Security Intelligence

Security for Shopping Centres, Retail Parks and Malls: Venue Security Planning | CloseProtectionHire

Q: "Do shopping centres and retail parks fall under Martyn's Law?"

"Most shopping centres and retail parks with significant footfall will qualify as Enhanced duty premises under the Terrorism (Protection of Premises) Act 2024 (Martyn's Law). The Enhanced duty threshold is a capacity of 800 or more people. Major shopping centres -- including regional centres such as Westfield, Trafford Centre, and Meadowhall -- have capacities well above this threshold. Enhanced duty requirements include: a Security Management Plan documented and available to the SIA on request, a nominated Senior Premises Manager with security responsibility, staff training in ACT Awareness (counter-terrorism awareness through NaCTSO's ProtectUK), a documented terrorism risk assessment (including hostile vehicle mitigation, crowded places threat, and CBRN awareness), and emergency procedures that are tested and reviewed. Retail parks with significant capacity will similarly qualify. The Act received Royal Assent on 3 April 2024; implementation timelines are being set by the SIA."

Q: "What is the hostile vehicle threat at shopping centres and how should it be addressed?"

"Shopping centres and retail parks present a specific hostile vehicle threat: the concentration of pedestrians at entry and exit points, car park areas adjacent to pedestrianised zones, and service road access create multiple approach routes for vehicle-as-weapon attacks. The NaCTSO hostile vehicle mitigation (HVM) guidance recommends a layered approach: permanent physical barriers (concrete bollards, security planters) at the highest-risk pedestrian-vehicle interface points (main entrances, event entrances, pedestrianised frontages), temporary measures for higher-risk periods (pop-up bollards, temporary vehicle exclusion zones during peak events), and CCTV coverage of vehicle approach routes. PAS 68:2013 and IWA 14-1:2013 specify the testing standards for hostile vehicle mitigation products. Products that meet PAS 68 impact test specification at V/7500[N2]80/90 are assessed for vehicles of 7,500kg striking at 80km/h. Specification selection should be informed by the site threat and impact assessment."

Q: "What are the legal considerations around CCTV and facial recognition at shopping centres?"

"Shopping centres' CCTV systems are governed by UK GDPR, the Data Protection Act 2018, and the ICO CCTV Code of Practice (updated 2023). Signage informing visitors of CCTV recording is a legal requirement, as is a documented retention policy (typically 28-31 days), access controls on recorded footage, and a procedure for responding to data subject access requests and law enforcement disclosure requests. Facial recognition technology (FRT) at shopping centres is a more legally constrained practice. The Court of Appeal judgment in Bridges v South Wales Police [2020] EWCA Civ 1058 established that automated facial recognition requires: a legal basis, a necessary and proportionate purpose, and compliance with the DPA 2018's requirements for biometric data processing. The ICO has been critical of FRT deployment in retail environments. Retailers deploying FRT -- for example, to identify known shoplifters -- must have documented legal basis (Article 6 and Article 9 lawful processing), an up-to-date data protection impact assessment (DPIA), and explicit consideration of accuracy and bias issues in the technology."

Q: "What is organised retail crime and how has it changed?"

"Organised retail crime (ORC) in the UK has escalated significantly in recent years. The British Retail Consortium (BRC) Annual Crime Survey 2024 reported GBP 2.2 billion in retail theft in 2023-2024, up from GBP 953 million in 2019-2020 -- a 131% increase in four years. The specific tactic change that affects shopping centres is the rise of 'smash-and-grab' flash mobs: coordinated attacks by groups of 10-40 individuals who simultaneously enter a store (typically luxury goods, electronics, or sportswear), overwhelm staff, and exit with high-value merchandise within 1-3 minutes. These attacks are organised via encrypted messaging platforms, with roles assigned (entry team, bag carriers, lookouts, getaway drivers). The attacks are not spontaneous -- they follow a reconnaissance phase in which the store, its security arrangements, and the goods display are assessed. Prevention measures include: advance intelligence sharing between retailers and police (through Business Crime Reduction Partnerships and BID schemes), enhanced store design (goods in locked cases, reduced front-of-store high-value display), physical security upgrades, and evacuation procedure for ORC incidents."

Q: "What are the specific security requirements for shopping centre car parks?"

