Duty of Care in Business Travel: An Employer Checklist

Short answer: Duty of care in business travel is an organisation's responsibility to protect its people from foreseeable harm, and it does not stop when an employee boards a plane. In practice, it means assessing risk before a trip, checking documents and health needs, and knowing where travellers are. It also means being able to reach them, having a plan for emergencies and learning from incidents afterwards. ISO 31030:2021 gives a widely referenced framework for this. This article is general guidance, not legal advice; obligations differ by country, so check with your legal and health and safety advisers.

What duty of care in business travel means

The idea is simple: if you send someone somewhere for work, you take reasonable steps to keep them safe there. How that is defined in law varies. ISO 31030 describes duty of care as the moral responsibility or legal obligation of an organisation to protect its travellers from hazards and threats. It notes that the duty can arise from negligence, contract or statute. Law-firm commentary on US practice, for example, points out that an employer's safety obligations to employees generally cannot be handed off to a third party simply because a travel provider is involved.

In other words, outsourcing bookings does not outsource responsibility. A travel management company or platform can help, but the organisation still owns the policy and the decisions.

What ISO 31030 adds

ISO 31030:2021, "Travel risk management — Guidance for organizations", was published by the International Organization for Standardization in September 2021. According to ISO, it applies to organisations of any sector or size and covers how to manage risks to the organisation and its travellers from business travel. It sets out a structured approach that runs from policy and programme design to threat identification, risk assessment and treatment.

Two points worth knowing:

It is a guidance standard, not a certification scheme.
Its value is in giving you a recognised structure: if you ever need to show how you assessed and managed travel risk, following an established framework helps.

The risks to plan for

Travel risk is broader than security incidents:

Health: illness, accidents, access to medication, vaccination requirements.
Security: conflict, crime, civil unrest.
Natural hazards: earthquakes, floods, extreme weather.
Transport disruption: cancellations, long delays, strikes. If your people fly to or from Türkiye, see our guide to passenger rights in Türkiye.
Documents: expired passports, missing visas, changing entry rules.
Information security: lost laptops, unsafe networks, device inspections at borders.

The same destination can carry different risk for different travellers: a first-time international traveller, someone with a medical condition, or an experienced field engineer.

Duty of care checklist

Before the trip

Assess the destination. Check current conditions. Define which destinations need extra approval and which are off-limits.
Check documents. Passport validity, visa requirements and entry conditions. Rules depend on destination and passport; always check the destination's official sources.
Check health needs. Vaccinations, travel medical insurance, regular medication.
Collect contact details. The traveller's phone during the trip, where they are staying, and an emergency contact.
Brief the traveller. Basic information about the destination and exactly who to call in an emergency.
Book through known channels. Trips booked outside company channels are the ones you cannot see when something happens.

During the trip

Know who is where. You should be able to answer "who is in city X today?" from a reliable record, not from a round of messages.
Stay reachable. Agree how the company reaches the traveller and how the traveller reaches the company, at any hour.
Handle changes quickly. When a flight is cancelled or plans change, rebooking should not depend on one person being at their desk.

After the trip

Record incidents. What went wrong, and what would have helped?
Update the policy. Add notes on hotels, areas or routes for the next traveller, and adjust rules where needed.

A one-page emergency procedure

You do not need a large security programme to start. Every company can write a one-page procedure covering:

Who is responsible: the first person to call at the company when something happens, a backup, and out-of-hours contact details.
Who the traveller calls: the company emergency number, the travel insurer's assistance line and, if needed, their country's embassy or consulate at the destination.
Who is where: how you produce a list of everyone in an affected area quickly.
Contact order: if the traveller cannot be reached, who is called next (hotel, local partner, emergency contact).
Decision rights: who can decide to shorten a trip, change the route or bring a traveller home, and how the cost is covered.
Records: what happened, which decisions were made and what was spent.

Keep it short and current, share it with frequent travellers, and walk through it at least once a year as a tabletop exercise so the gaps show up before a real incident does.

Traveller data: protect it too

Duty of care requires data: passport numbers, dates of birth, itineraries, sometimes health information. That data needs protecting as well.

Collect only what you need, and use it only for the purpose it was collected for.
Limit access. An approver needs the itinerary, not necessarily the passport number. Role-based access makes this practical.
Treat health data with extra care. Many data protection laws treat it as a special category with stricter rules.
Check cross-border transfer rules. Sending passenger data to airlines and hotels abroad is a cross-border transfer under many regimes, including the EU GDPR and Türkiye's KVKK.
Set retention periods. Do not keep travel data longer than you need it.

Building duty of care into your travel policy

Your travel policy should include:

Extra approval or a ban for high-risk destinations,
Travel insurance requirements,
Contact and emergency procedures,
Who can see traveller data and why,
How responsibility works when personal days are added to a business trip (often called "bleisure").

Our guide on how to write a corporate travel policy includes these sections in its outline.

How Kolay Seyahat's corporate panel helps

Destination rules: add extra approval or a block for high-risk countries in your travel policy (travel policy).
Documents: passport and visa documents are kept in one place with expiry warnings, alongside a country-by-country visa guide and checks before the search (passport and visa tracking).
Who is where: approved trips appear in one list, so you can see from booking records who is travelling where and when.
Data protection: two-step sign-in, role-based screens, an audit log and employees' rights over their own data (security and data protection).

Frequently asked questions

Is duty of care a legal requirement?

In many countries, employers have legal obligations for employee health and safety that extend to work travel, but the exact scope depends on local law. Ask your legal adviser what applies to you.

Do we need ISO 31030 certification?

ISO 31030 is guidance and is not designed for certification. You can use it as a framework for your travel risk management programme.

Does using a travel management company cover our duty of care?

A provider can support you with bookings, tracking and assistance, but the organisation generally remains responsible for its policies and decisions.

Does duty of care apply to personal days added to a business trip?

This is a grey area and there is little definitive case law. Write a clear rule into your policy and get legal advice for your situation.

What is the first step for a small company?

Make sure every trip is booked through a channel you can see, keep passport and contact details current, and write a one-page emergency procedure. Then build from there.

Sources

Cover photo: Yender Fonseca / Pexels