A mobile patrol contract should put four things in writing: visit cadence and clock window, alarm response time with an escalation path, a missed-visit procedure with a service-credit rule, and termination notice with handback. A cover sheet citing each by clause number keeps a dispute on the contract, not on what someone remembers from a meeting.
A written contract is the only reliable evidence you have if a dispute arises.
What should the SLA in a mobile patrol contract specify?
The SLA should name five things in plain language: visits per site per week and the overnight clock window; alarm response time from activation to the named officer on site; the report delivery channel and turnaround; the escalation path for a missed visit or a response breach; and how often the SLA is reviewed.
We anchor each of these in the contract because a vague SLA is the easiest kind to argue about: nobody agrees what counts as a breach. We run 24-hour key holding and mobile alarm response for NHS Trust pharmacies and surgeries, and you can read how that work is set up in our NHS Trusts case study.
Which KPIs should a mobile patrol contract measure?
Five KPIs cover most UK mobile patrol contracts: visit completion against the contracted count; alarm response time against the SLA target, with a stated tolerance band; reports delivered within 24 hours of the visit; a missed-visit rate below a named monthly threshold; and complaints resolved within a stated number of working days.
Give each KPI a measurement method as well as a target, because a dispute is usually about how the number was produced. We report each KPI monthly, so you can see the trend without waiting for the contract review.
What missed-visit and service-credit clauses should the contract contain?
Four clauses cover it: a definition of a missed visit (no scan logged, no officer attendance, no report filed); an automatic service credit per missed visit; a monthly cap on cumulative credits; and an escalation procedure that names the contact and the response time if a credit is disputed.
Set the credit and the cap with care. Courts applying the penalty rule ask whether a clause is out of all proportion to a legitimate interest of the innocent party (Cavendish Square Holding BV v Makdessi [2015] UKSC 67). Reliable patrol coverage is a legitimate interest so the aim is a credit sized to it but the figures are a matter for your solicitor.
Service-credit model clause
If the contractor fails to complete a scheduled mobile patrol visit within the agreed time window, the buyer is entitled to a service credit of five per cent of the monthly contract value for each missed visit, capped at fifty per cent of the monthly invoice. The contractor applies the credit to the next invoice automatically, without the buyer having to claim.
The percentages are an example, not a recommendation. Agree figures that reflect the cover the site needs.
What termination and exit terms should the contract contain?
Five terms close a mobile patrol contract cleanly: a notice period in weeks or months; a termination-for-cause clause; a handback period in which the provider keeps patrolling while you transition; a return-of-keys and access-code procedure with named sign-off and a window for the final invoice and service-credit settlement.
Termination for cause should cover repeated SLA breaches, insolvency, and any loss, suspension or expiry of a required SIA licence or other regulatory approval that stops the services being performed lawfully.
Termination-for-cause model clause
The Private Security Industry Act 2001 requires anyone carrying out a licensable security activity to hold a valid SIA licence. Licensable activities include security guarding, keyholding, door supervision, public space surveillance (CCTV), close protection, and cash and valuables in transit. It is a criminal offence to supply unlicensed operatives for licensable work subject to statutory exemptions and defences. Our SIA licensing checklist covers what to check.
ACS is the benchmark scheme for licensed UK security suppliers, so a lapse means the contractor can no longer show you that it complies.
If the contractor’s SIA Approved Contractor status is suspended, revoked or expires during the term, the buyer may terminate the contract immediately, without notice or compensation to the contractor, and may recover its reasonable transition costs.
How do you negotiate a mobile patrol contract before signing?
Send us four things: your proposed visit cadence and clock window; the alarm response target and tolerance band; the KPI targets and service-credit rule you want; and the termination notice period you expect. We return a fixed-fee proposal within two working days.
If you are still deciding between patrols and a static officer, our guide to manned guarding versus mobile patrol sets out the difference, and our mobile patrols page describes the service itself.
How should the contract handle changes to visit cadence?
Under English contract law, existing terms cannot normally be varied by one side alone. A variation needs both parties’ agreement, which may be express or implied by conduct, and a unilateral change without consent is likely to be a breach, with a risk of a damages claim or termination.
