Policy paper

Terrorism (protection of premises) Act 2025: Enhanced duty requirements factsheet

Published 3 April 2025

This factsheet explains the requirements that apply to enhanced duty premises and qualifying events under the Terrorism (Protection of Premises) Act 2025[footnote 1]. These are also referred to as the 鈥渆nhanced tier鈥�.

Further information on the premises or events that may be in the enhanced tier can be found in the scope (premises) factsheet and the scope (events) factsheet.

As explained in the standard duty requirements factsheet, the requirement to have in place appropriate public protection procedures applies to all qualifying premises as well as qualifying events. These procedures will help those in scope to prepare for action to be taken in the event of an attack.

Due to the greater number of people present at premises and events in the enhanced tier, the impact of a successful attack is likely to be more significant and so responsible persons are also required to have in place, so far as is reasonably practicable, public protection measures. These measures must be appropriate to further the objectives of reducing vulnerability and reducing the risk of physical harm, thereby providing better protection from acts of terrorism.

The requirements for premises and events in the enhanced tier are:

1. Notification

The responsible person for enhanced duty premises or qualifying events must notify the Security Industry Authority (SIA) when they become responsible for the premises or event. They must also notify the SIA when they cease to be responsible.

Regulations will set out the required time for notifying the SIA, and what information must be provided about the responsible person and the premises or event.

2. Designate a senior individual

Where the responsible person for enhanced duty premises or a qualifying event is not an individual, they must designate a senior individual. This must be someone who has responsibility for聽managing the affairs of the relevant body as a whole, such as a director or partner, rather than a lower-level employee.

The primary function of the senior individual is to ensure that the responsible person (the body) complies with the relevant legislative requirements, which serves a wider objective of engaging senior management in decision-making relating to the requirements of this Act. The senior individual does not need to take responsibility for carrying out actions to fulfil the requirements but should have overall responsibility within the body that is the responsible person.

The senior individual is not liable for an organisation鈥檚 failure to meet requirements. However, senior officers (including the senior individual) may be liable to prosecution under the Act if their organisation commits an offence and it is proved that the offence was committed with their consent, connivance or occurred as a result of their neglect.

Public protection procedures and measures

Public protection procedures

The responsible person for enhanced duty premises and events will be required to ensure that, so far as is reasonably practicable, appropriate public protection procedures are in place at the premises or event.

Public protection procedures are procedures of a type set out in the legislation that may be expected to reduce the risk of physical harm to individuals if an act of terrorism occurred at the premises or in the immediate vicinity. They are procedures to be followed by people working at the premises or event where they suspect an act of terrorism is occurring, or is about to occur, at the premises, the event, or in the immediate vicinity.

The four types of procedures that must be put in place, as appropriate and so far as is reasonably practicable, are:聽

Evacuation The process of getting people safely out of the premises or event.
Invacuation The process of bringing people safely into, or to safer parts of, the premises or event.
Lockdown The process of securing the premises or event to prevent individuals entering or leaving the premises/event, e.g. to restrict or prevent entry by an attacker by locking doors, closing shutters or using available barriers.
Communication The process of alerting people on the premises or at the event to the danger, e.g. providing instructions to remain in place or move away from any danger.

When considering the procedures in place, the responsible person will need to consider what is appropriate and reasonably practicable for their premises or event. This will involve consideration of matters such as the nature of the premises or event and resources available. The Act does not require physical alterations or the purchase of equipment for the purpose of having these procedures in place. The requirement has been designed with the intention of being simple for the responsible person to follow.

As part of ensuring that public protection procedures are in place, people working at the premises or event must be made aware of the procedures so that they can be ready to put them into practice. For example, it would not be sufficient to have an evacuation procedure in place if no one working at the premises or event understood how to follow it.

Public protection measures

The requirements for enhanced duty premises and qualifying events are designed to ensure that mitigations are in place to provide greater protection against acts of terrorism. This is achieved through the requirement to have in place, so far as is reasonably practicable, appropriate public protection measures of the four types specified in the Act.

To be appropriate, the responsible person should ensure that the public protection measures that they put in place are tailored to the particular premises or event and the objectives set out in the requirement, which are:

1. To reduce the vulnerability of the premises or event to acts of terrorism, and

2. To reduce the risk of physical harm being caused to individuals if an act of terrorism occurred at the premises or event or nearby.

