation: it gives you a clean, compliant support; the accuracy of what you tick is still on you, as with any tool.

Staff training, especially for specials

Every front-of-house team member should know where the allergen record lives, what to say, and the one absolute rule: never guess, always check with the kitchen. The dish of the day and specials are where systems break, because they change daily; give them the same allergen check as the printed menu, every time. Cover it at every induction and every menu change.

Allergies mentioned at booking: service and data protection

A careful allergic guest rarely waits until the table to mention their allergy: they write it in the booking notes or reply to the confirmation email. Handle that well on two fronts.

Service side. The note has to reach the kitchen on the day, not die in an inbox. A booking tool that shows guest notes on the day's service list solves this structurally: the team sees "table 12, peanut allergy" before the first order goes in. ViteUneTable's free plan sends every guest an automatic booking confirmation email, a natural moment for guests to reply with dietary needs, and the Standard pack (€29 excl. VAT/month) adds custom questions at booking, so you can ask about allergies and dietary requirements up front instead of discovering them at the table. If you are weighing up tools more broadly, see our guide to the best restaurant booking systems in the UK.

Data side. An allergy is information about someone's health, and health data is special category data under Article 9 of the UK GDPR, which prohibits processing it except in narrow circumstances. The practical rule fits in one sentence: use the allergy note to prepare and serve that meal safely, then let it go. Do not feed it into marketing segments, do not build a permanent "allergics" list, and let guests restate it at each booking rather than storing it indefinitely.

Done well, the loop from booking note to kitchen to a safely served plate turns a legal duty into your best retention tool: the guest who was served without a single anxious conversation comes back, and brings their whole table.

Frequently asked questions

Is verbal allergen information enough in a UK restaurant?

Only partially. For food served loose, staff may give the information verbally, but the law requires a written notice, clearly visible, telling customers how to obtain it, and the answers must come from a reliable written record. The FSA's best practice guidance recommends written allergen information supported by a conversation with staff.

Does Natasha's Law apply to food served at the table?

No. Natasha's Law covers prepacked for direct sale (PPDS) food: items packed on your premises before the customer orders or selects them, like grab-and-go sandwiches. Food plated after the order, or takeaway packed once the order is placed, is not PPDS. Those dishes follow the loose-food information rules instead.

What are the 14 allergens UK restaurants must declare?

Celery, cereals containing gluten, crustaceans, eggs, fish, lupin, milk, molluscs, mustard, peanuts, sesame, soybeans, sulphur dioxide and sulphites above 10 mg/kg or 10 mg/litre, and tree nuts. The list is set by assimilated Regulation 1169/2011 and applies to every dish, including specials and takeaway.

What is the penalty for missing allergen information?

It is a criminal offence under the Food Information Regulations 2014, punishable on summary conviction by a level 5 fine, which is unlimited in England and Wales. Enforcement usually starts with an improvement notice from the local authority, but a serious allergic reaction caused by wrong information can lead to prosecution and civil claims.

Do I have to warn about cross-contamination, like a shared fryer?

The legal declaration duty covers allergens used as ingredients in the recipe. But where you cannot rule out a genuine cross-contact risk, tell the customer honestly so they can decide. Never reassure an allergic guest to end the conversation; check with the kitchen every time.

Can I keep a customer's allergy on file in my booking system?

Treat it as health data under UK GDPR, a special category with extra protection. Use it to prepare and serve the meal it was given for, and avoid storing it permanently or using it for marketing. The simplest compliant habit is letting guests restate the allergy at each booking, for example through a custom question on the booking form.