Duty of care in business travel: what it means and what a company should do

Duty of care is the employer's responsibility to look after the health and safety of an employee who travels for work. In practice it answers three questions: was the risk assessed before the employee went somewhere hazardous, is it known where each traveler is during the trip, and can the employee be reached in a crisis? This article explains the concept, the official framework in Turkey, the international standard, and the routine a company can build to answer these questions.

What does duty of care mean?

Duty of care is a concept describing the reasonable care a person or organization must take so that those under its responsibility are not harmed; in Turkish it is generally rendered as "özen yükümlülüğü". In corporate travel it expresses the employer's responsibility to look after the health and safety of an employee who sets out on a business trip.

A business trip takes the employee out of the office, which the company controls every day. The employee is in a different city, a different country, under different health and safety conditions. A natural disaster, an epidemic, a political event or an ordinary accident can require the company to answer "where is our employee right now, and are they safe?" within minutes. Duty of care means having that answer prepared in advance.

The legal scope of the concept varies from country to country. This article offers no legal interpretation; the official framework in Turkey is reported with its sources, and practical suggestions are general information.

Which law sets out the employer's obligations in Turkey?

In Turkey the employer's occupational health and safety obligations are set out in Law No. 6331 on Occupational Health and Safety. The Law was adopted on 20 June 2012 and published in Official Gazette No. 28339 dated 30 June 2012. It applies to all jobs and workplaces in the public and private sectors and to all employees regardless of their field of activity; Article 2 of the Law exempts certain activities.

These are the articles that come to mind when thinking about travel safety (consolidated text on mevzuat.gov.tr, accessed 4 November 2026):

Article 4 also states that obtaining services from experts and organizations outside the workplace does not remove the employer's responsibilities. How this provision applies to the use of an agency, a travel management company or software for business travel is a legal assessment and outside the scope of this article.

How business travel falls within these articles depends on the nature of the trip and the structure of the company, and is a legal question. It should be assessed with your company's occupational safety specialist, workplace physician and legal adviser. The full text of the Law is available from the sources below.

What is the ISO 31030 travel risk management standard?

ISO 31030:2021 is the international standard that guides organizations on how to manage the risks that travel creates for the organization and for the people who travel. According to ISO's risk management technical committee (ISO/TC 262), the standard can be applied by organizations of any sector and size, and does not apply to tourism and leisure travel.

The standard builds on the principles, framework and process of ISO 31000:2018 on risk management and is consistent with the occupational health and safety management principles of ISO 45001:2018. As a guidance standard it gives companies a structure for "what should be done" and leaves individual measures to the company's own risk assessment. It is a good starting framework for a company building its travel safety routine from scratch.

What should a company do before travel?

The most important step before travel is assessing the risks of the destination and of the trip. Going to a neighboring city for a client visit and going to a country with a security advisory do not call for the same preparation. The result of the assessment should be reflected in the approval rule for the trip and in the information given to the employee.

Pre-trip checklist:

• Destination assessment: Consider the travel advisories published by countries' foreign ministries together with the company's own knowledge.
• Approval rule: Decide whose approval is needed for travel to places considered risky.
• Documents: Check that passports and visas are valid; documents close to expiry can stop a trip at the last minute. We cover this in visa and passport tracking for business travel.
• Health: Assess the health conditions of the destination and any special needs of the employee with the workplace physician.
• Contact details: Keep the employee's mobile number and emergency contact current.
• Accommodation and transport: Add safety as a criterion in the policy for the choice of accommodation area and transport.
• Briefing: Give the employee written information before departure on the risks of the destination and who to contact in an emergency.

How does travel policy contribute to employee safety?

Travel policy makes safety decisions independent of individuals. Whether an employee can book a ticket to a risky country directly is tied to a rule written beforehand rather than to a manager's decision in the moment. Every trip is then assessed by the same yardstick and the decision is recorded.

The policy engine of the Kurumsal.pro portal, which an agency opens to its corporate clients, has rules that bear directly on safety:

The outcome is chosen separately for each rule: block, send for approval if violated, send for approval always, or inform only. The risky-country list and the outcome of the rule are set by the company; the portal does not provide a ready-made risk list. Because the policy is also saved as a new version, you can later see which countries were treated as risky on which date. All rule types are on the travel policy software page, and the design of approval levels on the travel approval workflow page.

How do you answer "who is where?" in a crisis?

When news of an incident arrives, a company's first question is which employees are in that area. The fastest and most reliable answer is confirmed bookings made through the company's own channel. If bookings are made in different places, with personal cards and by email chains, the list can only be produced by calling people one by one.

The "Who is where" report in the Kurumsal.pro portal gives a starting point for this question. Based on confirmed trip records, it lists staff who are travelling today, who are abroad, and who are in the air today; the table shows person, department, city, accommodation, return date and phone. The report is limited to the role scope of the person opening it; for example, a user whose data scope is their own department sees only staff in that department. Employees can also keep an emergency contact in their profile. A short definition of the concept is in the traveler locator report entry.

Knowing the limits of this report is a prerequisite for using it properly:

• The report is not location tracking; no device location, GPS or live flight status is used.
• Only bookings confirmed in the portal appear; a ticket or hotel bought outside the portal is not in the report.
• If the travel plan changed afterwards and the change did not reach the portal, the report shows the old plan.
• The portal does not send the employee safety alerts, SMS or mobile push notifications.

The "Who is where" report is therefore a tool for pulling the first list in your emergency plan; the steps of reaching the employee, verifying their status and organizing help must be written in the plan itself. How the report is used with other reports is on the corporate travel reporting page.

What should be done during and after the trip?

During the trip the key need is that communication with the employee stays open; after the trip it is that problems experienced are recorded and reflected in the policy. Together the two stages keep a duty of care routine from being set up once and left, so that it is updated with experience.

During the trip:

• Have a contact point the employee knows how and on which number to reach.
• Reflect plan changes (flight time, hotel change) in the company's records.
• Settle in advance who pulls the relevant list and who contacts employees if an incident occurs in the area.

After the trip:

• Record delays, cancellations and health or security problems with a short note.
• Review the risky-country list and approval rules in the light of that experience.
• Publish policy changes as a new version and announce them to employees.

How is personal data protected in travel safety?

The information kept for employee safety is personal data: phone number, accommodation location, travel dates, passport details and emergency contact. Only those who genuinely need this information should have access to it, and the data must not be used beyond its purpose.

In the Kurumsal.pro portal, reports are narrowed by role scope; the "Who is where" report is seen by a person with report-viewing authority only for the staff in their own scope. ID numbers are returned masked in responses and card details are not stored. The legal framework for protecting personal data is covered in data protection in corporate travel, which also explains Turkey's data protection law (KVKK) for an international reader.

Does a corporate travel portal fulfil the duty of care?

No; a booking portal does not fulfil the obligation itself. Risk assessment, the emergency plan, informing the employee and decisions in a crisis are the company's responsibility. The portal contributes a dependable data source, created by collecting bookings in a single channel.

The contribution and the limits of the Kurumsal.pro portal can be summarised as follows:

This table helps you position the portal as one part of your travel safety routine. To look at the risky-country rule and the "Who is where" report next to your emergency plan, you can arrange a live walkthrough.