A duty of candour (under the ‘Hillsborough Law’ pushed by the Sir Keir Starmer Government) only works if the evidence already exists, says Lloyd Major, pictured, CEO of the incident management software developers Halo Solutions.
The Public Office (Accountability) Bill, widely known as Hillsborough Law, passed its second reading in the House of Lords on September 1 and is now heading into Committee stage. It sits alongside Martyn’s Law as the second major piece of legislation in two years asking the same underlying question of anyone running security operations at scale: not just were the right decisions made, but can you prove it?
I’ve made this point about Martyn’s Law before, and the Lords debate on the Hillsborough Law made it again from a different angle: a legal duty doesn’t create the culture it’s trying to protect. Several peers raised concerns that legislation alone won’t guarantee institutions actually change how they behave once the pressure is on. That’s not a criticism of the Bill. It’s just true of any Act of Parliament. Culture gets built on the ground, incident by incident, long before anyone’s asking questions about it.
For security teams specifically, duty of candour lands somewhere very particular: you’re often the people closest to the decision, and the first ones asked to account for it afterwards. That’s not a comfortable position to be in evidence terms if your record of what happened lives across three radio channels, somebody’s notebook, an incident form filled in the next morning, and whatever the CCTV managed to catch. None of that is negligence. It’s just how most sites still operate, and it becomes a serious problem the moment somebody needs a defensible account of who knew what, when, and why one decision was made rather than another.
Being ready for a duty of candour isn’t a legal exercise, and it isn’t something to reach for once an inquiry looks likely. It’s an operational habit, built well before it’s needed: incidents logged from the ground as they happen, not reconstructed the next day. Actions and communications time-stamped and attributed to the person who made them, not written up after the fact by whoever’s free. A single, shared record that control room, supervisors and frontline officers are all actually feeding into โ not separate logs that only get compared once something’s already gone wrong.
There’s a protective element to this worth being honest about. A reliable record doesn’t just serve the organisation. It protects the individual officer or supervisor who made a good call under real pressure and later has to explain it โ to a manager, an insurer, or an inquiry. Without that record, a right decision and a wrong one can end up looking identical on paper, and that’s a genuinely unfair position to leave your own people in.
It also changes what training and briefing need to cover. Knowing the procedure isn’t the same as knowing why the record matters, or what “good” looks like when you’re the one filling it in under pressure. Teams that understand that distinction tend to produce better records without being told to โ because they understand what the record is actually for, not just that it’s required.
Ask the same basic question you’d ask about Martyn’s Law readiness: can you see what’s happening across your site right now, on one dashboard? Can you trust what it tells you, and could you prove that to somebody else afterwards? If any part of that answer is no, that’s not a failure of your security teams. It’s a gap in what they’ve been given to work with. Clear, time-stamped records don’t just show what was decided, they show why โ and that’s the actual substance of candour. It has to already exist before anyone asks for it.
About the author
Lloyd Major is CEO of Halo Solutions, an incident management platform used across public safety and security operations. He is a former counter-terrorism police officer with over 20 years of operational experience. Visit https://www.halosolutions.com/.
