A woman died on Sunday 9 August 2026 at the Houghton Festival site in Norfolk (UK), on the final day of the event. The question a headline like that raises for anyone running an event in Spain is a different one: if it happens on my site, what am I required to have, and what am I required to do?
What happened
The two outlets covering the case, Lynn News and NME, quote a statement from Norfolk Constabulary: "The death is currently being treated as unexplained but is not believed to be suspicious. Our enquiries are ongoing." The festival issued a brief statement: "We are deeply saddened to confirm that a person has passed away at Houghton 2026."
The identity of the deceased and the cause of death have not been published, and the post-mortem result is pending. That is where the case ends, and where the Spanish rules begin: article by article, a map that is less tidy than one might expect in a sector turning over €807 million in box office.
The self-protection plan: a national floor and several regional floors
The national framework is Royal Decree 393/2007, whose Annex I, section 1.d), includes "Public entertainment and recreational activities" with three thresholds:
- Enclosed buildings: capacity of 2,000 people or more.
- Demountable or seasonal enclosed facilities: 2,500 people.
- Outdoors: "in general, those with a capacity of 20,000 people or more."
That 20,000 figure is misleading. Article 3.1 states that the obligations apply "as a minimum or supplementary rule": it is a floor, not a ceiling. Article 2.2 further allows a plan to be required for activities not included in Annex I "where they present a particular risk or vulnerability", and the second final provision empowers local authorities to extend these obligations. A town council can ask for a plan even if the royal decree does not require one.
The regions set the figure much lower. In Catalonia, Article 46 of Decret 112/2010 requires a plan outdoors for authorised capacities above 15,000 and in enclosed spaces above 5,000, with a lower tier between 1,000 and 15,000 expected attendees outdoors and between 500 and 5,000 indoors. Below 500, the plan is governed by occupational risk-prevention rules. Between the national 20,000 threshold and Catalonia's 1,000, there is a full order of magnitude for the same event.
In Andalusia, Decree 195/2007 — which governs occasional and extraordinary public entertainment, the category many festivals fall under — requires in Article 9.1.b) an "Emergency and self-protection plan, to ensure, with the human and material resources available, the prevention of incidents and immediate intervention to control them." In the Basque Country, the procedure has its own name: the Register of Foreseeable Risk Devices (Decree 277/2010, Annex I.3, amended by Decree 21/2019).
Who signs it and what it contains
Article 4.1.a) is unambiguous: "Its drafting, implementation, maintenance and review is the responsibility of the party holding the activity." Not the supplier, not the production crew. Article 4.1.b) requires it to be drawn up by "a qualified technician." The plan has no fixed expiry, but must be reviewed "at least every three years", and its key details are entered into an administrative register (Article 5).
Of the nine chapters in Annex II, the one that kicks in when something happens is 6.2: detection and alert, alarm mechanisms, response, evacuation or lockdown, first aid and receiving external help. Within the alarm mechanisms section, it requires naming by name the person who will issue alerts and the Civil Protection Emergency Coordination Centre. Chapter 8 adds staff training and a drills programme. If that person is not named, the plan is not implemented — it is merely printed. We've broken down the earlier steps — licence, capacity, documentation — in our guide on how to organise a festival in Spain.
Above this sits Law 17/2015 on the National Civil Protection System, whose Article 7 ter sets out the "duty of precaution and self-protection" of those holding centres and establishments.
Insurance: four scales, four different minimums for the same festival
We have not seen these scales set out side by side anywhere else. The four regions reviewed set minimum amounts by capacity, and they do not resemble each other.
| Capacity | Andalusia | Valencian Community | Madrid | Catalonia |
|---|---|---|---|---|
| Up to 50 people | €225,000 | €300,000 | 7,000,000 ptas | €300,000 |
| Up to 100 people | €375,000 | €400,000 | 10,000,000 ptas | €300,000 |
| Up to 300 people | €526,000 | €600,000 | 20,000,000 ptas | €600,000 |
| Up to 700 people | €901,000 | €900,000 | 80,000,000 ptas | €900,000 |
| Up to 1,500 people | €1,201,000 | €1,200,000 | 120,000,000 ptas | €1,200,000 |
| Up to 5,000 people | €1,201,000 | €1,800,000 | 200,000,000 ptas (€1,202,024.21) | €2,000,000 |
| Above 5,000 people | no bands above this | +€120,000 for every 2,500 people or part thereof | +20,000,000 ptas for every 2,500 people or part thereof | +€60,000 for every 1,000 people or part thereof, capped at €6,000,000 |
Three caveats.
