Lobby emergency playbook: medical emergencies, threats, lockdowns and evacuations

Why visitors change every emergency

Your staff know the drill. A visitor knows the lift lobby and one meeting room; a contractor in a DG room may not hear an announcement. ProtectUK, the UK counter-terrorism policing service, makes the point for bomb threats: staff, contractors and visitors are likely to know fire drills, “however, most will be unfamiliar with the procedures in relation to bomb evacuations.”

Two rules follow. The host owns the visitor: from approval to exit, the employee who invited someone keeps them safe or reports them missing. Reception owns the list: every scenario starts with “who is inside right now?”, and only a register with exit times answers it.

Emergency types at a glance: first actions, who leads, what the visitor list is for

Who does what: roles and the emergency call tree

The call tree. The Ministry of Home Affairs calls ERSS-112 a “State-centric” system: each state’s answering centre passes calls to police, health, fire, disaster and other helplines. MHA’s page, last updated 19 February 2026, says 24 states and UTs had upgraded to ERSS 2.0 and expected the rest by March 2026. The ERSS site says the existing numbers 100 (police), 101 (fire) and 108 (ambulance) will be integrated into 112, and states are at different stages: in January 2026 Delhi announced it would link 100, 101, 108 and other helplines to 112 in a first phase. The Ministry of Health describes 108 as primarily for critical care, trauma and accident cases, and 102 as patient transport aimed at pregnant women and children.

Add the local police and fire stations, the nearest hospital emergency department, building management and the lift contractor’s 24-hour line.

Lockdown, shelter in place or evacuate: how to decide

For threats other than fire, ProtectUK warns that “evacuation in non-fire scenarios is not the same as evacuation due to fire”: glass and fragments from explosive devices injure at a distance, so “moving people inside is often safer than evacuating them onto the streets.”

ProtectUK also warns that “a poorly implemented lockdown can actually increase the risk” and that fire safety duties “may be at odds with lockdown requirements”: ask your fire consultant how your doors behave in a lockdown and on a fire alarm, because exits must stay usable.

Bomb threat procedure for offices in India

The Indian guidance we found is for schools: after hoax email threats to over 100 Delhi schools in May 2024, the Delhi government told schools to check official email at all times and inform the police immediately, and in May 2025, on Delhi High Court directions, its Directorate of Education issued a school SOP with drills run with police and the fire department. We found no national SOP for offices, so the steps below draw on the US Cybersecurity and Infrastructure Security Agency (CISA) and ProtectUK; agree your version with local police.

A threat by phone:

1. Stay calm, listen carefully and keep the caller talking (ProtectUK); do not hang up (CISA).
2. Signal a colleague to alert the incident controller and call the police.
3. Note the number on the display, write down the exact words, and record the call if you can (CISA).
4. Ask where the device is and when it will go off. Note the voice, accent and background noise.
5. If nobody has yet, call the police on 112 or 100 as soon as the call ends.

By email or social media: do not reply to, forward or delete the message, note the sender’s address or user ID, and preserve your web logs for the police (ProtectUK); do not log out, leave the message open, take a screenshot and note the date and time (CISA).

A suspicious item: do not touch or move it, and do not use two-way radios or mobile phones close to it (CISA). ProtectUK’s test asks whether the item is hidden, obviously suspicious, or not typical for the place, and its four Cs are confirm, clear, communicate, control. To clear, it advises moving people at least 100 metres from a small item such as a rucksack and 200 metres from a car, out of line of sight and away from glass, and not using radios or phones within 15 metres. In a dense lobby, agree in advance with local police where people go.

Who decides. ProtectUK says “responsibility for the initial decision making remains with the management of the location being threatened” and advises: “do not delay your decision-making process waiting for the arrival of police.” In India, call the police at once, let the incident controller make the first decision, and follow police instructions when they arrive.

How to handle an intruder or a violent visitor at reception

An intruder or tailgater. Two people approach, ask whom they are visiting, and walk them back to reception to check the register. If the person refuses or turns aggressive, the guard steps back and calls the supervisor by code word.

A weapon or an attack. UK police advice is “RUN, HIDE, TELL”: leave if there is a safe route; otherwise hide behind solid protection, lock or barricade yourself in and silence your phone; call the police when it is safe. Reception or hosts message visitors in meeting rooms with the same instruction staff get; nobody walks the building to find them.

A violent or distressed visitor. CISA teaches four steps: recognise, assess, de-escalate “if safe to do so”, and report, with the rule “safety is the highest priority, know your limits, and obtain help immediately if needed.” One calm person speaks, others clear the lobby, and police are called at the first threat of harm.

