Terrorism (Protection Of Premises) Act 2025

Overview of the Act

1. The Terrorism (Protection of Premises) Act 2025 is intended to improve protective security and organisational preparedness across the UK. The Act requires those responsible for certain premises to take steps to reduce the risk of physical harm to individuals at the premises, in the event of an attack occurring. In addition to this, certain larger premises and events must also take steps to reduce the vulnerability of the premises to terrorist attacks. It establishes a tiered approach linked to the activity that takes place at premises or an event and the number of individuals it is reasonable to expect may be present on the premises at the same time.
2. The Act also makes amendments to the Licensing Act 2003 and the Licensing (Scotland) Act 2005 to protect premises plans from being used for the purposes of terrorism.

Responsibility for requirements

3. A person will be subject to the main requirements of the Act if they are responsible for qualifying premises or events, which is to be determined on the basis of whether or not the person has control over the premises in connection with an activity that is within the scope of the Act (this is referred to as the "relevant Schedule 1 use" of the premises).
4. The principle of control has been utilised in other regulatory regimes, such as fire safety. A person who has control of premises in connection with their relevant Schedule 1 use is responsible for qualifying premises. For example, the operator of an arena or governing body of a school will be responsible for fulfilling the requirements of the Act at their respective premises.
5. A person who will have control of the premises at which an event is to be held in connection with their use for the event will be responsible for a qualifying event.
6. If there is more than one person who is responsible for the qualifying premises or event, they may act jointly in fulfilling the requirements and will, in any event, be required to coordinate with each other.

Qualifying premises

7. Premises will be in scope – i.e. premises at which the requirements must be fulfilled – if they are "qualifying premises". Premises are qualifying premises if:
   1. the premises consist of a building or of a combination of a building and other land ("building" includes part of a building or a group of buildings);
   2. they are wholly or mainly used for one or more uses set out in Schedule 1 to the Act (e.g. for the sale of food and drink for consumption on the premises);
   3. it is reasonable to expect that from time to time 200 or more individuals may be present on the premises at the same time, and;
   4. the premises are not excluded by virtue of Schedule 2 to the Act.
8. Where premises are used for only one use set out in Schedule 1, its "relevant Schedule 1 use" would be that use, e.g. a retail store. However, where the premises are used for more than one such use, the relevant Schedule 1 use will be whichever of those uses is the principal use.
9. Qualifying premises may be contained within other qualifying premises. For example, at a shopping centre, the shopping centre may be qualifying premises as might a retail unit within the centre if the above conditions are met.
10. The Act separates qualifying premises into two categories, which have their own requirements:
    1. enhanced duty premises are qualifying premises that it is reasonable to expect that they will, from time to time, host 800 or more individuals at the same time, and
    2. standard duty premises are all other types of qualifying premises (i.e. those that can be reasonably expected to host between 200 and 799 individuals from time to time).
11. In some cases, certain qualifying premises that would otherwise be enhanced duty premises are to be treated as standard duty premises under Schedule 1. For example, places of worship that are qualifying premises are to be treated as standard duty premises even if they host 800 or more individuals from time to time.

Qualifying events

12. Events will be in scope – i.e. events at which the requirements must be fulfilled – if they are a "qualifying event". An event is a qualifying event if:
    1. the premises where the event is to be held consists of a building (including part of a building or a group of buildings), other land or a combination of a building and other land;
    2. the premises at which the event is to be held are not enhanced duty premises and do not form part of enhanced duty premises (such events are excluded as the premises will already be subject to the enhanced duty requirements);
    3. members of the public will have access to the premises for the purpose of attending the event;
    4. it is reasonable to expect that at some point during the event 800 or more individuals may be present on the premises at the same time in connection with their use for the event;
    5. measures will be in place to control access to the event. Specifically, this will involve checking members of the public wishing to access the event have paid to do so, have invitations or passes, or are members or guests of a club, association or other body; and
    6. the event is not excluded by virtue of a provision in Part 2 of Schedule 2 to the Act.

Standard duty premises requirements

13. The requirements for standard duty premises are intended to be simple, focusing on having specified procedures in place to follow in the event of a terrorist attack.
14. Those responsible for standard duty premises will be required to notify the Security Industry Authority that they are responsible for the premises (i.e. notification).
15. Those responsible for standard duty premises will also be required to implement reasonably practicable public protection procedures as appropriate for their premises. These procedures are specified in the Act and are procedures for lockdown, invacuation (i.e. bringing people onto the premises to shield them), evacuation and communicating necessary information to people at the premises. These procedures are procedures that may be expected, so far as is reasonably practicable, to reduce the risk of physical harm being caused to individuals if an act of terrorism were to occur at the premises or in the immediate vicinity.

Enhanced duty premises and qualifying events requirements

16. Those responsible for enhanced duty premises or qualifying events will also be required to notify the Security Industry Authority.
17. They will be required to put in place reasonably practicable public protection measures that could be expected to reduce, so far as reasonably practicable, both:
    1. the vulnerability of the premises or event to an act of terrorism occurring at the location;
    2. and the risk of physical harm being caused to individuals if an attack was to occur there or nearby.
18. They will also be required to produce a document setting out the public protection procedures and measures in place, or proposed to put in place, and to provide this document to the Security Industry Authority. This document should include an assessment as to how those procedures and measures may be expected to reduce, so far as is reasonably practicable, vulnerabilities and the risk of harm.
19. Where the person responsible for enhanced duty premises or a qualifying event is not an individual, they will also be required to designate a relevant senior individual who will have responsibility for ensuring that the person responsible complies with the requirements of the Act. This person must have a sufficient level of seniority.

Inspections and enforcement

20. The Act establishes that the Security Industry Authority will be the regulator. It shall have functions relating to inspections and enforcement as well as providing advice to promote compliance.
21. The Act confers a number of investigation and enforcement powers on the Security Industry Authority. The Security Industry Authority will have powers to issue compliance notices and monetary penalties for contraventions in relation to all qualifying premises and events and, in relation to enhanced duty premises and qualifying events, it may also issue restriction notices.
22. For the most part the requirements will be enforced by way of civil penalties and other civil measures. However, the Act also creates certain criminal offences: for providing false or misleading information to the Security Industry Authority; for failing to comply with a restriction, compliance or information notice; for impersonating an inspector; and for obstructing an inspector.
23. The Security Industry Authority will be required to issue guidance as to how it intends to exercise its functions, particularly its powers of investigation. The Security Industry Authority must obtain the consent of the Secretary of State to issue the guidance i.e. the guidance must be approved by the Secretary of State. The Security Industry Authority must provide an annual report to the Secretary of State, who will be able to issue directions to the Security Industry Authority, as part of their oversight of the body.

Support for duty-holders

24. The Secretary of State must provide statutory guidance as to how requirements of the Act may be complied with. This guidance will assist duty-holders in understanding and fulfilling their duties under the Act.

Licensing: disclosure of plans of premises

25. The Act also makes amendments to the Licensing Act 2003 and the Licensing (Scotland) Act 2005, mandating that all new licence applicants applying for a premises licence in England, Wales and Scotland will be required to supply two plans to the Local Licensing Authority in support of the application. The first plan will be a detailed plan for the Local Licensing Authority’s use, whilst the second plan - which is the new component of this provision - will be a less detailed plan that will be made available for public inspection. This will prevent sensitive information in premises plans being made available to the public, where this is considered necessary to reduce the risk of this sensitive information potentially being used to assist terrorist activity.