A scope requiring distinctions between functions
Article 3 of Spain’s Occupational Risk Prevention Act includes employment relationships and administrative or statutory personnel with particular provisions. Its exceptions concern activities whose characteristics prevent application of certain rules in specified public functions. They do not exclude everything a person does because they wear a uniform or place every security establishment outside prevention.
For prisons, the legislation provides for adaptation of activities justifying special regulation. Royal Decree 67/2010 develops the State administration framework. Before applying a rule, identify the employer, actual function and relevant specific legislation. Regional and local administrations may have their own organisation and implementing provisions, which the State regime does not automatically replace. The starting point is a reasoned coverage decision rather than a blanket institutional label.
National Police and Guardia Civil: specific rules
Royal Decree 2/2006 regulates prevention for National Police personnel within its scope. Royal Decree 179/2005 addresses the Guardia Civil and included personnel, with wording updated in February 2026. Both provide for assessment, training and protection adapted to the characteristics of their functions.
Tasks without features exclusive to the special activities follow the general framework with the stipulated particularities. Guardia Civil military missions follow specific rules. These arrangements should not be transferred without analysis to regional or local police, private security or contractor personnel. The shared word “security” covers different relationships and powers requiring their own legal mapping. An appropriate preventive measure may be similar across workplaces while the authority, representation and procedure for implementing it differ.
Assess actual work rather than the building alone
Assessment needs to distinguish public contact, intervention, transfers, administration, catering, maintenance, cleaning and healthcare where present. Exposures, equipment and the ability to organise tasks differ. A building inventory can identify physical defects but does not by itself capture workload, interaction with other people or service circumstances.
Review follows the applicable rule. For example, article 5 of Royal Decree 2/2006 provides for review every four years and in the other specified situations; this is not universal expiry of every occupational risk assessment. The Guardia Civil has its own updating and review provision. Changes and harm should activate the appropriate examination without mechanically waiting for a calendar date. Each review should identify what changed and whether existing measures remain effective.
External violence and psychosocial demands
Interaction with conflict situations may require assessment of assaults, threats, emotional demands, shifts and organisational support. This does not justify assuming every detained person or service user is dangerous or every professional will develop a disorder. Analysis focuses on tasks, conditions, incidents and opportunities for prevention, with participation and confidentiality.
Measures may include organised support, communication, appropriate training and post-incident care according to assessment and competent procedures. They should not be reduced to demands for individual resilience. Aggregated information helps identify recurring situations without exposing personal details. Diagnosis belongs to healthcare; preventive questionnaires should not become automatic fitness tests or rankings of professional reliability. Organisational improvements need their own follow-up rather than relying solely on individual counselling.
Biological exposure and hygiene without stigma
Healthcare, contact with bodily fluids, cleaning or waste management may involve biological exposure depending on the activity. Assessment under Royal Decree 664/1997 identifies the nature, degree and duration of exposure rather than attributing infection to a population group. Controls are selected by task and exposure route, including hygiene, suitable resources and incident-reporting arrangements.
Healthcare professionals assess vaccination and surveillance according to risk and the applicable framework. Accidental exposure requires the planned care pathway without waiting for administrative forms to be completed. Contaminated clothing and equipment need appropriate management. Diagnoses concerning detained people or staff should not circulate as substitutes for controls that must work for foreseeable exposures. Information should support care and prevention while respecting each person’s dignity.
Ergonomics, facilities and support tasks
These workplaces also contain ordinary hazards: manual handling, postures, screens, cleaning products, electrical installations and kitchen equipment. Their lower visibility compared with operational security does not make them secondary. Assess them by job, frequency and actual conditions, including people working when less support is available.
Prevention can address design, maintenance, mechanical assistance, product selection and organisation. Equipment changes should consider compatibility with the service and with its users. Access restrictions do not justify leaving a dangerous defect unresolved indefinitely; they require coordination of a safe intervention. Operational and technical instructions should be consistent so complying with one does not make compliance with another impossible. Support-service workers need usable information, suitable resources and a route to raise unresolved problems.
Organisation, participation and confidential health care
Preventive organisation must identify management responsibilities, technical resources and participation channels under each regime. Bodies and representatives are not identical across all services. Planning needs actions, resources, accountable roles and verification; passing an incident between departments without resolving it does not control the risk.
