KEY POINTS
- Every standard tier and enhanced tier premises, and every qualifying event, must have appropriate public protection procedures in place, so far as is reasonably practicable.
- There are four procedures: evacuation, invacuation, lockdown and communication. In a real incident they are usually used together or in sequence.
- The most important question in the first seconds is where the threat is: inside, outside, or unknown. That points to which procedure to start.
- Your procedures must name who decides and who can trigger each one, on every shift, without waiting for the police.
- A written procedure that staff cannot carry out quickly does not meet the standard the Home Office guidance describes.
What are public protection procedures?
Public protection procedures are the actions your staff take if there is reason to suspect a terrorist attack is happening, or is about to happen, at your premises or in the immediate vicinity. Section 5 of the Terrorism (Protection of Premises) Act 2025 requires the responsible person for every qualifying premises and qualifying event to ensure appropriate procedures are in place, so far as is reasonably practicable. This is the core duty at the standard tier (200 to 799 people) and it also applies at the enhanced tier (800 or more). If you are not sure which tier applies to you, use our free tier checker.
The Act names four procedures. The definitions below follow the Act and the Home Office statutory guidance published in April 2026.
| Procedure | What it means | Typical use |
|---|---|---|
| Evacuation | Getting people away from danger by moving them out of the premises, or out of part of it. | The threat is inside, or a suspicious item is found inside. |
| Invacuation | Moving people to a place within the premises where there is less risk of harm, including bringing people in from outside. | The threat is outside, or in one part of the building. |
| Lockdown | Securing the premises, or part of it, to stop people entering or leaving. | Keeping an attacker out, or stopping people walking towards danger. |
| Communication | Giving people information: alerting them to danger quickly and telling them what to do, where it is safe to do so. | Every incident. It is how the other three procedures start. |
The duty is about procedures, not equipment. The statutory guidance is clear that there is no requirement in the Act to make physical alterations or buy specific equipment to put procedures in place, although small changes can sometimes be reasonably practicable, such as moving a shutter control or changing how a door locks.
How the four procedures work together
It helps to think of the four procedures as building blocks rather than four separate plans. The statutory guidance asks responsible persons to consider how procedures work together, because several may be needed at once or one after another. Communication is the thread that runs through all of them: nothing else happens until someone raises the alarm.
Common sequences include:
- Communication, then evacuation: a suspicious bag is found by the bar, the duty manager announces an evacuation through the exits furthest from it, and people disperse.
- Communication, then invacuation, then lockdown: there is a disturbance in the street, staff bring people in from the terrace, then lock the front doors and move everyone away from the glass.
- Lockdown, then evacuation: the doors are secured to keep an attacker out, and when it is safe, people leave by a route the attacker cannot reach.
- Partial lockdown with evacuation: one entrance is locked because the threat is nearby, while other exits stay open so people can leave in a safe direction.
The guidance includes an example of a standard tier shop where panicked members of the public rush towards the doors. Staff do not know exactly what is happening, so the duty manager starts invacuation followed by lockdown: people outside are brought in, the front and rear doors are locked, and everyone shelters in internal rooms with lockable doors. That is the pattern to aim for: a quick, simple decision that combines procedures, made by someone who knows they have the authority to make it.
The first decision: where is the threat?
The statutory guidance says staff should focus first on identifying where the threat is coming from and what that means for keeping people safe, rather than trying to work out the exact type of attack. As a rule of thumb:
| Where the threat seems to be | Likely first action | What often follows |
|---|---|---|
| Inside the premises | Evacuate away from the threat, using exits that avoid it | Dispersal, a call to 999, keep others from entering |
| Outside or in the immediate vicinity | Invacuate people from outside, then lock down | Move people away from windows and entrances, wait for instructions |
| In one part of a larger building | Partial evacuation or partial lockdown | Keep people away from that area, use other routes |
| Unknown | Move people away from entrances and glass, gather information fast | Decide quickly once more is known, and keep reassessing |
Two exceptions are worth knowing. The guidance notes that a threat may come from above, for example from drones, not only at ground level. And attacks using hazardous substances can need a different response; the National Protective Security Authority's Recognise, Assess, React guidance covers this.
The Act does not require a separate procedure for every attack method. The guidance gives an example of a standard tier bar that wrote several evacuation procedures for different attack types. In practice, staff could not decide which one to use, and the delay put people at greater risk. The bar replaced them with one simple evacuation procedure that staff adapt to where the threat is. Fewer, simpler procedures that people can remember beat a thick folder.
Who decides and who triggers what
The statutory guidance says your procedures should set out the key roles and responsibilities, including who decides what actions to take and who has the authority to start a procedure. It also asks who will alert the emergency services and what information they will give. Earlier counter-terrorism guidance from ProtectUK makes a related point: the initial decision usually falls to the venue's own management, and it should not wait for police instruction, because speed matters.