These are legal minimums, not what a real production actually takes out. The rule sets the floor below which insurance does not comply; it says nothing about whether that figure covers the risk of a venue holding 30,000 people.
The scales do not share the same bands. Where a region does not set an exact tier, we have shown the next band up on its own scale. The Andalusian figures in the table come from section 4.1 of the annex to Decree 109/2005 (cinemas, theatres, auditoriums, amusement arcades and similar venues); section 4.2 sets a higher scale for greater risk which we do not quote here because we have not verified it in full. For open-air spaces or undetermined capacity, Andalusia's section 5 drops to "a minimum sum of €151,000."
Madrid is still in pesetas. Law 17/1997 requires insurance in its Article 6.3, but the amounts live in the third transitional provision, drafted "pending the regulatory development of this Law" and "with no excess whatsoever." It remains transitional nearly three decades on. And it adds the detail most relevant to a festival: "For temporary, portable and demountable installations, the minimum insurance amount shall be determined in the corresponding licence, according to the entertainment or activity to be carried out, the conditions of the installation, capacity and other relevant circumstances." For a temporary build in Madrid, the licence governs, not the table.
The details that change the bill
Catalonia has the densest set of provisions. Its Article 81 applies correcting coefficients — surcharges of up to 30% for below-ground activity and up to 50% for special risk; reductions of up to 30% for location, up to 50% for type of event and up to 30% for duration — with an absolute floor of €300,000 that no discount can go below. Article 82.1 requires that cover apply "per claim, with a minimum per-victim sub-limit of €150,000", and Article 80.6 sets €601,000 for events on public roads or open public spaces without defined boundaries.
The Valencian Community, under Article 18.1 of Law 14/2010, requires that the insurance "must also include fire risk", and Article 60.3 of Decree 143/2015 closes a common loophole: "sub-limits that restrict or cap the amounts indicated in section 1" are not allowed. A policy that meets the overall figure but splits it up by category does not comply. Andalusia attaches the obligation to Article 14.c) of Law 13/1999: a "collective accident insurance contract under the terms to be set by regulation."
What happens if it is missing
In Andalusia, "the absence or lapse of the collective accident insurance contract" is a very serious offence (Article 19.12 of Law 13/1999), and Article 22.1 sets very serious fines between €30,050.61 and €601,012.10, and serious ones between €300.51 and €30,050.61.
In Madrid, not having insurance is a serious offence (Article 38.1 of Law 17/1997), carrying a fine of €4,501 to €60,000; failing to meet safety conditions with a serious reduction in those conditions is very serious (Article 37.8), carrying a fine of €60,001 to €600,000. Ranges on the order of the €320,000 fine imposed on a festival. We deliberately leave out the Catalan figures: its penalty rules have since been amended, and the figures in circulation are not up to date.
Medical provision: who sets the figure, and who does not
There is no nationwide table stating how many ambulances a festival needs: there is a leftover rule from 1982, and whatever each region or licence decides.
Royal Decree 2816/1982 remains in force in its Article 11 — the Technical Building Code repealed its Articles 2 to 9 and 20 to 23, but not this one — stating: "Whenever the venue's capacity exceeds 1,000 or 100 spectators or attendees, a first-aid room or first-aid kit, respectively, shall be provided, suitably equipped to give first aid in the event of an accident or sudden illness." It allows the first-aid room to be replaced by a kit plus ambulances, and its Article 1.3 gives it supplementary status: it applies where the region has not legislated. The same regulation requires, in Article 51, liability for damage caused by negligence, and in Article 73 allows the event to be suspended if the venue stops meeting safety conditions.
Catalonia has legislated on this. Article 48 of Decret 112/2010 requires a first-aid room "from 1,000 people of authorised capacity", allows it to be replaced "with a first-aid kit and the presence of medicalised vehicles", and finishes with the clause that really decides the provision: "The licence or authorisation may establish the need for specific minimum provisions."
The scale of that negotiation is not visible from outside. In the city of Madrid alone, SAMUR-Civil Protection processed 4,281 preventive-service request case files in 2025 and deployed resources at 1,336 events: each case file is a promoter negotiating a provision that national law does not quantify.
