Policy paper

Terrorism (protection of premises) Act 2025: Standard duty requirements factsheet

Published 3 April 2025

Some requirements in the Terrorism (Protection of Premises) Act 2025 ^{[footnote 1]} apply to all qualifying premises and events. Those core requirements are the only requirements that apply to standard duty premises, which are also referred to as the “standard tier”.

This factsheet explains those requirements, which aim to ensure that persons responsible for standard duty premises are better prepared to respond to a terrorist attack so that people working at the premises can take action that might save lives and reduce harm.

Further information on which premises may be in the standard tier can be found in the scope (premises) factsheet.

The requirements for all qualifying premises and events are:

1. Notification

The responsible person for standard duty premises will be required to notify the Security Industry Authority (SIA) when they become responsible for the premises. They must also notify the SIA when they cease to be responsible.

Regulations will set out the required time for notifying the SIA, and what information must be provided about the responsible person and the premises.

2. Public protection procedures

The responsible person for standard duty premises will be required to ensure that, so far as is reasonably practicable, appropriate public protection procedures are in place at the premises.

Public protection procedures are procedures of a type set out in the legislation that may be expected to reduce the risk of physical harm to individuals if an act of terrorism occurred at the premises or in the immediate vicinity. They are procedures to be followed by people working at the premises where they suspect an act of terrorism is occurring, or is about to occur, at the premises or in the immediate vicinity.

The four types of procedures that must be put in place, as appropriate and so far as is reasonably practicable, are:  

• evacuation: the process of getting people safely out of the premises
• invacuation: The process of bringing people safely into, or to safer parts of, the premises
• lockdown: the process of securing the premises to prevent individuals entering or leaving the premises, e.g. to restrict or prevent entry by an attacker by locking doors, closing shutters or using available barriers
• communication: the process of alerting people on the premises to the danger, e.g. providing instructions to remain in place or move away from any danger.

When considering the procedures in place, the responsible person needs to consider what is appropriate and reasonably practicable for their premises. This will involve consideration of the nature of the premises and resources available. The Act does not require physical alterations or the purchase of equipment for the purpose of having these procedures in place.

The requirement has been designed with the intention of being simple for the responsible person to follow and guidance will support the consideration of reasonably practicable public protection procedures.

As part of ensuring that public protection procedures are in place, people working at the premises must be made aware of the procedures so that they can be ready to put them into practice. For example, it would not be sufficient to have an evacuation procedure in place if no one working at the premises understood how to follow it.

Appropriate and reasonably practicable

Reasonably practicable is a concept found in other regimes, such as Fire Safety and Health and Safety. In determining what is reasonably practicable, the responsible person will need to take into account their particular circumstances, including the nature of the premises and the resources available to them.

Ultimately, what is appropriate and reasonably practicable will be a consideration at each of the individual premises in scope. The particular procedures in place at one location may not be appropriate and reasonably practicable at another.

There may also be premises or events where taking forward a particular procedure is not feasible. For example, at premises that consist of only one room, there may not be a safe place to which individuals could be moved – i.e. where there is a lower risk of harm – and so what is an appropriate and reasonably practicable invacuation procedure would take that into account.

Procedures may differ at a shop that can reasonably expect to have no more than 200 people (including staff numbers) on the premises at any one time from a restaurant that can seat 400 people. Procedures should be tailored to the specific circumstances of the premises. For example:

A 200-capacity (including staff numbers) shop may assess that it is appropriate and reasonably practicable to put in place the following public protection procedures:

• evacuation - there will be one route through the main entrance that leads into the car park at the front of the shop and another through the back door that leads into an exterior area

• invacuation - bring individuals into the main floor of the shop and into the back storage room, that has secure windows and a modern lock that is routinely checked

• lockdown - a sophisticated process would not be required. As such, it is sufficient for a nominated person to simply use the lock on the front door in the event of an attack occurring outside

• communication - met by setting out the above procedures in a one-page summary and circulating with relevant individuals that work at the shop

• supporting activities - a poster summarising the procedures is placed in a private staff area of the shop and a landline is present

• the procedures are reviewed annually

A 400-seater restaurant may assess that it is appropriate and reasonably practicable to put in place the following procedures:

• evacuation - there will be one route via through the main entrance that leads onto public pavement and another through a side door that leads into an alley

• invacuation - bring individuals into the main restaurant area and, if needed, into a variety of staff areas

• lockdown - nominated individuals knowing when (i.e. when their shift manager instructs them to) and how to quickly lock and barricade doors, close window shutters and turn off lights

• communication – met by ensuring staff know who will enact procedures (shift manager) and planning how to communicate with customers present at the restaurant, were an attack to occur

• supporting activity - new members of staff are provided a short awareness briefing on the restaurant’s procedures at induction (alongside health and fire safety inputs)

• the procedures are reviewed annually

Effective procedures

Procedures should be communicated to all those who need to be aware of them, i.e. the people who must implement them effectively in response to a suspected incident. This may include employees, volunteers and contractors as well as those hiring premises. 

How these people are made aware of the procedures and measures in place will depend on the particular circumstances of the premises or event (including the nature of use and types of people working there) and available resources. For example, the responsible person may require relevant employees to attend instructional training, or receive appropriate briefing.

Footnotes

1. The Act was granted Royal Assent on 3 April but these requirements have not yet been commenced. This means that they are not yet in force and so do not need to be complied with until brought into force by regulations. ↩