For most standard tier venues, a simple structure works:
| Role | Typical responsibilities |
|---|---|
| Decision maker (duty manager or person in charge on that shift) | Decides which procedure to start, gives the instruction, reassesses as things change, liaises with emergency services. |
| Deputy decision maker | Takes over if the decision maker is absent, injured or cut off. Every shift needs one. |
| Any member of staff | Reports concerns immediately, calls 999 if in immediate danger, follows instructions, and can act to protect people nearby if there is no time to escalate. |
| Door, entrance or front of house staff | Secure doors during lockdown, bring people in during invacuation, stop people entering. |
| Area leads (bar, kitchen, floors, back of house) | Sweep their area, direct people, check toilets and side rooms, report back. |
Two practical points matter more than job titles. First, the decision maker must exist on every shift, including early mornings, late nights and private hires. Second, staff need to know they are allowed to act. If an attacker is at the door, the person nearest should not have to find a manager before locking it. Your procedure can say this explicitly.
Where several organisations share a building, the Act requires responsible persons to co-ordinate with each other, so far as is reasonably practicable. That includes agreeing who triggers what, so that one tenant's evacuation does not send people into another tenant's lockdown. See multi-tenant and shared buildings.
What appropriate and reasonably practicable mean for your venue
The guidance says procedures must be appropriate, meaning suitable for your specific premises, and then put in place so far as is reasonably practicable, meaning proportionate to the cost, time and difficulty involved. It lists factors to assess:
- the nature of the premises, including location and layout
- what the premises are used for
- how many people are expected at the same time, and the types of staff (employees, volunteers, security, contractors)
- how actions change depending on whether an attack is inside or outside
- different attack methods
- existing equipment and structures you can use, such as lockable doors, shutters, secure rooms or a public address system
It may also be important to consider nearby premises and their procedures. If a procedure is genuinely not appropriate, for example invacuation at an outdoor event with no internal areas, the guidance suggests it could help to record the reasoning in case of an inspection by the Security Industry Authority (SIA).
The immediate vicinity matters too. You are not required to put procedures in place in areas you do not control, but you must consider how an attack nearby would affect your procedures. For example, a 300-capacity pub with a pavement smoking area and an evening queue should think about how staff would bring those people inside.
Making procedures work in real life
The statutory guidance says it is not enough to have a written procedure that cannot be carried out rapidly and effectively, for example because staff lack awareness, experience or the tools to do it. In practice, procedures work when four things are in place:
- Staff know the procedures and their own role, through induction, briefings or training. See staff training requirements.
- The procedures are written down simply. There is no legal duty to document them at the standard tier, but the guidance says you should, and it may be difficult to demonstrate compliance otherwise. See record keeping and evidence.
- They have been tested, even with a short tabletop exercise. See testing and drills.
- They are reviewed when things change. The guidance suggests a periodic review, which could be annual, depending on your circumstances.
The guidance also suggests considering a grab bag or incident kit with emergency contacts, staff lists and floor plans, stored somewhere safe that the right people can reach.
Common mistakes to avoid
- Copying the fire plan. Terrorist incidents can need different routes, no assembly point and a different alarm. See the evacuation procedure guide.
- Writing one procedure per attack type, which slows decisions down.
- Relying on one manager who is not always on site.
- Assuming the PA or radios will work everywhere without checking toilets, cellars, kitchens and outside areas.
- Forgetting the queue, the terrace or the smoking area.
- Ignoring neighbours and landlords in shared buildings.
- Filing the document and never briefing or testing it.
What to do next
Start by confirming your tier with the free checker, then work through each procedure in turn: evacuation, invacuation, lockdown and communication. Our how it works page explains how we approach this. If you would like ready-made, editable procedures tailored to your venue type, our packs include templates for all four.
Frequently asked questions
Do I need all four public protection procedures?
You must ensure appropriate procedures are in place so far as is reasonably practicable. Most premises will need all four, but if one is genuinely not appropriate, such as invacuation at an outdoor event with no internal space, the Home Office guidance suggests recording your reasoning.
Do public protection procedures require building works or new equipment?
No. The statutory guidance says the Act does not require physical alterations or specific equipment. Small changes may sometimes be reasonably practicable, such as moving a shutter control, but that depends on your premises.
Who should decide which procedure to use?
Your procedures should name who decides and who can trigger each procedure. For most venues this is the duty manager, with a named deputy on every shift. Staff should also know they can act immediately to protect people if there is no time to escalate.
Should we wait for the police before acting?
No. ProtectUK guidance says initial decisions should not be delayed while waiting for police instruction. Call 999 when it is safe to do so, act on the information you have, and follow police advice once you receive it.
Do I need separate procedures for each type of attack?
No. The Act does not require a separate procedure for each attack method. The Home Office guidance gives an example where several procedures confused staff and caused delay. One simple procedure for each type, adapted to where the threat is, usually works better.
Sources
General information based on the Act and published guidance, not legal advice. Check the official statutory guidance on GOV.UK for your situation.