Retail security in Ireland: what it covers, what the law allows, and how it is checked

01

What retail security is, and the law behind it

Retail security covers the people, procedures and equipment that protect a shop against theft, burglary, robbery, damage and violence. In a large store or shopping centre that means uniformed security officers, store detectives, CCTV, security tags and an intruder alarm; in a small shop it may be the manager, the staff and a sound routine for opening, closing and cash. Either way, most of it is done by people who are not security professionals. An Garda Síochána's Retail Security Guide says attentive staff are the best asset in shoplifting prevention, and that too often prevention "is left to security staff alone".

Anyone paid to guard is regulated. The Private Security Services Act 2004, amended in 2011 and 2021, set up the Private Security Authority (PSA) and defines a security guard as a person who for remuneration "guards or patrols or provides any other protective services in relation to persons or property". The definition expressly includes someone who does this only for an employer that is not a security firm, which describes an in-house store security team. Section 37 makes it an offence to provide a security service without a licence for it, section 38 to employ or engage someone unlicensed to provide one, and under section 29 a licence holder must carry the PSA identity card while working and produce it on request to the client, a Garda or a PSA inspector.

Contract guarding firms are licensed against the PSA's standard PSA 28:2013. The PSA's Auditing Guidelines for Certification Bodies for PSA 28:2013 (2025 edition) set out what an auditor inspects: site risk assessments, assignment instructions kept on site, training, incident reports and the firm's command and control system.

The offence at the centre of it all is theft. Section 4 of the Criminal Justice (Theft and Fraud Offences) Act 2001 says:

Section 4(6) sets the maximum penalty on indictment at ten years' imprisonment, a fine, or both, which is what brings shoplifting within the citizen's power of arrest (section 03 below). And the staff are covered by section 19 of the Safety, Health and Welfare at Work Act 2005, which requires every employer to identify the hazards, assess the risks and hold a written risk assessment. In retail, the HSA treats violence and aggression as a hazard that has to be risk assessed like any other, with control measures put in place.

02

What retail security covers in practice

The Garda guide works through staff, security personnel, loss prevention, stock and customers. On a typical shop floor that comes down to:

• Customer theft, from opportunists to organised teams, including "steaming", where a large group intimidates or distracts staff to take goods in bulk. The guide warns it can be dangerous to tackle them.
• Internal theft: staff processing their own purchases, collusion with customers or drivers, and "No Sale" till entries, checked by controlled staff purchases and spot checks at cash points.
• Stock and goods inward: one goods-in point, deliveries checked and re-checked, drivers escorted, loading bay doors kept closed, and high-value goods tagged and kept away from the doors.
• Cash: till limits, a cash office out of public view with a panic attack button at each work position, and lodgements made by a cash-in-transit company or by at least two experienced staff varying time and route.
• Robbery: a plan every member of staff knows. During a robbery, co-operate, obey and observe, and never try to overpower the thief.
• The building out of hours: lighting, shutters or grilles, the intruder alarm, keyholders, and the opening and closing routine.
• CCTV: cameras with a stated purpose, signed, working and handled lawfully.
• Fire and escape: security must never lock or block an escape route while anyone is inside.

In a shopping centre, where the landlord's team covers the malls and car parks and each tenant its own unit, the Garda guide advises an opening and closing procedure agreed among the parties. The wider duties of a security officer apply in a shop as anywhere, and the building as a whole may need its own site security checklist.

03

Shoplifting, arrest and searches: what staff may and may not do

A PSA licence is permission to provide a security service; it gives an officer no more power over a customer than any other member of the public has.

The power of arrest is in section 4 of the Criminal Law Act 1997. Any person may arrest without warrant someone they reasonably suspect to be committing an arrestable offence (one punishable by five years' imprisonment or more, which theft is), or, where one has been committed, someone they reasonably suspect to be guilty of it. But a person who is not a Garda may do so only where they reasonably suspect that the person would otherwise attempt to avoid, or is avoiding, arrest by a Garda, and must hand them over to the Garda Síochána as soon as practicable.

The Garda Retail Security Guide sets out how staff or security should deal with a suspected shoplifter:

1. Keep the suspect in sight at all times.
2. Be absolutely sure a theft has taken place and that the suspect has the item.
3. Do not approach until they have passed the final cash point and are heading for the exit.
4. Ask whether they have forgotten to pay, and ask them back into the shop to a room away from other customers and staff.
5. If possible, have two staff involved from this point, and give the suspect the chance to explain and produce the items.
6. Call the Gardaí. The staff member "has no power of search".
7. Record the incident, with the date and time, in a notebook.
8. When the Gardaí arrive they take charge, and may arrest the offender if an offence is disclosed.

