Skip to main content
main content, press tab to continue
Article | Managing Risk

How could the Protect Duty impact your business?

Shielding people, reducing claims

November 23, 2021

Experts in risk, regulation and civil law assessed the implications for businesses and what they can do to defend potential claims in light of the new Protect Duty.
Risk Management Consulting

The Protect Duty will impose new legal obligations on businesses and could therefore open the door on a range of potential personal injury and damage claims should businesses not have appropriate security and processes in place.

Our October 2021 webinar assembled an expert panel to explore how leisure and hospitality businesses can effectively manage a terrorism crisis event while reducing the risk of mental trauma to employees and members of the public, and therefore potentially mitigating the chances of later claims.

The Protect Duty and civil claims

What obligations will the Protect Duty create?

The Protect Duty means businesses will likely need to have appropriate physical security and well-established systems that:

  • Assess the terror threats at their property
  • Address the risks to the public if a terror event were to happen
  • Manage and mitigate those risks.

The obligations are likely to be greater for larger businesses with more than 250 employees. Smaller businesses, such as independent shops and restaurants, will be expected to take proportionate and reasonable measures.

The Protect Duty will apply to outdoor spaces under an organisation’s control.

The Protect Duty will apply to outdoor spaces under an organisation’s control. For some businesses, this could mean the areas directly surrounding their building. For local authorities, the new law could apply to their parks, beaches and high street areas.

Who will the new Protect Duty apply to?

The consultation proposes any venue capable of holding gatherings of 100 people or more should fall within the Protect Duty. It is also expected to apply to all large organisations employing 250 people or more, operating at publicly accessible locations.

How much will the new obligations impact my organisation?

Unlock More

Venues and organisations affected could include:

  • music venues
  • festivals
  • pubs, bars and clubs
  • hotels and casinos
  • tourist attractions
  • conference and event venues
  • sports stadiums
  • high streets
  • retail stores, shopping centres and markets
  • schools and universities
  • medical centres and hospitals
  • places of worship
  • government offices and job centres
  • transport hubs
  • parks, public squares and other open spaces
  • beaches

The Health and Safety at Work Act1 already imposes a generalised duty to prevent foreseeable harm. However, the Protect Duty will make this a legal requirement specific to terror threats.

How much this will impact your business depends on what measures you already have in place. For example, if your business has good physical security and a well-established process to assess and manage security risks, it is well-placed to fulfil most of the new requirements without needing to take too much further action.

Much of what’s required may, for example, already exist in your organisations’ fire safety and health and safety procedures. That said, it’s still likely you’ll need to map your existing procedures into a specific plan for protecting the public in the event of a terror attack. This will involve identifying any gaps in that plan and plugging such holes with additional procedures or security measures.

If investigators think your business’ lack of planning or response contributed to injuries or fatalities, or if it is found not to have appropriate security measures in place, then it could be prosecuted under the Protect Duty.

It’s worth bearing in mind businesses will still need to protect their staff under health and safety laws, so will need to balance the needs of both the public and employees in their risk assessments and plans.

What kind of claims could businesses face?

If your business breaches the Protect Duty, it could open the door onto civil claims ranging from personal injury and trauma, to financial losses and loss of future earnings. Costs could include trauma-focused counselling for potentially large groups of people. While individual claims might be low in value, there could be larger class actions. Media attention could contribute to these claims and also create reputational damage.

How can organisations defend themselves against claims?

Documentation is key. You will need to evidence your risk assessment processes, training and security measures and show clearly how they met the guidance. It's also vital to document the rationale around your risk assessment and the mitigations you put in place as a result of this thinking. If an attack occurs, gather evidence including witness statements immediately afterwards and hold on to it indefinitely as cases can take a long time to be decided.

Documentation is key.

Remember, courts will expect organisations to act on what they should have known at the time of the incident, so carry out regular assessments and make sure your processes are up to date and adhere to the new duty.

Anti-terror police may be able to provide support in helping your organisation meet its new duties, but if you’ve carried out a terror threat assessment and find risks you can’t immediately manage, talk to your insurer. They are likely to have insight on either reducing, mitigating or transferring the terror risks your business faces, better enabling your organisation to manage the potential damage and retain or restore control of their operations.

Defending claims

When it comes to how well-placed your organisation is when it comes to defending claims, these are the key questions to consider:

  • Does your business have a robust, documented process to assess terror risks to the public?
  • Did your organisation take appropriate action to minimise the risks identified in your assessment?
  • Was your organisation's physical security enough to protect your premises?
  • Were your employees trained in how to respond to an incident?
  • Did everyone know their roles and what they needed to do?

If the answer to these questions is ‘yes’, and you can back this up with evidence, it may be less likely your organisation could be found to have breached the duty or be liable for damages.

Crisis management

Adapting your crisis management plans

It’s likely businesses will need to adapt their crisis management plans to meet the new Protect Duty, or create one if it doesn’t already exist. Experts suggest a headline action list to help in this process:

  1. Define what you mean by a terror attack. Think about the trigger points for your procedures to kick in. At what point do you escalate these procedures and how?
  2. Create a crisis management plan with a clear flow from the strategy to the tactics you implement on the ground.
  3. Ensure your plan covers all three phases of an attack and its impact: protecting life and limiting damage during an attack; restoring control and managing media immediately afterwards; picking up the pieces and getting back to normal in the aftermath.
  4. Rehearse your plan and practice scenarios to test your team in different situations. Make sure your people fully understand their roles and responsibilities and are ready to put these into action should an attack occur.
  5. Identify the person to lead the response – don’t assume that’s always the CEO; choose the person best-suited to a crisis situation. The leader should direct the response to any attack while allowing people to carry out their roles. They should also remain separate from the ground-level response to avoid confusion.
  6. Communicate effectively – assessing debriefs from previous terror incidents shows poor or confused communication has been identified as a contributor to loss of life. Given the highly pressurised scenario of a terror attack, limiting inbound communication to a minimum and outbound communications to essential stakeholders, such as the emergency services, is advisable.
Managing the mental health impact of an attack

People may experience trauma after being impacted by a terror attack. The most likely mental health issues people may experience are post-traumatic stress disorder (PTSD) acute stress disorder (ASD) or other symptoms of anxiety and depression. Symptoms may include re-experiencing the trauma, emotional difficulties and avoiding things associated with the traumatic event.

It’s important to have services available to support to support both staff and patrons.

It’s important to have services available to support to support both staff and patrons. Look at what you already have in place in terms of helplines, counselling services and employee assistance programmes and be clear on how people can access them during and after a terror event.

Remember that not everyone will need professional help to recover from a traumatic event, although if a person wants to seek help then support them in doing so.

How can Willis Towers Watson help?

  • Civil and regulatory defensibility reviews - The reviews help leadership teams assess their existing health and safety arrangements and recommend improvement to support the business' defensibility should it face civil compensation claims or regulatory investigation.
  • Risk consulting - Our Risk Consulting Practice includes highly experienced crisis management and business continuity experts able to support you across of range of crisis preparation measures such as risk assessment, plan writing, crisis and response training, scenario-based exercises and related management systems.
  • Mental Health First Aid - Our Health and Wellbeing Practice can deliver the Mental Health First Aid course from MHFA England. This teaches practical skills including how to spot the signs of mental health issues, improve confidence in having conversations around mental health and how to guide people towards appropriate professional support. It covers a wide range of mental health conditions and crises, including crisis first aid after a traumatic event.

Please do not hesitate to contact us to discuss your leisure and hospitality risk management and insurance strategy further and find out how we can help you implement the right approach for your business.




Leisure and Hospitality Practice Leader – London WTW

Contact us