Deciding what is appropriate and reasonably practicable should take account of how the organisation operates at the premises or event, their resources and control, and the types of terrorist attack that could occur there. The effect of all measures together should be considered to form an accurate understanding of how vulnerabilities will be reduced and the impact of a terrorist attack potentially mitigated. 聽聽聽

The measures in place will vary between different types of qualifying premises and events and may be implemented through people (e.g. training), processes (e.g. a bag search policy) or physical measures (e.g. CCTV).

The four types of measures are:聽

1. Measures in relation to monitoring the premises or event, and their immediate vicinity:

  • monitoring measures focus on identifying and reporting signs of suspicious behaviour and items and other potential indicators of terrorist attacks. Examples of such measures may range from circulating awareness-raising material to those working at the premises or event to CCTV and other monitoring systems

2. Measures in relation to controlling the movement of individuals into, out of and within the premises or event:

  • movement measures focus on mitigations to protect members of the public whilst they enter, are within and exit the premises or event. Examples of such measures may range from processes for observing suspicious behaviour and items on entry to the premises to searching and screening individuals and barriers

3. Measures in relation to the physical safety and security of the premises or event:

  • physical safety and security measures focus on strengthening premises and events to mitigate the impact of certain types of attack and/or deter or hinder attackers. Examples of such measures may include stand-off zones (a designated area to place distance between one location and another), safety glass and hostile vehicle mitigations (HVM)

4. Measures in relation to the security of information:

  • this focuses on understanding the sensitivities of information which may assist in the planning, preparation, or execution of acts of terrorism, particularly what is appropriate to share, where and who with. It may include key information about the premises or event, operating environment, design or usage that could reveal vulnerabilities. An example of this measure is ensuring that sensitive information such as floor plans are held securely, and access is restricted to relevant individuals

Guidance will support the understanding of public protection procedures and measures.

Appropriate and reasonably practicable

Reasonably practicable is a concept found in other regimes, such as Fire Safety and Health and Safety. In determining what is reasonably practicable, the responsible person will need to take into account their particular circumstances including the nature of the premises or event and the resources available to them.

Ultimately, what is appropriate and reasonably practicable will be a consideration at each of the individual premises or event in scope. The particular procedures and measures in place at one location may not be appropriate and reasonably practicable at another.

For example, procedures and measures will differ at a cinema where it can be reasonably expected that there will be no more than 1,000 people (including staff numbers) present at any one time from those at a stadium seating 20,000 people.

Procedures and measures should be tailored to the specific circumstances of the premises or event. For example:

A 1,200-capacity theatre may take forward the following activities in relation to implementing their public protection procedures and measures:

  • developing and implementing plans for public protection procedures and ensuring that they are routinely rehearsed

  • ensuring that induction and probation periods for new staff include awareness training packages for all those working at the theatre in roles relating to safety, security and counter-terrorism

  • developing policies for perimeter and entry checks as well as queue management and ticket checks

  • using internal radio systems and mobiles for communication between relevant individuals working at the theatre

  • introducing interim tabletop activities and walk-through scenarios that are designed and led by designated individuals

  • employing a mixture of salaried and contracted door staff to sufficiently protect ingress and egress areas

  • developing policies for suspicious or restricted items including bag checks and storage

  • having effective CCTV with an adequately staffed monitoring and control room

This list is non-exhaustive and subject to change over time.

Effective procedures and measures

Procedures and measures should be communicated to all those who need to be aware of them, i.e. the people who must implement them effectively in response to a suspected incident. This may include employees, volunteers and contractors as well as those hiring premises.聽

How these people are made aware of the procedures and measures in place will depend on the particular circumstances of the premises or event (including the nature of use and types of people working there) and available resources. For example, the responsible person may require relevant employees to attend instructional training.

Documenting compliance

A person responsible for enhanced duty premises or qualifying event must record the following information in a tailored document:

  • the public protection procedures that are in place, and/or which will be put in place;

  • the public protection measures that are in place, and/or which will be put in place; and

  • reasoning as to how those public protection procedures and measures reduce the vulnerabilities and/or risk of harm, were a terrorist attack to occur

The document must be kept up to date. It should focus on the totality of the procedures and measures in place and contain the necessary detail to enable the SIA to make an initial evaluation of compliance. This might form part of a remote assessment or support an on-site inspection, for which it is critical that the SIA can develop a clear understanding of the vulnerabilities of the premises or event to different types of attack.

The document should be provided to the SIA as soon as reasonably practicable after it is prepared for the first time and within 30 days of any revision.

  1. The Act was granted Royal Assent on 3 April but these requirements have not yet been commenced. This means that they are not yet in force and so do not need to be complied with until brought into force by regulations.聽鈫