Two things matter most. Safety: the guide says the primary aim when facing an aggressor is self-preservation, and that nobody should attempt to restrain or arrest someone without sufficient help. And the record: the notebook entry, the incident report and the CCTV footage are what the Gardaí and, later, a court will rely on, and an entry written at the time is worth far more than one reconstructed at the end of the shift. Writing a security officer's report covers what goes in one.

04

Violence and aggression towards shop staff

The HSA's Information Sheet on Work-related Violence and Aggression in Retail defines it as "any incident where staff are abused, threatened or assaulted in circumstances related to their work, involving an explicit or implicit challenge to their safety, health or wellbeing", verbal abuse and threats included. It reports a survey carried out for the HSA in the fourth quarter of 2024 (310 people online, 200 by telephone): 51% of retail employees surveyed experience violence and aggression towards them or colleagues monthly. The most common triggers it lists are challenging behaviour, drink or drugs, a complaint, theft or suspected theft, refusing service or entry, and waiting times.

Theft, refusal of entry and complaints are exactly the situations where security steps in, so the security plan and the risk assessment should be written together. The HSA's suggested controls, chosen by risk assessment, include:

• a clear message that violence will not be tolerated, and full support for staff after an incident;
• a robust reporting system for every incident, and training for staff;
• a shop floor where staff can see and communicate with each other, with no places to become isolated, and good lighting;
• places of refuge, and panic buttons that are visible, unobstructed and known;
• controlled access behind counters and tills, counters clear of anything that could be thrown, and screens where necessary;
• CCTV with signs saying it is there and why;
• an experienced colleague rostered to support others, an easy way to call for help, and lone working avoided where possible;
• security personnel where the risk assessment deems them necessary, and consideration of panic alarms, body-worn cameras and radios.

The HSA says "a system of internal recording of all incidents of violence and aggression should be put in place", and notes that CCTV and body-worn cameras may be subject to data protection law.

For contract security, PSA 28 builds the same duty into the audit. The auditing guidelines expect risk-mitigating measures in the site risk assessment to have been implemented, a mechanism for calling assistance where a risk of recurring violence has been identified, two or more operatives where a high risk of violence has been identified, and incidents of violence investigated. And: "In relation to door security and retail security staff a check in call must be made at the start and end of each shift."

05

Opening, closing, CCTV and the daily checks

The Garda guide calls opening and closing "high-risk periods" and advises:

• designated people, preferably two, open and close, and avoid a fixed pattern;
• the names and contact details of all keyholders are available to the Gardaí and kept up to date;
• no extra keys are cut and no master keys used, and alarm codes are known only to nominated staff;
• toilets, storerooms and other hiding places are visited before locking;
• tills are left open and empty, cash kept to a minimum, and the premises stay well lit after closing.

The Garda RS1 Retail Security Checklist turns the physical side into yes or no questions: entry points checked for tampering; locks sound and all keys accounted for; lighting working; climbing aids such as wheelie bins removed; the alarm and panic attack buttons tested and serviced; the keyholder list reviewed, and no former staff holding keys; sensors and cameras not blocked by screens, signage or stock; the recorder secure, its clock right, and capacity for at least 28 days; high-value goods near a till and away from the doors; the stockroom tightly controlled.

CCTV is where security meets privacy. The Data Protection Commission's Guidance on the Use of CCTV for Data Controllers (November 2023) uses a convenience shop as its first example: cameras on the areas where shoplifting has happened and on the till, an external camera on the door aimed away from the street, and none where staff take breaks. It also advises:

• clear, well-lit signs at every entrance stating the purpose and who controls the system;
• for a normal security system, it is difficult to justify keeping footage beyond one month, unless it shows an issue such as a theft and is kept for that investigation;
• a security company operating cameras for a client may be a data processor, with a contract covering what it may do with the footage and how long it is kept;
• CCTV justified for security should not be used to monitor staff attendance or performance;
• footage goes to the Gardaí on a formal written request, and a record is kept of every Garda request.

Fire safety runs through all of this. Under section 18(2) of the Fire Services Act 1981, the person in control of premises the public uses must take all reasonable measures to guard against fire and ensure, as far as is reasonably practicable, the safety of people there if one breaks out. Chained fire exits, stock in escape corridors and a shutter locked with staff inside all work against it; a security round should check that exits open and routes are clear.