Medical emergency at the workplace: first aid and AED at reception

1. Call an ambulance on 108 or 112, and follow the call handler’s instructions.
2. Send a first aider and the AED. AEDs “have been designed so that they can be used by people with little or no training” (Resuscitation Council UK).
3. Start CPR if needed. If the person is unresponsive and not breathing normally, start CPR as the call handler directs and switch the AED on as soon as it arrives (Resuscitation Council UK).
4. Meet the crew: a guard waits at the gate, holds a lift and walks paramedics in.
5. Call the host, and record call and arrival times and who helped.

What the rules say. Section 45 of the Factories Act, 1948 required a first-aid box for every 150 workers, each run by a holder of a State-recognised first-aid certificate, and an ambulance room above 500 workers. The OSH Code, 2020 replaced the Act on 21 November 2025; Trilegal reads the transition statement to mean existing rules continue until new ones are notified. We did not find a national rule requiring offices to keep an AED. The UK’s Health and Safety Executive leaves it to each employer’s first-aid needs assessment.

The watchlist question: how a quiet flag at the gate should work

Many buildings keep a list of people not to admit as a printout in the guard cabin or a photo in a WhatsApp group. Neither is easy to defend.

• Sourced entries only: a court order, a written police request, a recorded incident or an HR decision, never rumour.
• Minimum data: name, photo where policy allows, the instruction, who added it and a review date.
• A quiet flag: the guard sees “call the supervisor”, never the reason; the supervisor and security head see the reason.
• Owner and log: every entry has an owner, goes when the reason ends, and every view is logged.

The DPDP angle. Most DPDP duties apply from 13 May 2027 (Rule 1(4)). Section 8(3) requires completeness, accuracy and consistency where data is likely to be “used to make a decision that affects the Data Principal”, and in our reading refusing entry is such a decision. Section 8(5) requires security safeguards, and section 8(7) requires erasure once the purpose ends unless another law requires retention. Section 7 has no general security ground; section 7(e) covers complying with a court judgment, decree or order, so ask counsel which basis covers each other type of entry. See our DPDP guide.

Accounting for everyone and communicating with visitors

• Count against the live register: hosts confirm visitors, security confirms contractors and drivers, wardens confirm staff.
• Send an “are you safe” message to everyone on the list who has not been counted, asking for “safe” or “need help”.
• Chase in parallel: phone each non-responder and their host. In a fire, give unaccounted names to the fire service at once and keep chasing.
• Close the loop: tell visitors when the all-clear is given. After a real fire alarm, nobody re-enters until the fire officer in charge says so.

Using contact details in an emergency. DPDP section 7(f) covers “a medical emergency involving a threat to the life or immediate threat to the health” of a person, and 7(h) covers safety during a disaster (as the Disaster Management Act, 2005 defines it) or “any breakdown of public order”. A hoax threat or drill may fit neither, so say in your visitor notice that you may contact visitors about their safety.

After-action review, records and drills beyond fire

After any incident or drill, review the timeline, the decisions and who made them, the headcount reconciliation, what failed, and corrective actions with owners and dates. Keep the call log, the visitor list as it stood and messages sent, and ask police whether to preserve CCTV. Rule 8(3) of the DPDP Rules sets a one-year minimum for personal data, associated traffic data and processing logs, for the State purposes in its Seventh Schedule; Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read it as binding every data fiduciary. So keep visit records and their logs for a year, photos and mobile numbers for days (a decision your DPO and counsel sign off), and ask counsel about incident files that may lead to a claim.

Drills that are not fire drills. ProtectUK says lockdown procedures should be “developed, tested, and refined”. For offices, we suggest one non-fire drill a quarter, rotating through:

• Threat call: reception takes a scripted call using the checklist.
• Lockdown: code word, doors, meeting-room messages, a count and the all-clear.
• Medical: time from the call to the AED reaching the patient.
• Lift entrapment, with your lift contractor: passengers must not force the doors, and untrained people must not attempt a rescue.
• ”Are you safe” test: timed to the last reply.

Lobby emergency checklist

1. Name an incident controller and deputy for every shift, and make hosts responsible for their visitors.
2. Print the call tree at reception and the guard post, and check every line can dial it.
3. Keep a live visitor and contractor list with exit times, reachable outside the building.
4. Decide who calls a lockdown, set a code word, and check how your doors behave.
5. Keep a bomb threat checklist at every reception phone.
6. Brief guards: no confrontation, alert by code word, clear people well away from suspect items, no phones or radios near them.
7. Place an AED near reception and train first aiders, including CPR, on every shift.
8. Keep any watchlist short, sourced, quietly flagged and reviewed quarterly.
9. Mention safety contact in the visitor notice.
10. Run a non-fire drill each quarter with visitors on site, review it, and agree the plan with local police and fire service.

Where Orb fits

Orb, our visitor management system, gives the front desk the list and the messages each scenario depends on.

Questions buyers ask