Health surveillance is linked to risks and safeguards, applying the group’s specific provisions. Distinguish clinical information, necessary preventive conclusions and other fitness procedures governed by their own rules. Publishing diagnoses in a shift list or assuming every examination follows the same regime is inappropriate. Adjustment proposals should reach those able to implement them while clinical access remains restricted. A management need to organise work does not create unrestricted access to a worker’s medical history.
Contractors and concurrent activities
Maintenance, construction, cleaning and external services may overlap with normal operations. Coordination identifies reciprocal risks and necessary emergency instructions without indiscriminate disclosure of sensitive information. Each employer retains its duties; permission to enter does not by itself demonstrate that the task is safe.
Before work, define conditions, interactions, communication responsibilities and responses to change. Preventive information must be sufficient for the activity and understandable to those performing it. If new risks appear, coordination is reviewed. A generic document for every establishment can omit essential local circumstances. Access control and prevention should work together while retaining distinct purposes. Contractors need information appropriate to safe performance, rather than either no information or unnecessary operational details unrelated to their work.
Emergency planning: registration exemption does not remove the plan
The Basic Guideline published through Order INT/1068/2026 is the current State reference for self-protection planning, subject to its scope and adaptation provisions. Section 1.4 exempts specified prison and security-service establishments, among others, from administrative control and registration while preserving preparation of the plan under the guideline. This is not an exemption from preparedness or response.
Planning identifies risks, organisation, resources, implementation and coordination with outside assistance. It must consider staff, visitors, contractors and people in custody. The General Penitentiary Act requires protection of detained people’s life, integrity and health. That duty and occupational protection need to be integrated, avoiding plans that count only employees or overlook assistance needs. Registration status is therefore not a measure of actual preparedness.
Evacuation and sheltering adapted to the establishment
In a custodial establishment, planners cannot assume everyone leaves freely through the same route. Response arrangements must address mobility, support and occupant accountability under competent direction without turning ordinary restrictions into obstacles to protecting life. Evacuation, internal relocation or sheltering depend on the scenario and the specific plan.
Design requires coordination among prevention, management, technical services and external responders. Appropriate exercises should verify arrangements while protecting operational details. Drills must not create unnecessary risks or disclose sensitive information through public materials. For the Guardia Civil, article 5 integrates building emergency plans as annexes to the corresponding security plans. The general lesson is compatible planning, not publication of access arrangements or a universal movement procedure for every facility.
Hypothetical example of integrated review
An establishment schedules maintenance temporarily affecting an installation and people’s movement. Review checks the technical risk, interaction with service delivery, information for staff and contractors, and compatibility with emergency response. All shifts and people requiring support are considered without circulating operational plans outside authorised channels.
If a temporary measure reduces available protection, technically justified compensating controls are defined or the task is reconsidered. On completion, restored conditions are verified and relevant documentation updated. This example describes preventive coordination rather than an access or custody procedure. It does not establish that any compensating measure makes work permissible or replace competent assessment of the particular establishment. Decisions and their verification should remain traceable to the conditions actually assessed.
Indicators and traceability with restricted access
Suggested monitoring includes verified corrective actions, training coverage by role and shift, outstanding maintenance and exercise findings. Analyse recurring incidents and exposures in context. These are management suggestions, not official indices or automatic measurements of personal responsibility or institutional security.
EHS software can connect assessment, measures, training and emergency review with differentiated permissions. Sensitive plan material and health information must follow their specific access arrangements rather than being published to improve a report. Periodic review checks both implementation and effectiveness. A well-documented establishment also needs people who understand their role and possess the resources to work and respond safely. Evidence of completed forms should support, rather than substitute for, examination of actual working conditions.
Frequently asked questions
Does the prevention law exclude all police and prisons?
No. Activities and particularities must be distinguished. Adaptation and protection rules apply; there is no blanket exclusion of every worker or establishment.
Do all security services follow the same regime?
No. National Police, Guardia Civil, regional or local forces and private security require checks of their own rules and scope.
Does exemption from registration remove emergency planning?
No. Section 1.4 of the 2026 Guideline preserves preparation of the plan although specified establishments are exempt from the administrative control and registration it addresses.
Can all plans be published to explain prevention?
Information should reach those who need it through appropriate channels. A public reference entry should not disclose sensitive operational details or individual health information.
