Five Questions Before the Alarm Goes Live: Lone Worker Monitoring Due Diligence

The sales demonstration for a lone worker service is usually simple. A device is pressed, a call is answered and the buyer is shown a dashboard. The operational reality is a chain of decisions that runs from the alarm receiving centre to the person on the ground. Most of that chain sits in contract schedules and operating procedures that are rarely read closely during procurement.

For UK operations, the questions below are worth asking before signature. They are not designed to catch out a good provider. They are designed to make the chain auditable when an incident is reviewed by an insurer, the HSE or an internal investigation.

1. What exactly does the alarm receiving centre do when the button is pressed?

Ask for the escalation script as a contract document, not a verbal summary. It should distinguish between a panic alarm, a man-down or no-movement alert, and a routine test. It should state who the operator calls first, how long they wait, what happens if the lone worker does not answer, when a nominated manager or buddy is contacted, and when emergency services are called.

Police response cannot be assumed. The script should be clear about what the provider will do if police attendance is not available or is delayed. Ask whether the alarm receiving centre is accredited to BS 5979 or an equivalent standard, how operators are trained and how the script is version-controlled. A script that has not been reviewed since the contract started is a warning sign.

2. How is response time defined, and who measures it?

Marketing claims about response times often blend several different measurements. Device-to-centre transmission, call answering, escalation to a responder and arrival at the lone worker's location are separate stages. Ask the provider to define each one, state the target, and explain how it is measured.

Request sample monthly reports and ask where the timestamps come from. Are they from the device, the alarm receiving centre platform or a manual log? What is excluded from the calculation? A service credit is only meaningful if the definition is precise. It is also worth running a witnessed test scenario, with the provider's permission, to see how the chain behaves in practice rather than in a sales presentation.

3. What device testing is done, how often, and where are the logs kept?

A lone worker device should be tested end to end, not simply switched on. Ask whether the provider performs automatic daily or periodic tests, how failed tests are escalated, and what the user is expected to do. If workers are required to carry out weekly tests, the contract should say who checks compliance and what happens when a test is missed.

Log retention matters. The client should be able to obtain test records in a usable format for the duration of the contract and for a defined period afterwards. Confirm who owns the logs, how quickly they can be exported and whether they show the device, the network and the alarm receiving centre as separate elements. A test log that only proves the device had battery power is not evidence that an alarm would reach an operator.

4. How is location data handled under UK GDPR, and what is the retention period?

Lone worker devices can generate sensitive personal data, including location and movement. The contract should set out the lawful basis for processing, the role of each party, the retention period and the deletion process. Ask whether location is captured continuously or only when an alarm is raised. Continuous tracking may be justified for high-risk roles, but it needs a documented assessment, not an assumption.

Request the data processing terms, a list of sub-processors and the breach notification route. Confirm how subject access requests are handled and whether data is stored or routed outside the UK. Encryption is not a complete answer. The client needs to know what data is collected, why, where it goes and when it is deleted.

5. What evidence will we hold if an insurer or the HSE comes calling?

After an incident, the client needs a timeline: when the alarm was raised, when it was received, what the operator did, who was contacted and when the response arrived. Ask what incident report the provider supplies, in what format and within what timescale. Confirm that call recordings, device logs and location records can be exported and that the client has a right to retain them.

The contract should also address what happens at termination. Evidence may be needed months after the service ends. A provider that cannot supply a complete incident pack is a provider that leaves the client exposed. The point of these questions is not to create distrust. It is to make sure the button press is connected to a documented, testable and defensible response.