"Car parks are the highest-incident area for personal crime in the retail environment. Specific risks include: vehicle crime (theft from vehicle, theft of vehicle), personal attack during approach or departure, sexual assault in isolated parking levels, and child protection incidents. The Secure Car Parks Award (operated by the British Parking Association with Police input) provides a recognised standard for car park security. The elements are: CCTV coverage with identified camera positions, adequate lighting to a minimum 20 lux standard in parking areas and 50 lux in pedestrian routes, regular security patrols (documented and varied frequency), emergency help points in all parking areas, clear pedestrian route signing, and a response protocol for incidents. Multi-storey car parks with upper levels and stairwells require specific attention to lighting and CCTV coverage in the high-dwell, low-visibility areas. Lone worker protocols for car park attendants, including duress alarm provision, are required under the Health and Safety at Work Act 1974 for staff working in isolated environments."

Security for shopping centres, retail parks, and malls: Martyn's Law Enhanced duty obligations, hostile vehicle mitigation, organised retail crime, facial recognition legal framework, car park security, and crowd management planning.

4 May 2026

Written by James Whitfield

Speak to the Team

Shopping centres, retail parks, and large malls are Enhanced duty premises under Martyn’s Law, high-profile targets for organised retail crime, and among the most complex venue security environments in the civilian commercial sector. They combine: the crowded places terrorist threat, the hostile vehicle risk at pedestrian entry points, large-scale CCTV infrastructure with legal compliance requirements, organised crime escalation, and extensive car park areas that generate disproportionate personal crime incidents.

This guide covers the specific security planning requirements for shopping centre and retail park operators and their contracted security providers.

Martyn’s Law and the Enhanced Duty Framework

The Terrorism (Protection of Premises) Act 2024 (Martyn’s Law) applies to venues with a qualifying activity at or above the capacity thresholds. Shopping centres hosting retail, food, and entertainment activities with a capacity above 800 are Enhanced duty premises. The Enhanced duty requirements include:

Security Management Plan (SMP): A documented plan covering the terrorism risk assessment, the operational security measures in place, staff training records, emergency procedures, and the communication protocol for security incidents. The SMP must be available to the SIA on request.

Senior Premises Manager: A named individual with accountability for security compliance. This does not have to be the centre manager, but it must be a person with sufficient authority to implement security decisions.

ACT Awareness training: All public-facing staff must have completed ACT Awareness counter-terrorism training (available free through NaCTSO’s ProtectUK platform). This covers: Run-Hide-Tell response for an attack in progress, suspicious package procedures, Action Counters Terrorism reporting, and basic first response.

Terrorism risk assessment: A documented assessment covering the specific threat to the venue – including hostile vehicle attack, lone actor attack, CBRN threat, and cyber-physical attack on building management systems. The assessment drives the security measures.

Hostile Vehicle Mitigation

Shopping centres present multiple vehicle-accessible pedestrian interfaces: main entrance frontages, secondary entrances, service road access, and car park pedestrian exit routes. Each interface carries a hostile vehicle risk that requires individual assessment.

NaCTSO’s HVM guidance recommends PAS 68:2013-tested barriers or bollards at the highest-risk interfaces. The specification of any barrier system should be based on the site’s hostile vehicle impact assessment – the weight and speed of vehicle most likely to be deployed in an attack at the specific location. A city-centre shopping centre on a heavily trafficked road faces a different vehicle threat profile from an out-of-town retail park.

Temporary hostile vehicle mitigation measures (pedestrian barriers, event bollards, concrete blocks) are appropriate for higher-footfall periods – Christmas trading, sale events, promotional activities that attract significantly above-normal footfall.

Organised Retail Crime

The British Retail Consortium Annual Crime Survey 2024 reported GBP 2.2 billion in retail theft for 2023-2024, with violence or abuse towards retail staff recorded in 1.3 million incidents. The escalation is qualitative as well as quantitative: coordinated ORC attacks by organised groups have displaced opportunistic shoplifting as the primary volume theft mechanism.

Prevention framework: The most effective prevention combines intelligence sharing (through Business Crime Reduction Partnerships, BIDs, and direct police intelligence channels), store design modifications (locked cases for high-value goods, reduced front-of-store display accessible without staff assistance), CCTV with coverage of approach routes (enabling identification and intelligence development before an attack, not just after), and a documented staff response protocol that prioritises withdrawal and CCTV evidence capture over physical confrontation.

SIA-licensed security officers on the centre floor provide a deterrent and an initial response capability. Their value is primarily intelligence collection and deterrence – they are not a counter to a coordinated ORC group of 30 individuals and should not be positioned as one.

Car Park Security

Car parks generate a disproportionate share of personal crime incidents in the retail environment. The isolated environment, low-visibility stairwells, and predictable vehicle approach/departure patterns create opportunity for vehicle crime, personal attack, and sexual assault.

