Preskoči na glavni sadržaj
Svi članci
POSSep 9, 2026

Does Natasha's Law apply to restaurants? PPDS food explained

Natasha's Law applies to a restaurant only when it sells food that is prepacked for direct sale (PPDS): food packed on the premises before a customer orders or chooses it, such as wrapped sandwiches, salad pots or slices of cake in a grab-and-go fridge. Dishes cooked to order, and food packed at the customer's request, are not PPDS. Since 1 October 2021, PPDS food must carry a label showing the name of the food and a full ingredients list, with any of the 14 regulated allergens emphasised.

Most restaurant menus therefore fall under the rules for non-prepacked food, which require allergen information but no label. The two sets of rules often apply in the same business, especially where a restaurant also runs a café counter, a deli or a takeaway fridge.

What is Natasha's Law?

Natasha's Law is the common name for changes to food information law that took effect across the UK on 1 October 2021. It is named after Natasha Ednan-Laperouse, a teenager who died after an allergic reaction to a baguette. Before the change, businesses could give allergen information for food packed on their own premises by any means, including verbally.

In England the change was made by the Food Information (Amendment) (England) Regulations 2019, which added PPDS rules to the Food Information Regulations 2014. Wales and Northern Ireland made equivalent regulations in 2020 and Scotland in 2021, all in force from the same date. The Food Standards Agency (FSA) publishes guidance for England, Wales and Northern Ireland, and Food Standards Scotland publishes its own.

What counts as PPDS food in a restaurant?

The FSA describes PPDS food as food packaged at the same place it is offered or sold to consumers, before it is ordered or selected. A single item is PPDS when it is fully or partly enclosed by packaging, cannot be altered without opening or changing that packaging, and is ready for sale to the final consumer.

The FSA's examples for restaurants, cafés and pubs include:

  • Sandwiches or salad boxes made and packed before service.
  • Paninis or pizza boxes packed in advance, even if they are reheated when a customer asks.
  • Pies in packaging and soup already in pots.
  • A slice of cake wrapped in cling film.
  • Drinks poured and lidded in advance to cope with a rush.

PPDS also covers food kept behind a counter, some food sold from mobile or temporary outlets, and food a business packs and then sells at another of its own sites, such as a market stall.

Which restaurant food is not PPDS?

Whether packaged food counts as PPDS depends on when it was packed and what kind of packaging it is in:

FoodPPDS?What applies
A dish cooked to order and served at the tableNoNon-prepacked rules: allergen information for all 14 allergens, which can be given verbally if customers are told where to find it
A burger wrapped for takeaway after the customer ordersNo, it was packed at the customer's requestNon-prepacked rules
A burger served in an open cardboard trayNo, the food can be altered without opening the packagingNon-prepacked rules
Unwrapped cakes on a counter, or an open salad barNo, the food is not packagedNon-prepacked rules
Crisps or biscuits packed by a manufacturer at another siteNo, this is prepacked foodThe manufacturer's full label
Sandwiches packed in the morning for a chilled displayYesFull PPDS label

Distance sales are a special case. Food sold online or by phone is outside the PPDS labelling rules, and for those sales allergen information has to be available before the customer buys and again when the food is delivered. Our guide to taking collection orders through your own restaurant website covers how to do that for click-and-collect.

What must a PPDS label show?

A PPDS label must show the name of the food and a full list of ingredients, with any of the 14 allergens emphasised each time they appear, for example in bold, capitals, a contrasting colour or underlining. The text has to be clear and legible. The prepacked rules on naming allergens apply, so the specific cereal and the specific nut must appear in the list: 'wheat flour' instead of 'gluten', 'almonds' instead of 'nuts'.

Compound ingredients need the same care. If a sandwich contains mayonnaise, the ingredients list has to show the allergens inside the mayonnaise, such as egg and mustard. Build labels from a checked recipe and the specification sheet for each bought-in ingredient, keep that recipe information in one place, and reprint labels whenever a recipe or supplier changes.

Does Natasha's Law apply to hotels, cafés and event venues?

The same test applies anywhere food is packed on site before sale. A hotel lobby fridge stocked with sandwiches made in the hotel kitchen, wrapped pastries in a coworking café and pre-wrapped hot food held under a heat lamp at an event kiosk are all likely to be PPDS. Food that is plated, or packed after the customer orders, is not.

For borderline products, the FSA publishes an allergen and ingredients food labelling decision tool, and your local authority's food team can advise on specific items.

