Page 9 - CITS Theft Guide

CITS Guide for Theft Prevention
- 9 -
CESAR scheme (see Annex B). This is a live area of policy and CITS members should check for updated
secondary legislation periodically.
2.4. Data Protection Act 2018 and UK GDPR
The Data Protection Act 2018 implements the UK's data protection regime alongside the UK General Data
Protection Regulation. Construction sites generate and hold significant volumes of personal data — access
control logs, CCTV footage, driver and delivery records, and the personal data of the workforce — and
increasingly hold sensitive design and asset data through Building Information Modelling (BIM). Site
operators are expected to implement proportionate technical and organisational measures, conduct data
protection impact assessments where appropriate, and be able to demonstrate accountability. Section 8
of this guide addresses the practical steps this implies for cyber hygiene and BIM access control.
2.5. Occupiers' Liability Acts 1957 and 1984
The Occupiers' Liability Act 1957 sets out the duty of care owed to lawful visitors, and the Occupiers'
Liability Act 1984 extends a more limited duty of care to trespassers. It is important for the occupier of a
construction site to understand that a duty of care to trespassers exists, even where their presence on site
is unwelcome or unlawful; an occupier cannot disregard this duty. Effective, well-signed, and well-
maintained perimeter security is one of the most direct ways an occupier can manage this exposure,
alongside making the site itself less attractive and less hazardous to enter without authorisation.
2.6. Modern Slavery Act 2015
The Modern Slavery Act 2015 makes provision about slavery, servitude, forced or compulsory labour, and
human trafficking. Construction has been repeatedly identified, both in the EU and in the UK, as a sector
at elevated risk of labour exploitation. Robust workforce identity checks, undertaken as part of site access
control, contribute to reducing this risk as well as to reducing insider threat, and should be seen as a shared
objective of safety, security, and ethical labour practice.
2.7. The Planning Act 2008 — Development Consent Orders
The Planning Act 2008 created a regime for granting development consent for Nationally Significant
Infrastructure Projects — large-scale developments such as harbours, roads, railways, power stations, and
electricity transmission infrastructure. Projects that fall within this regime typically carry a heightened
security profile, given their scale, critical national infrastructure status, or public visibility, and may warrant
a security overlay from project inception, in line with NPSA guidance referenced in Annex B.
2.8. Common law duty of care and the reasonable person standard
Much primary legislation uses phrases such as "so far as is reasonably practicable" or "reasonable
precautions." This requires a contractor to make a judgement, generally assessed against the reasonable
person standard used in the law of tort. Negligence is typically a failure to act with the prudence of a
reasonable person; a documented, risk-based approach to site security, of the kind this guide describes,
is one of the clearest ways a contractor can demonstrate that this standard has been met.
2.9. Security Industry Authority Act 2001
The Security Industry Authority (SIA) Act 2001 established the SIA, which regulates the private security
industry in the United Kingdom. Individuals performing licensable security activities on a construction site