Search for the regulations governing shopping centre security and you will not find a single act with that name. What you will find, once you are responsible for one, is four separate legal regimes that all apply at once, each with its own regulator, its own paperwork and its own failure modes. This article maps them: what each one requires, who enforces it, and what a centre manager or FM team should have in place for each.
1. Fire safety: the Regulatory Reform (Fire Safety) Order 2005
The oldest and most enforced regime. The Fire Safety Order makes the Responsible Person, in practice usually the centre’s owner or managing agent for the common parts, and each tenant for their own unit, legally accountable for fire precautions: risk assessment, detection and alarm, escape routes, emergency lighting, signage and maintenance of all of it.
Shopping centres are a specific challenge under the Order because responsibility is split. The landlord runs the malls, service yards and back of house; every retailer is a Responsible Person for its own demise; and the two sets of systems have to work as one when an alarm activates. Article 22 requires Responsible Persons who share premises to cooperate and coordinate, which in a centre with dozens of tenants is not a courtesy, it is a duty. Where security hardware meets the fire strategy, the interface is regulated too: electronically locked doors on escape routes must release on alarm under the principles of BS 7273-4, a subject we covered in detail in our article on access control and fire alarm release.
2. Counter terrorism: Martyn’s Law
The newest regime, and the one with a countdown attached. The Terrorism (Protection of Premises) Act 2025, Martyn’s Law, received Royal Assent in April 2025, and its first provisions came into force on 15 June 2026, switching on the Security Industry Authority as regulator. The main duties on premises are expected in spring 2027.
Shopping centres sit squarely in scope. Premises listed in Schedule 1 of the Act, and shops and shopping centres are listed, fall into the standard tier where 200 or more people may reasonably be expected on site at once, and the enhanced tier at 800 or more. Almost every managed shopping centre in the country will be an enhanced tier premises. That brings requirements to notify the SIA, to put in place public protection procedures for evacuation, invacuation, lockdown and communication, and, for the enhanced tier, to assess and document the security measures that reduce both the risk of an attack and the harm one would cause. Our Martyn’s Law commencement article covers the timeline and both tiers in detail.
The practical consequence for security systems is that CCTV, access control, lockdown capable door hardware and public address stop being discretionary spend and become the evidenced means by which a legal duty is met.
3. CCTV and data protection: UK GDPR and the Data Protection Act 2018
A shopping centre’s CCTV system films the public all day, which makes the centre operator a data controller under UK GDPR and the Data Protection Act 2018, with the Information Commissioner’s Office as regulator. The obligations are specific: signage telling people surveillance is in operation and who operates it, a lawful basis and a documented purpose for the system, retention periods that are set and kept, controlled access to footage, and the ability to answer a subject access request from anyone whose image you hold.
This is the regime most likely to be tested not by an inspector but by a member of the public, a solicitor after an incident, or the police requesting footage. A system that records over itself before the retention period, or one where nobody can say who has access to the recorder, fails quietly until the day it fails publicly.
4. Alarms and response: certification standards the police actually check
Intruder and hold up alarm systems in commercial premises are designed and graded to BS EN 50131, and remote signalling and monitored response run through an alarm receiving centre. Here the standard has teeth through police policy: under national police guidance, a new alarm system only qualifies for police response if it is installed and maintained by a company certificated by an approved inspectorate, in practice NSI or SSAIB. An uncertificated installation can leave a centre with an alarm that sounds but no police URN behind it.
The same logic runs through monitored CCTV and alarm response: detection is only worth what the response arrangements behind it can deliver, and insurers increasingly write certification requirements into policy conditions.
What a centre should have in place
- One fire strategy across landlord and tenants, with the cooperation duty under Article 22 actually exercised: shared cause and effect, coordinated testing, and a common approach to alarm response.
- A Martyn’s Law preparation file: expected occupancy figures, tier determination, draft public protection procedures, and a gap review of existing CCTV, access control and communication systems against them.
- A CCTV data protection pack: signage, retention schedule, access log and a subject access procedure someone actually owns.
- Certificated systems with the paperwork to prove it: NSI certificated installation and maintenance for alarms and CCTV, service records current, and the fire alarm interface to security locked doors tested door by door.
How Gemini AMPM can help
Gemini AMPM designs, installs and maintains security and fire systems for shopping centres: NSI Gold certificated intruder alarms, CCTV, access control and monitored response, integrated with the fire detection the same buildings depend on. One contractor across both disciplines means the interfaces between them, the exact places where these four regimes meet, are designed and tested rather than assumed. Call 0330 043 0080 or request a consultation.