Treat visit cadence, route coverage, report timing and alarm response windows as core terms, and resist any clause that lets the provider cut visits or scope on its own.
Variation and change-control model clause
No amendment, waiver or variation of the service schedule (including visit frequency, route coverage, report delivery timing or alarm response window) is effective unless agreed in writing and signed by an authorised representative of both parties. Where the contractor proposes a change, it gives the buyer not less than fourteen days’ written notice, an impact assessment covering cost, KPI performance and data-protection implications, and a draft change-control note for the buyer’s approval. Where the buyer proposes a change, the contractor responds within seven working days with a costed proposal. A unilateral change to the service schedule by either party is a breach of contract and engages the termination-for-cause clause.
How should the contract handle data protection for patrol reports and body-worn video?
Patrol reports, keyholding logs and body-worn video all contain personal data, so the contract should split controller and processor duties under UK GDPR Article 28, set retention periods, fix incident-notification times, and require a DPIA review for any new use, such as body-worn video in residential common areas.
Under UK GDPR and the Data Protection Act 2018, processing must be lawful, fair and transparent. Information Commissioner’s Office guidance on body-worn video stresses a Data Protection Impact Assessment, clear privacy information for individuals, retention and disposal rules, and the ability to answer subject access requests and redact footage.
Data protection and body-worn video model clause
The contractor acts as processor for the buyer (the controller) for any personal data processed under the contract. The contractor processes personal data only on the buyer’s documented instructions, keeps records of its processing, and applies appropriate technical and organisational measures, including encryption in transit and at rest, role-based access controls and a documented breach-response procedure. The contractor notifies the buyer within 24 hours of becoming aware of a personal data breach. Body-worn video is retained for 31 days unless the buyer instructs otherwise in writing, in which case the longer period is recorded in the DPIA. Either party passes a subject access request to the other within five working days.
The 24-hour and 31-day figures are examples to agree case by case.
What due diligence should you do before signing?
Verify the contractor’s regulatory status and certified scope from public records, then ask to see how it documents a visit and an alarm response. Five checks cover it, and none needs a paid tool: the first three are public record, and the last two are one email away.
- Confirm ACS status, sector approval and expiry date on the SIA Register of Approved Contractors.
- Pull the latest ISO certificate and read the scope statement, to check that mobile patrol and keyholding fall within it.
- Check Companies House for the legal entity, registered office and current directors.
- Request a sample patrol report and a sample incident report.
- Ask for the contractor’s last client-retention rate and the average tenure of the supervisor who will run your account.
Also ask how officers are screened before they reach your site, and which standard that screening follows.
Which red-flag clauses should buyers watch for?
Four patterns shift risk to the buyer or let performance slip without a remedy: broad unilateral variation rights; a definition of SLA failure that excludes missed visits; service credits capped so low, or wrapped in claim procedures so restrictive, that they never pay out; and clauses excluding all liability for regulatory breaches, including the use of unlicensed officers.
Balanced protections look like this: a written variation process for visit frequency, route coverage and alarm response window; a service-credit regime whose figures your solicitor has tested against the Cavendish rule; termination for cause on loss of SIA approval or licence; and an indemnity for regulatory breaches involving unlicensed officers. Have your solicitor review any liability clause before you sign.
Frequently asked questions
The missed-visit service-credit clause. It defines what counts as a missed visit, the credit per missed visit, the monthly cap and the route for disputing a credit. Without it, the provider faces no contractual consequence for failing to attend. With it, the invoice falls automatically and any dispute is about numbers, not principle.
Monthly for the first quarter after signing, then quarterly. Monthly review catches SLA drift while there is still time to correct it, and quarterly is enough once performance has been consistent. We send every client a monthly SLA dashboard for the first 90 days and move to quarterly on request.
Send us the site address, the hours you need covered and a short description of the site's risk profile. We use those to price a fixed-fee proposal, which we return within two working days of receiving your four contract terms. You then mark up the cadence, response, KPI and termination terms in it.