The Secure Car Parks Award (operated by the British Parking Association with police input) provides the benchmark standard. The minimum elements are: documented CCTV coverage with identified camera positions, lighting at or above the minimum lux standard (20 lux in parking areas, 50 lux on pedestrian routes), regular patrols with varied timing and documented records, emergency help points, and a response protocol for incidents within 5 minutes.

Multi-storey car parks with separate levels and stairwells require specific consideration of the high-dwell, low-visibility areas where personal crime risk is concentrated. Lone worker protocols for car park staff, including duress alarm provision, are required under the Health and Safety at Work Act 1974.

For the broader late-night licensed premises security framework – bars and nightclubs that operate within retail and entertainment complexes – see our security for alcohol and nightlife venues guide. For the general event security framework applicable to promotional events, markets, and activations within shopping centre environments, see our event security planning guide.

Sources

Terrorism (Protection of Premises) Act 2024 (Martyn’s Law). SIA: Implementation Guidance for Enhanced Duty Premises 2024. NaCTSO: Hostile Vehicle Mitigation Guidance 2024. PAS 68:2013 (Specification for Vehicle Security Barriers). IWA 14-1:2013. British Retail Consortium: Annual Crime Survey 2024. ICO: CCTV Code of Practice 2023. Bridges v South Wales Police [2020] EWCA Civ 1058. Data Protection Act 2018. UK GDPR. British Parking Association: Secure Car Parks Award Standard 2024. Health and Safety at Work Act 1974. NPSA: ProtectUK Crowded Places Guidance 2024. SIA: Door Supervisor Licensing Standards 2024. OSAC 2024.

James Whitfield is a Senior Security Consultant with 20 years of experience in venue security, retail security, and security programme design across commercial environments.

Summary

Key takeaways

Most major shopping centres are Enhanced duty premises under Martyn's Law -- the SIA will be the regulator, and compliance requires a documented Security Management Plan and a named Senior Premises Manager

The Terrorism (Protection of Premises) Act 2024 is not a recommendation. Enhanced duty premises that do not comply face enforcement action by the SIA. Shopping centre operators should treat the preparation of a Security Management Plan, appointment of a Senior Premises Manager, and delivery of ACT Awareness training to staff as immediate compliance obligations, not a future consideration.

The 131% increase in UK retail theft between 2019 and 2024 reflects a qualitative change in organised retail crime tactics, not just volume -- prevention requires intelligence-led planning, not reactive security staffing

The BRC data documents a fundamental shift from opportunistic theft to coordinated, planned ORC attacks. Staffing-only responses are insufficient against a coordinated group of 30 individuals who have conducted advance reconnaissance and assigned specific roles. Effective prevention requires: intelligence sharing with police and neighbouring retail venues, store design modifications that reduce ORC effectiveness, and a trained staff response protocol that prioritises staff withdrawal over confrontation.

Hostile vehicle mitigation is a mandatory element of the Martyn's Law Enhanced duty terrorism risk assessment for shopping centres -- vehicle approach routes to pedestrianised areas need assessment and physical response

NaCTSO's HVM guidance identifies shopping centres as one of the primary crowded places where vehicle-as-weapon risk requires physical mitigation. The terrorism risk assessment required under Martyn's Law must include a specific hostile vehicle assessment. Where the assessment identifies vehicle-accessible approach routes to high-density pedestrian areas, physical mitigation (PAS 68-tested barriers or bollards) is the appropriate response.

Facial recognition technology at retail venues is legally constrained -- deployment requires specific legal basis, a Data Protection Impact Assessment, and ICO compliance before implementation

The ICO has investigated FRT use in retail environments and found compliance failures at multiple retailers. The Bridges case established that FRT cannot be deployed without a clear lawful basis, a current and documented DPIA, and demonstrated proportionality. Retail operators who deploy FRT without this framework are exposed to ICO enforcement (fines up to GBP 17.5 million or 4% of global annual turnover under the DPA 2018) and civil litigation from individuals unlawfully processed.

Car parks are the highest-incident area for personal crime in the retail environment -- lighting, CCTV coverage, and emergency help point provision are the minimum physical security standard

The Secure Car Parks Award standard provides a documented benchmark for car park security. Operators who cannot demonstrate compliance with the minimum illumination, CCTV coverage, and emergency response standards face both regulatory challenge and litigation exposure in the event of a serious incident in an inadequately secured car park area.

