What Are Public Protection Procedures (PPP)? A Complete Guide

What Are Public Protection Procedures?

Public Protection Procedures are the structured set of procedures that record how your venue responds to a terrorist incident. They describe what your staff and volunteers will do if there is a terrorist incident. How people get out, how they shelter in place, how you lock the building down, how you communicate with everyone on site.

Think of it as the terrorism equivalent of a fire safety plan. Your fire plan covers evacuation routes and assembly points. A PPP covers the same ground but adds the procedures you need when the threat isn't fire. Sometimes you need to keep people inside rather than send them out.

The terms come from the Terrorism (Protection of Premises) Act 2025 itself. Section 5 requires “public protection procedures” for standard tier, and Section 6 requires “public protection measures” for enhanced tier. You may also see the written document called a “Premises Protection Plan”, but that is an informal industry term, not one used in the legislation.

Does Standard Tier Require a Written PPP?

No. Standard tier venues (200–799 capacity) must have public protection procedures in place, but the Act does not require those procedures to be written down or submitted to the SIA. A formal, written PPP submitted to the regulator is an enhanced tier requirement (Section 7 of the Act).

The original consultation proposed a mandatory “Standard Terrorism Evaluation” form. After feedback, the government dropped it. Standard tier is now entirely about having procedures and making sure your staff and volunteers know them.

Why Write One Anyway?

Even though it is not legally required, having a written PPP is the easiest way to demonstrate compliance. When an SIA inspector visits, the SIA has said the focus will be on three things: do procedures exist, do they make sense for your building, and can your staff and volunteers explain them?

A documented PPP helps you on all three counts:

• You can show an inspector exactly what your procedures are
• Every staff member or volunteer gets the same information
• New starters can read it during induction
• You have a baseline to update when your layout or staffing changes
• Some insurers are starting to ask about terrorism preparedness

What Does a PPP Cover?

A PPP covers the four public protection procedures required under Martyn's Law, plus the supporting information needed to make them work.

There is no mandated format. You could write it in a Word document, use a spreadsheet, or generate it for free with a tool like Standard Tier. What matters is that the content is specific to your premises and that your staff and volunteers can act on it.

Evacuation Procedures

Getting people out safely. Your PPP should record every exit route, where each route leads, who initiates the evacuation, and how staff and volunteers guide people out.

This is where terrorism differs from fire. In a fire, everyone goes to the same assembly point. But in a terrorist incident, that assembly point might be right next to the threat. Staff and volunteers need to give real-time directions away from the danger, not just point people towards the fire exit.

Cover:

• All exit routes (primary and secondary)
• Where each route leads (car park, street, alley)
• Who initiates the evacuation and how
• How staff and volunteers guide people towards the right exits
• Accessibility considerations (wheelchair users, people with reduced mobility)
• Assembly point(s) and alternatives

Consider three types of evacuation: full site (everyone out), directional (specific exits away from the threat), and phased (those closest to the threat first).

Invacuation Procedures

The opposite of evacuation. When the threat is outside, you bring people deeper into the building rather than sending them out. Most venues don't have this already. Fire safety never requires it, which is why it catches people off guard.

Think about:

• Identified safer areas and why they are safer (no external windows, interior walls, robust locks)
• Which floors offer more protection (upper floors protect better from vehicle-borne or person-borne explosives)
• How people are directed to these areas
• Who is responsible for directing them
• Provisions for extended shelter (water, toilets, lighting, communications)

Invacuation is appropriate when evacuation routes would take people closer to the threat, when the risk of glass or fragment hazards from an external explosion is high, or when police advise remaining inside.

Lockdown Procedures

Securing every entrance and exit so nobody gets in or out. For each point, you need to know: how does it lock? Who locks it? How long does it take?

Record:

• Every entry and exit point and how it is secured (locks, bolts, shutters, barricades)
• Nominated individuals who know how to quickly secure each point
• Additional measures (turn off lights, close blinds, silence phones)
• Expected time to achieve full lockdown
• Reversibility: procedures must be reversible in case of fire during an incident
• Zoned lockdown where possible

For a small venue with one front door and a back exit, lockdown might be as simple as “deadbolt the front door and lock the fire exit from inside”. The government's own example for a 200-person shop is: “nominated person uses lock on front door”.

Communication Procedures

None of the above works if people don't know what's happening. Communication ties evacuation, invacuation, and lockdown together. Without it, you've got procedures on paper and chaos in practice.

Set out:

• Who initiates the alert (typically the duty or shift manager)
• How staff and volunteers are alerted (verbal, radio, PA, phone, WhatsApp, code words)
• How customers and visitors are informed with clear instructions
• How and when emergency services are contacted
• A method distinct from fire alarms, because fire alarms direct people to assembly points that may be near the threat
• Considerations for hearing-impaired, visually impaired, and non-English speakers

A pub might use a code word over the staff WhatsApp group. A community hall might use a PA system. What matters is that every staff member or volunteer knows the method and can act on it.

Staff and Volunteer Awareness and Training

Your PPP should record how procedures are communicated to staff and volunteers. The Act does not prescribe a specific training format. What matters is that the people who will implement the procedures actually know them.

Acceptable methods include:

• Induction briefings for new starters
• Shift briefings and pre-shift reminders
• Written summaries or procedure cards
• Posters in staff areas
• Tabletop exercises (try the free ACT in a BOX exercise)
• Walk-throughs of routes and locking points

Differentiate by role. Duty managers need deeper awareness because they initiate and coordinate responses. Everyone else needs to know what to do and where to go. Anyone nominated for lockdown duties needs to know exactly how to secure each entry point.

The real test: if an SIA inspector asked a random staff member or volunteer to explain the procedures, could they do it?

Worked Example: A 300-Capacity Pub

This is based on the government's own worked example from the standard duty requirements factsheet.

That is the whole thing. No consultants. No equipment. No specialist qualifications. A venue manager can put this together in a few hours, or use Standard Tier to generate it in 10 minutes.

How to Write Your PPP

You have two options: do it yourself or use a tool. Either way, the process is the same.

1. Work out your capacity. Use one of the six approved methods. Our free capacity calculator uses Method A (fire safety floor space factors and exit widths). Under 200? You are not in scope.
2. Walk your premises. List every exit, every entry point, every room. Note which doors lock, which windows have shutters, which areas have no external walls.
3. Write the four procedures. For each of evacuation, invacuation, lockdown, and communication, describe what happens, who does it, and how.
4. Plan briefings and training. Decide how you will train existing staff and volunteers and brief new starters. Record this in the document.
5. Set a review date. At least once a year, or whenever the layout, staffing, or use of the premises changes.

The government has been clear: this should not require “particular expertise nor the use of third-party products or services”. You do not need a security consultant.

Get Started

You can write your PPP yourself using the structure above. Or you can use Standard Tier to generate a tailored PPP, set up a training portal with quizzes for your staff and volunteers, and build a permanent audit trail. Takes 10 minutes.

Frequently Asked Questions

Official Sources

• Full text of the Act
• Standard duty requirements factsheet
• Home Office overarching factsheet
• ProtectUK: Evacuation, invacuation, lockdown, protected spaces
• ProtectUK: Free training catalogue

Related Guides

• Use our compliance checklist to track what you still need to do
• See what penalties apply if you don't comply
• Learn about the free ACT e-learning courses for your staff and volunteers