Faults found on the rounds need somewhere to go. A broken lock, a failed light over the rear door or a sensor blocked by a display stays a security problem until someone fixes it. Section 20 of the Safety, Health and Welfare at Work Act 2005 requires the safety statement to name the people responsible for the tasks it assigns; the security checks, and who acts on them, belong there.

06

Where the retail security record fails, and where SiteClara fits

Most retail security failures are not dramatic: the closing check signed at nine o'clock when the storeroom was never walked, the sensor behind a display nobody noticed for a month, the broken rear-door lock written in the occurrence book and never passed to maintenance. When something is then stolen or someone is hurt, the retailer, the landlord and the security firm each look for a record of what was checked, by whom and when, and find a tick on a sheet.

SiteClara gives those routine checks a record made where they happen. A printed QR poster, with an optional NFC tag behind it, sits at each point on the round: the rear fire exit, the goods-in door, the stockroom, a car park level, the service yard. The officer or member of staff scans the code or taps the tag on their own phone, with no app to install, and marks the scheduled check done, or says what stopped them. The time and the named person are recorded as it happens, with a photo when one helps. A fault found on the round is reported there and goes onto the team's list of open jobs until someone closes it.

The supervisor sees what is due, done and missed, records why a check was missed from the company's own list of reasons, and works from a queue of open jobs grouped by building and floor, escalating one to the building manager when it needs them. At the end of the day the supervisor reviews the totals and photos, adds a note and approves the daily report, which goes to the nominated managers the next morning.

07

Questions people ask

What does a retail security guard do?

The Private Security Services Act 2004 defines a security guard as a person who for remuneration "guards or patrols or provides any other protective services in relation to persons or property", and that includes monitoring security equipment. In a shop the work is deterring and dealing with shoplifting and internal theft, which is why An Garda Síochána's Retail Security Guide says that in most major retail outlets "it is now necessary to employ dedicated security personnel", either directly or through a contract security agency. The officer works to the site's assignment instructions and follows the shoplifting procedure in section 03.

Does a retail security guard need a PSA licence?

Yes, if they are paid to guard, whether they work for a security firm or directly for the retailer. The Private Security Authority's page Who is Licensable? (Employees) says anyone working as a Security Guard (Guarding) must have a PSA licence. Its page Applying for a First Licence (Employees) sets out the requirements: evidence of the required training, a QQI certificate or equivalent (the course often advertised as static security), photo identification and Garda vetting, with about six weeks to process a new application. Under section 37 of the Private Security Services Act 2004, providing a security service without a licence carries a fine of up to €3,000, up to 12 months' imprisonment or both on summary conviction, and up to five years on indictment.

What is a security guard not allowed to do in Ireland?

A security guard has no more power than any other member of the public. Section 4 of the Criminal Law Act 1997 lets any person arrest someone they reasonably suspect to be in the act of committing an arrestable offence, such as theft, but only where they reasonably suspect the person would otherwise try to avoid arrest by a Garda, and the person must be handed over to the Gardaí as soon as practicable. The Garda Retail Security Guide says the staff member "has no power of search" and should call the Gardaí, and that one should only "attempt to restrain or arrest an aggressor" with sufficient help. So a guard has no power to search a customer, and may not keep someone they have arrested instead of handing them to the Gardaí.

08

Further reading, and a list to take away

The primary sources, all free to read:

• An Garda Síochána's Retail Security Guide and RS1 Retail Security Checklist; your local Garda Crime Prevention Officer can also advise.
• The HSA's Information Sheet on Work-related Violence and Aggression in Retail.
• The Private Security Services Act 2004 (revised) and the PSA's Auditing Guidelines for PSA 28:2013.
• Section 4 of the Criminal Law Act 1997 and of the Criminal Justice (Theft and Fraud Offences) Act 2001.
• The Data Protection Commission's Guidance on the Use of CCTV for Data Controllers.

A retail security check for a shop or shopping centre manager:

• Anyone paid to guard holds a PSA licence and carries the identity card.
• The risk assessment covers theft, robbery and violence towards staff.
• Everyone knows the shoplifting procedure: be sure, wait for the final cash point, two people, no search, call the Gardaí, write it down.
• Nobody tackles a group, a robber or anyone armed.
• Every incident of violence or aggression is recorded, and staff are supported.
• Two designated people open and close, with toilets and storerooms checked at locking-up.
• The keyholder list is current and held by the Gardaí, and no former staff have keys.
• Alarms and panic buttons are tested, and nothing blocks a sensor or camera.
• CCTV is signed, footage kept no longer than needed, and Garda requests logged.
• Fire exits open and escape routes are clear whenever anyone is inside.
• Faults found on the rounds reach someone who fixes them.