FAQ

Frequently Asked Questions

Most shopping centres and retail parks with significant footfall will qualify as Enhanced duty premises under the Terrorism (Protection of Premises) Act 2024 (Martyn’s Law). The Enhanced duty threshold is a capacity of 800 or more people. Major shopping centres – including regional centres such as Westfield, Trafford Centre, and Meadowhall – have capacities well above this threshold. Enhanced duty requirements include: a Security Management Plan documented and available to the SIA on request, a nominated Senior Premises Manager with security responsibility, staff training in ACT Awareness (counter-terrorism awareness through NaCTSO’s ProtectUK), a documented terrorism risk assessment (including hostile vehicle mitigation, crowded places threat, and CBRN awareness), and emergency procedures that are tested and reviewed. Retail parks with significant capacity will similarly qualify. The Act received Royal Assent on 3 April 2024; implementation timelines are being set by the SIA.

Shopping centres and retail parks present a specific hostile vehicle threat: the concentration of pedestrians at entry and exit points, car park areas adjacent to pedestrianised zones, and service road access create multiple approach routes for vehicle-as-weapon attacks. The NaCTSO hostile vehicle mitigation (HVM) guidance recommends a layered approach: permanent physical barriers (concrete bollards, security planters) at the highest-risk pedestrian-vehicle interface points (main entrances, event entrances, pedestrianised frontages), temporary measures for higher-risk periods (pop-up bollards, temporary vehicle exclusion zones during peak events), and CCTV coverage of vehicle approach routes. PAS 68:2013 and IWA 14-1:2013 specify the testing standards for hostile vehicle mitigation products. Products that meet PAS 68 impact test specification at V/7500[N2]80/90 are assessed for vehicles of 7,500kg striking at 80km/h. Specification selection should be informed by the site threat and impact assessment.

Shopping centres’ CCTV systems are governed by UK GDPR, the Data Protection Act 2018, and the ICO CCTV Code of Practice (updated 2023). Signage informing visitors of CCTV recording is a legal requirement, as is a documented retention policy (typically 28-31 days), access controls on recorded footage, and a procedure for responding to data subject access requests and law enforcement disclosure requests. Facial recognition technology (FRT) at shopping centres is a more legally constrained practice. The Court of Appeal judgment in Bridges v South Wales Police [2020] EWCA Civ 1058 established that automated facial recognition requires: a legal basis, a necessary and proportionate purpose, and compliance with the DPA 2018’s requirements for biometric data processing. The ICO has been critical of FRT deployment in retail environments. Retailers deploying FRT – for example, to identify known shoplifters – must have documented legal basis (Article 6 and Article 9 lawful processing), an up-to-date data protection impact assessment (DPIA), and explicit consideration of accuracy and bias issues in the technology.

Organised retail crime (ORC) in the UK has escalated significantly in recent years. The British Retail Consortium (BRC) Annual Crime Survey 2024 reported GBP 2.2 billion in retail theft in 2023-2024, up from GBP 953 million in 2019-2020 – a 131% increase in four years. The specific tactic change that affects shopping centres is the rise of ‘smash-and-grab’ flash mobs: coordinated attacks by groups of 10-40 individuals who simultaneously enter a store (typically luxury goods, electronics, or sportswear), overwhelm staff, and exit with high-value merchandise within 1-3 minutes. These attacks are organised via encrypted messaging platforms, with roles assigned (entry team, bag carriers, lookouts, getaway drivers). The attacks are not spontaneous – they follow a reconnaissance phase in which the store, its security arrangements, and the goods display are assessed. Prevention measures include: advance intelligence sharing between retailers and police (through Business Crime Reduction Partnerships and BID schemes), enhanced store design (goods in locked cases, reduced front-of-store high-value display), physical security upgrades, and evacuation procedure for ORC incidents.

Car parks are the highest-incident area for personal crime in the retail environment. Specific risks include: vehicle crime (theft from vehicle, theft of vehicle), personal attack during approach or departure, sexual assault in isolated parking levels, and child protection incidents. The Secure Car Parks Award (operated by the British Parking Association with Police input) provides a recognised standard for car park security. The elements are: CCTV coverage with identified camera positions, adequate lighting to a minimum 20 lux standard in parking areas and 50 lux in pedestrian routes, regular security patrols (documented and varied frequency), emergency help points in all parking areas, clear pedestrian route signing, and a response protocol for incidents. Multi-storey car parks with upper levels and stairwells require specific attention to lighting and CCTV coverage in the high-dwell, low-visibility areas. Lone worker protocols for car park attendants, including duress alarm provision, are required under the Health and Safety at Work Act 1974 for staff working in isolated environments.

Get in Touch

Request a Consultation

Describe your security requirements below. All enquiries are confidential and handled by licensed consultants.