Terrorism (Protection of Premises) Act 2025 1 May 2025

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. The aim is to improve protective security and organisational preparedness across the UK, by requiring people who are responsible for qualifying premises to take steps to reduce the risk of physical harm to individuals at the premises, if a terrorist attack were to occur. For larger premises and events, the responsible person must also take steps to reduce the vulnerability of the premises to terrorist attacks.

Which properties are subject to the standard duty?

• Those where there is at least one building (or the premises are in a building).
• Premises which are used for one or more of the uses specified at Schedule 1 to the Act, e.g. a restaurant, shop, hotel, school or university.
• Premises on which it is reasonable to expect that at least 200 individuals may be present at any one time.
• Premises which are not excluded under Schedule 2 to the Act, such as those that are already subject to alternative security regimes like airports.

Which properties are subject to the enhanced duty?

Those that meet the criteria set out above and, in addition, it would be reasonable to expect that at least 800 people might be present at any one time.

Which events are impacted?

• Those that take place at premises that are not enhanced duty premises.
• Those that are open to members of the public.
• Events that are expected to draw at least 800 attendees.
• There will be measures to check entry conditions are met, such as ticket checks.
• The event is not excluded under Schedule 2 to the Act.

1. What is the standard duty?

The responsible person will be required to:

• Notify the Security Industry Authority of their premises;
• and have in place, so far as is reasonably practicable, appropriate public protection procedures for staff to follow if an act of terrorism were to occur at the premises, or in the immediate vicinity. There are procedures which may be expected to reduce the risk of physical harm being caused to individuals relating to evacuation, invacuation (moving people to a safe place), locking down the premises, and communicating with individuals on the premises. These are meant to be simple, low cost activities with costs relating primarily to time spent. There is no requirement to put in place physical measures.

2. What is the enhanced duty?

The responsible person will be required to:

• Put in place the same measures for the enhanced duty;
• and have in place, so far as is reasonably practicable, ‘appropriate public protection measures’ to reduce both the premises vulnerability to an act of terrorism, and the risk of physical harm being caused to individuals if an attack were to occur there or nearby;
• document these measures and provide this document to the SIA. This document should include an assessment of how the proposed procedures and measures will reduce vulnerability and/or the risk of harm;
• and where the responsible person is not an individual, it must appoint a senior person with responsibility for ensuring that the responsible person complies with these requirements, such as a director or partner.

What might “appropriate public protection measures” involve?

• Monitoring the premises or event, and their immediate vicinity, e.g. by circulating awareness raising material to those working at the premises or event, through to installing security systems and control rooms.
• Controlling the environment of individuals into, out of and within the premises or event, e.g. by observing suspicious bags, searching and screening individuals, locks and barriers or CCTV.
• Physical safety and security measures e.g. by installing stand off zones, safety glass and hostile vehicle mitigation.
• Security of information which may assist in the planning, preparation or execution of acts of terrorism, e.g. ensuring that floor plans are held securely, and access is restricted to relevant individuals.

3. Who is the responsible person?

The responsible person is the person who has control of the premises in relation to their relevant Schedule 1 use. Where there is more than one Schedule 1 use (e.g. a hotel that also has retail units), it will be the person in control of the premises in connection with whichever Schedule 1 is the principal use. Clause 8 of the Act imposes obligations on affected parties to co-ordinate and co-operate in complying with the relevant requirements under the Act.

For example, where there is more than one responsible person for a qualifying premises or a qualifying event (e.g. where two parties jointly occupy the premises to deliver a service) they must co-ordinate, so far as is reasonably practicable, in complying with the requirements imposed on them by this Act.

Similarly, where qualifying premises form part of other qualifying premises, the responsible persons for each must co-ordinate, so far as is reasonably practicable to do so, to comply with the requirements, e.g. in a shopping centre or entertainment complex, where the occupiers of in-scope units will have to co-operate with the shopping centre operator or entertainment complex operator as required to deliver relevant procedures and measures. The individual units, where they meet qualifying premises criteria, will also have responsibility in relation to their own units.

Finally, where a person has some degree of control over enhanced duty premises or the premises for a qualifying event, but is not the responsible person, they must co-operate with the responsible person, so far as reasonably practicable, to assist them in meeting their requirements, e.g. a theatre operator might need to make alterations to the building’s structure to install safety measures and needs the landlord’s consent to do so.