What rules apply to food that is not PPDS?

For non-prepacked food, you must provide allergen information for every item that contains any of the 14 allergens. The law lets you give it in writing or verbally, but if you rely on staff telling customers, you must display a clear notice explaining how to get the information.

The FSA's best practice guidance, published in February 2025 for England, Wales and Northern Ireland, recommends written allergen information for all 14 allergens, backed by a conversation with staff. Following it is not a legal requirement. In a paper published on 3 September 2026 for its board meeting later in the month, the FSA said it is evaluating how the guidance has been received and that the findings will inform the design of future legislation. Local authorities enforce the allergen rules and can serve an improvement notice on a business that fails to act on their advice.

Tiquo's allergy and dietary information feature lets each service area prompt staff about allergens when an order starts or when a product with configured allergens is added, and carries the recorded requirements onto supported POS flows and kitchen outputs. Customer profiles can also hold allergy and dietary requirements for future visits. The prompts depend on accurate product information and on staff confirming the guest's needs with them.

This is general information. Check the FSA's PPDS guidance, or Food Standards Scotland's guidance in Scotland, and ask your local authority if you are unsure how the rules apply to a product.

© 2026 Tiquo. "Tiquo" i Tiquo logotip su registrirani zaštitni znakovi tvrtke Tiquo Ltd.

GDPR · CCPA · PCI DSS · ICO · Cyber Essentials Certified · EU–US DPF · SOC 2 Type II (in progress) · ISO 27001 (in progress)

Security & Operational

  • 99.99% SLA Uptime
  • AES-256 encryption at rest
  • TLS 1.3 in transit
  • AES-256 / TLS 1.3
  • Perfect Forward Secrecy (PFS)
  • HTTP Strict Transport Security (HSTS)
  • 99.999999999% (11 nines) data durability
  • Automated backups
  • DDoS protection
  • Web Application Firewall (WAF)
  • Zero Trust posture
  • Role-Based Access Control (RBAC)
  • Principle of Least Privilege
  • Secret scanning in CI
  • SBOM generation
  • Dependency supply-chain controls
  • 24/7 infrastructure monitoring
  • GDPR Article 22 safeguards
  • Data Protection Impact Assessments (DPIAs)
  • Records of Processing Activities (ROPA)
  • SAML 2.0 SSO
  • EASIE SSO
  • OAuth 2.0 / OpenID Connect (OIDC)
  • SCIM 2.0 provisioning
  • MFA / 2FA enforcement
  • Responsible disclosure / bug bounty programme

Privacy, Data Protection & Statutory Obligations

  • ICO Registered
  • UK Modern Slavery Act 2015 compliant
  • UK Public Interest Disclosure Act 1998 compliant
  • EU Article 27 Representative appointed (Paris, France)
  • Swiss FADP Article 14 Representative appointed
  • UK GDPR compliant
  • EU GDPR/DSGVO compliant
  • UK Data Protection Act 2018 compliant
  • Swiss revFADP compliant
  • CCPA / CPRA compliant (California)
  • VCDPA compliant (Virginia)
  • CPA compliant (Colorado)
  • CTDPA compliant (Connecticut)
  • TDPSA compliant (Texas)
  • OCPA compliant (Oregon)
  • MCDPA compliant (Montana)
  • FDBR compliant (Florida)
  • ICDPA compliant (Iowa)
  • ICDPA compliant (Indiana)
  • TIPA compliant (Tennessee)
  • DPDPA compliant (Delaware)
  • NJDPA compliant (New Jersey)
  • NHDPA compliant (New Hampshire)
  • NDPA compliant (Nebraska)
  • MCDPA compliant (Minnesota)
  • MODPA compliant (Maryland)
  • KCDPA compliant (Kentucky)
  • RIDTPPA compliant (Rhode Island)
  • Canada PIPEDA compliant
  • Quebec Law 25 compliant
  • Alberta PIPA compliant
  • British Columbia PIPA compliant
  • Singapore PDPA compliant
  • Hong Kong PDPO compliant
  • Brazil LGPD compliant
  • Japan APPI compliant
  • Australia Privacy Act / APPs compliant
  • India DPDPA 2023 compliant
  • Thailand PDPA compliant
  • Malaysia PDPA 2010 (as amended 2024) compliant
  • New Zealand Privacy Act 2020 compliant
  • South Africa POPIA compliant
  • UAE PDPL compliant
  • Mexico LFPDPPP compliant
  • Kenya Data Protection Act 2019 compliant
  • Ghana Data Protection Act 2012 compliant
  • Nigeria NDPA 2023 compliant
  • Indonesia PDP Law 2022 compliant
  • Philippines Data Privacy Act 2012 compliant

