Protect Duty: What do businesses need to know after the latest Government announcement?

What is the Government’s recent announcement on the Protect Duty?

In January 2022, the Government published an initial response to the Protect Duty public consultation,^[1] which ran in 2021. Its response did not specify when the duty will become law but highlighted emerging themes from the near-3000 consultation responses it had received from stakeholders. The majority of these are said to support a legal requirement for some public places to ensure preparedness for, and protection from, terrorist attacks. Other key themes included:

• Many respondents agreed those responsible for publicly accessible locations should take appropriate and proportionate measures to protect the public from attacks, including ensuring staff are trained to respond appropriately.
• Many agreed venue capacity should determine when the duty applies, with an understanding small and medium-sized enterprises should not face the same requirements as larger venues.
• Very strong views were expressed on accountability, such as the need for clear roles and responsibilities, particularly amongst event organisers and those at senior levels within venues and organisations.
• Half of respondents were in favour of an inspectorate that would identify key vulnerabilities and areas for improvement. There was also an even split of those who supported using civil penalties to ensure compliance.

So, when will the Protect Duty become law?

The Government has said it will continue to engage with a range of stakeholders and other government departments, as well as use the feedback from the consultation to further develop the legislation, which will be introduced to Parliament ‘at the earliest opportunity’. It’s understood there will be an awareness period between the bill being passed and full implementation to allow those impacted to be educated in the requirements and to provide time to introduce the corresponding measures. However, the consultation process has already indicated some of the intended requirements, for example, comprehensively risk assessing terrorism, which organisations can start to explore and get ahead of today.

Which businesses need to comply to the Protect Duty?

The consultation proposes any venue capable of holding gatherings of 100 people or more should fall within the Protect Duty. It is also expected to apply to all large organisations employing 250 people or more, operating at publicly accessible locations.

What are the implications of the Protect Duty for impacted organisations?

The implications are potentially wide-ranging, but from the consultation, we know the scale and complexity of your operations is going to be particularly important in determining the action your business should take.

For small businesses, where the cost implications of implementing significant physical security measures could prove impractical, the Protect Duty is unlikely to apply to a greater extent. These businesses may only need to reframe how they articulate their current crime prevention measures, such as roller shutters, robust door locks and CCTV, in the context of the Protect Duty. However, it’s likely smaller operations will still be expected to educate and train staff and carry out specific risk assessments.

At the other end of the scale there are landmarks such as famous stadiums, major shopping centres and symbolic real estate, already allocated by Counter Terrorism Policing and the Centre for the Protection of National Infrastructure (CPNI) for special attention. Consequently, these sites will already have extensive security measures in place, often built in at the point of construction design.

For the majority of organisations in this category, the Protect Duty will have little impact because they have already assessed and mitigated their terrorism risk in great detail.

Organisations in the middle ground are most likely to need to assess their current security risk arrangements and incur financial costs and operational implications, such as new procedures, training and physical installations, as a result of the Protect Duty. These businesses may also need to enhance their in-house security capability and capacity, potentially by creating new positions, training additional staff, or using external consulting support to assess and mitigate the risks appropriately.

What can I do to prepare for the Protect Duty?

Firstly, you should ascertain whether you will fall under the requirements of the Protect Duty and if so, what category of organisation size and vulnerability you are in. From here you can take steps to understand what changes to your current risk assessments, security culture – levels of awareness among staff training and the like – and physical security arrangements you might need to make.

The consultation document offers strong indications of those requirements the Government is expected to make law, so organisations could consider preparing for the Protect Duty using three broad steps:

1. Educate your staff on the risk assessment process. Terrorism often proves more complicated to risk assess than initially anticipated. If you don’t have people in your organisation already versed in this, particularly those who will be responsible for assessing and mitigating the threat to your organisation, it’s a good idea to spend some time now preparing them, particularly around the different terrorist threats the UK faces and the various modes of attack.
2. Start to think about the physical, technical and procedural security measures you currently have in place, perhaps for crime or fire prevention reasons. Reframe how you think about these existing measures, considering how they might mitigate your terrorism risk and be included in your terrorism risk assessment. This exercise will also help you identify the potential gaps and where you may need to invest to comply with the Protect Duty.
3. Get familiar with the material already available by the National Counter Terrorism Security Office (NaCTSO) and CPNI which provides a baseline for education, training and mitigation advice before the Protect Duty is implemented. The Government has said such resources will be brought together on one digital forum some time in 2022 (see below), but it’s expected the content will largely remain the same.

We’re a large entertainment operation with a comprehensive risk management approach, do we need to do anything further to comply with the Protect Duty?

Much of what’s required may potentially already exist in your organisations’ fire safety and health and safety procedures. That said, it’s still likely you’ll need to map your existing procedures into a specific plan for protecting the public in the event of a terror attack. This will involve identifying any gaps in that plan and plugging these holes with additional procedures or security measures.

What does the Protect Duty mean for my liability cover?

The impact on cover and exclusions is unclear. We expect more clarity as the Protect Duty moves closer to becoming law.

Where can I find information and resources to help us prepare to comply?

The Home Office is currently collaborating with NaCTSO and Pool Reinsurance to develop a new interactive online platform to serve as a central digital location for advice, guidance and e-learning. It is due to launch publicly this year.

In the meantime, there are lots of useful tools and information publicly available from organisations such as CPNI and NaCTSO. These can help you assess whether you’re doing enough to secure your spaces and what you need to improve.

Local Counter Terrorism Security Advisors (CTSAs) can also provide advice on protecting people in crowded spaces and suggest practical improvements, while free See, Check and Notify (SCaN) training can start to build awareness amongst your employees of the different threats and how they can help prevent them.

WTW also has a range of resources that include practical guidance on preparing to meet the Protect Duty.

How can WTW help my business comply with the Protect Duty?

• Security vulnerability assessment – This assesses the physical, technical and procedural security measures currently in place at your assets and aligns these, through remedial recommendations, to Protect Duty requirements.
• Risk consulting – Our Risk Consulting Practice includes highly experienced crisis management and business continuity experts able to support you across of range of crisis preparation measures such as risk assessment, plan writing, crisis and response training, scenario-based exercises and related management systems.
• Threat awareness brief – This brief translates the UK terrorism threat environment specifically to your business, leveraging the expertise of our security consultants to competently assess the risk. You will receive practical recommendations to enhance your organisation’s security culture, awareness and physical protective measures.
• Civil and regulatory defensibility reviews - These help leadership teams assess their existing health and safety arrangements and recommend improvement to support the business' defensibility should it face civil compensation claims or regulatory investigation.

Footnote

¹ https://www.gov.uk/government/news/government-publishes-protect-duty-consultation-findings

Contacts

---

Kay McMenamin

Leisure and Hospitality Practice Leader – London WTW

email Email phone +44 20 3124 6590

---

Frederick Gentile

Director of Risk Engagement
WTW

email Email phone +44 203 124 6000

---

Patrick Rogers

Head of Risk Advisory – Alert:24, Crisis Management

email Email phone +44 (0) 7990 406133

---