Policy paper

Terrorism (Protection of Premises) Act 2025: Standard duty requirements factsheet

Updated 24 July 2026

Some requirements in the Terrorism (Protection of Premises) Act 2025 ^{[footnote 1]} apply to all qualifying premises and events. For standard duty premises (more commonly referred to as standard tier premises), these requirements are the only ones that apply, whilst enhanced tier premises and qualifying events have additional requirements to comply with (see enhanced tier requirements factsheet or chapters 7 and 8 of the statutory guidance.

This factsheet explains those requirements, which aim to ensure that those responsible for qualifying premises or qualifying events can take action that will reduce the risk of physical harm caused by a terrorist attack.

Further information on which premises may be in the standard tier can be found in the scope (premises) factsheet and chapter 4 of the statutory guidance.

The requirements for all qualifying premises and events are:

1. Notification

The responsible person will be required to notify the Security Industry Authority (SIA) when they become responsible for the premises, when they cease to be responsible, and when information previously notified becomes inaccurate.

Regulations and associated guidance will set out the required time and format for notifying the SIA, and what information must be provided in that notification.

2. Public protection procedures

The responsible person for all qualifying premises and qualifying events must ensure that appropriate public protection procedures are in place at the premises, so far as is reasonably practicable.

Public protection procedures are sets of actions that staff can take if they suspect an act of terrorism is occurring, or is about to occur, at the premises, at the event or in the immediate vicinity.

The four types of procedures that must be in place, as appropriate and so far, as is reasonably practicable, are:  

Evacuation

The process of getting people away from danger by moving them out of the premises or event (or part of the premises or event).

Invacuation

The process of moving people away from danger to a place within the premises or event where there is less risk of physical harm being caused to them. This can include bringing people into the premises or event from the outside or moving people from one part of the premises to another, where it is safe to do so.

Lockdown

The process of securing the premises or event to prevent individuals entering or leaving (for example, to restrict or prevent the movement of an attacker by locking doors, closing shutters or using available barriers).

Communication

The process of ensuring information is provided to individuals at the premises or event (for example, alerting people to danger as quickly as possible and providing instructions to remain in place or move away, where it is safe to do so).

When considering the public protection procedures in place, the responsible person must consider what is appropriate and reasonably practicable for their premises in relation to each public protection procedure. This will involve consideration of the nature of the premises and resources available. The Act does not require physical alterations or the purchase specific equipment relating to putting public protection procedures in place. However, it may be that in certain circumstances it is reasonably practicable to do so, and this will depend on the context of the qualifying premises or event.

As part of ensuring that appropriate public protection procedures are in place, people working at the premises must be made aware of the procedures so that they can be ready to put them into practice. For example, it would not be sufficient to have an evacuation procedure in place if no one working at the premises understood how to follow it.

Appropriate and reasonably practicable

The responsible person must consider what is appropriate and reasonably practicable in relation to each public protection procedure

‘Appropriate’ means ensuring procedures are suitable, taking account of the context of the premises or event and avoiding a one-size-fits-all approach. To then establish what is reasonably practicable and therefore proportionate, it is necessary to consider the objectives of the public protection procedures balanced against the cost, time and difficulty involved in implementing them.

Ultimately, what is appropriate and reasonably practicable will be a consideration for each individual premises and event in scope. The particular procedures in place at one location may not be appropriate and reasonably practicable at another. For example, procedures may differ at a shop that can reasonably expect to have no more than 200 individuals (including staff numbers) on the premises at any one time from a restaurant that can seat 400 individuals.

Procedures should be tailored to the specific circumstances of the premises. For example:

 A shop that can reasonably expect to have 200 individuals (including staff) present may assess that it is appropriate and reasonably practicable to ensure the following public protection procedures are in place:

• Evacuation – there will be one route through the main entrance that leads into the car park at the front of the shop and another through the back door that leads into an exterior area.
• Invacuation – to bring individuals into the main floor of the shop and into the back storage room, which has secure windows and a lock that is routinely checked.
• Lockdown – a sophisticated process would not be required. As such, it is sufficient for a nominated person to simply use the lock on the front door in the event of an attack occurring outside.
• Communication – met by setting out the above procedures in a one-page summary and circulating with relevant individuals that work at the shop.
• Supporting activities – a poster summarising the procedures is placed in a private staff area of the shop and a landline is present.
• The procedures are reviewed annually. Although not a statutory requirement under section 5 of the Act, in practice, the responsible person should keep under review the procedures that are in place so that they remain up-to-date.

A 400-seater restaurant may assess that it is appropriate and reasonably practicable to ensure the following public protection procedures are in place:

• Evacuation – there will be one route via the main entrance that leads onto a public pavement and another through a side door that leads into an alley.
• Invacuation – to bring individuals into the main restaurant area and, if needed, into a variety of staff areas.
• Lockdown – nominated individuals knowing when (i.e. when their shift manager instructs them to) and how to quickly lock and barricade doors, close window shutters and turn off lights.
• Communication – met by ensuring staff know who will enact procedures (shift manager) and planning how to communicate with customers present at the restaurant, were an attack to occur.
• Supporting activity – new members of staff are provided a short awareness briefing on the restaurant’s procedures at induction (alongside health and fire safety inputs).
• The procedures are reviewed annually. Although not a statutory requirement under section 5 of the Act, in practice, the responsible person should keep under review the procedures that are in place so that they remain up-to-date.

Effective procedures

Public protection procedures should be communicated to all those who need to be aware of them (for example, the people who must implement them effectively in response to a suspected incident). This may include employees, volunteers and contractors as well as those hiring premises. 

How people are made aware of the procedures in place will depend on the particular circumstances of the premises or event and available resources. For example, the responsible person may require relevant employees to attend instructional training or receive appropriate briefing. There is no statutory requirement in the Act for the responsible person or staff to carry out specific training. However, as part of ensuring that public protection procedures are in place and can be enacted quickly and effectively, those working at the premises with responsibility for carrying them out (as identified by the responsible person) must be made aware of the procedures and their specific role. They also need to be provided with the understanding, experience and tools required to carry them out effectively.

1. The Act was granted Royal Assent on 3 April 2025, but these requirements have not yet been commenced. This means that they are not yet in force and so do not need to be complied with until brought into force by regulations. ↩