Global Fiscal & E-Invoicing

  • EN 16931 - EU e-invoicing core standard
  • UBL 2.1 - Universal Business Language
  • Austria - RKSV
  • Belgium - Peppol BIS 3.0 (B2B)
  • Czechia - fiscalization
  • Croatia - Fiscalization 2.0
  • Denmark - Peppol BIS 3.0 (B2B)
  • France - NF525 / LNE / Infocert, Factur-X / PDP, E-Reporting
  • Germany - KassenSichV / TSE, DSFinV-K, GoBD, E-Rechnung B2B (XRechnung / ZUGFeRD)
  • Hungary - Online Szamla
  • Italy - Scontrino, FatturaPA (via SDI)
  • Lithuania - i.SAF / i.MAS
  • Norway - Peppol BIS 3.0 (B2B), SAF-T
  • Poland - KSeF
  • Portugal - ATCUD/QR, SAF-T PT
  • Slovakia - eKasa
  • Slovenia - fiscalization (davcno potrjevanje)
  • Spain - FacturaE, SII, VeriFactu, TicketBAI
  • Sweden - SKVFS (certified cash registers)
  • Argentina - ARCA (Q4 2026)
  • Australia - Peppol PINT A-NZ (Q4 2026)
  • Brazil - NFe, NFCe, NFSe (Q4 2026)
  • Chile - SII Chile (Q4 2026)
  • Colombia - DIAN (Q4 2026)
  • Finland - Finvoice, TEAPPSXML (Q4 2026)
  • Japan - JP PINT (Peppol) (Q3 2026)
  • Malaysia - Peppol Malaysia (Q4 2026)
  • Mexico - CFDI (Q4 2026)
  • New Zealand - Peppol PINT A-NZ (Q4 2026)
  • Peru - SUNAT (Q4 2026)
  • Romania - Peppol (RO e-invoice) (Q4 2026)
  • Saudi Arabia - ZATCA (Q4 2026)
  • Singapore - Peppol BIS 3.0 (Q4 2026)
  • United Arab Emirates - Peppol (5C) (Q4 2026)

Standards & Frameworks

  • Cyber Essentials Certified
  • SOC 2 Type II - audit in progress
  • ISO/IEC 27001 - audit in progress
  • NIST Cybersecurity Framework - aligned
  • NIST Privacy Framework - aligned
  • NIST SP 800-53 / 800-63 / 800-63B - aligned
  • NIST AI Risk Management Framework - aligned
  • CIS Critical Security Controls / CIS Benchmarks - aligned
  • OWASP ASVS & OWASP Top Ten - aligned
  • ISO 25010 (quality) - aligned
  • ISO 31000 (risk) - aligned
  • ITIL - aligned
  • W3C Web Standards - aligned
  • OpenAPI Standard - aligned
  • DevSecOps practices - aligned
  • ePrivacy Directive - aligned
  • EU Whistleblowing Directive (2019/1937) - aligned

Payments Compliance

  • PCI DSS Level 1
  • PSD2 / Strong Customer Authentication
  • 3D Secure (3DS)
  • EMVCo Level 1 & 2
  • AML / KYC controls
  • Sanctions screening (OFAC, UN, EU, HMT)

International Data Transfer Mechanisms

  • EU-US Data Privacy Framework
  • EU Standard Contractual Clauses (Decision 2021/914) - Modules 2 & 3
  • UK International Data Transfer Agreement (IDTA) + ICO Addendum
  • Swiss FDPIC-recognised transfer mechanisms
  • APEC Cross-Border Privacy Rules (CBPR)

Accessibility Compliance

  • ADA (Americans with Disabilities Act) - aligned
  • European Accessibility Act (EAA) 2025 - aligned
  • WCAG 2.2 - aligned
  • EN 301 549 - aligned
  • WAI-ARIA - aligned

Platforma za hotele, spa centre, tečajeve, događanja i restorane.

Tiquo Ltd
London, Ujedinjeno Kraljevstvo

LinkedInTop Performer Spring

Koristimo kolačiće

Odaberite dopuštate li kolačiće za analitiku i oglašavanje. Možete ih prihvatiti ili odbiti. Zatvaranjem ove obavijesti odbijate ih.

Saznajte više