Private security and the line with the police
Article 43 of Decret 112/2010 sets the minimum staffing at music events: one private security guard from 501 people of authorised capacity, two from 1,001, and one more for every additional 1,000. Article 42.1 also requires a safety report above 150 people: not an internal document, but part of the licence paperwork, with a binding police report where applicable. Its content must include establishing "fast and efficient communication systems with the Catalan police" and specifying medical assistance provisions. Article 45.b) adds the duty to inform the police "of any sign of antisocial behaviour outside and in the vicinity" of those venues.
In Andalusia there is no set number: Article 9.6 of Decree 195/2007 states that the authorisation decision "may require the establishment of a private security service, where circumstances of particular risk are present." Much like with capacities: that's where the Brunch Electronik licence for 65,000 attendees comes in. And it all rests on access control: a plan that assigns guards and evacuation routes assumes a reliable count of how many people are inside.
Sexual assault: what exists and what does not
Worth stating precisely, because the opposite claim circulates. In the consolidated text of Organic Law 10/2022, on the comprehensive guarantee of sexual freedom, there is no mention of leisure venues, public entertainment, festivals or nightlife establishments: it imposes no specific obligations on event organisers.
The negative finding goes further. We have found no rule, national or regional, requiring a festival to have a protocol against sexual assault. The schemes seen at venues — purple points and similar — are voluntary or quality marks, not legal obligations. We do not name them here, nor give their launch dates, because we have not been able to confirm them against an official source in this review. Nor is there any mandatory staff training imposed by law.
The most concrete thing that exists in a Spanish entertainment regulation is not called a protocol. It is Article 52.1.b) of Decret 112/2010, which requires venue holders and organisers to refuse entry to "people who display violent attitudes or who publicly incite hatred, violence or discrimination on grounds of birth, race, sex, religion, opinion, disability, sexual orientation, gender identity…" Article 52.2 requires the removal of anyone already inside, "for which police assistance may be requested." It is a duty of admission and removal, not a victim-support protocol: it says who must be kept out, not what to do for someone who has already been assaulted inside.
Where the requirement does exist, it arrives by another route: the Catalan safety report, the self-protection plan, or a condition set by the local licence. There is no national article to point to, and there is a specific authorisation that can require it. Anyone operating across several regions has to check venue by venue, not once.
What happens in minute one
The response is yours. Article 46.4 of Decret 112/2010 says it plainly: "In the event of an emergency within the scope of civil protection, the tasks of internal self-protection, evacuation and security, in accordance with the provisions of the self-protection plan, must be carried out by the holder or organiser or by the venue's own staff." Public services arrive; the evacuation is the organiser's responsibility.
The alert to emergency services comes from the plan, not from improvisation: chapter 6.2 of Annex II of RD 393/2007 requires naming the person who issues alerts and the Emergency Coordination Centre.
Private security has its own duty. Article 14.2 of Law 5/2014 requires security firms and their staff to report to the competent Security Forces and Corps, "as soon as possible", any information relevant to public safety "as well as any criminal act of which they become aware in the course of their activity or duties."
There is a clock running with the insurer. Article 16 of Law 50/1980: the policyholder, the insured or the beneficiary "must notify the insurer of the occurrence of the claim within a maximum period of seven days of becoming aware of it, unless a longer period has been set in the policy", and must provide "all kinds of information on the circumstances and consequences of the claim."
And the negative finding. In Madrid's Law 17/1997, Andalusia's Decree 195/2007, and the Valencian Law 14/2010 and Decree 143/2015, there is no article expressly requiring the organiser to report an accident, incident or serious occurrence at the event to the administration. The closest thing we found is Catalonia's Article 45.b), and that refers to signs of antisocial behaviour, not accidents.
Why it matters
The same festival has four different legal minimums depending on where it is held. The Andalusian scale stops at €1,201,000 and does not rise however many attendees there are; the Catalan one reaches €6,000,000 with coefficients for depth, risk, type and duration; the Valencian one is the most granular; and Madrid's is still in pesetas and, for a demountable build, hands the figure over to the licence. Anyone touring across Spain is not complying with one rule with variants — they are complying with four that barely resemble each other.
And the duty to report when someone dies on your site is not found in the entertainment law. It is spread across three places that do not talk to each other: the private security law, which places the duty on your contractor rather than on you; the insurance contract law, which looks towards the insurer; and your own self-protection plan, which you drafted yourself. The administration that issued your licence appears in none of the three. That gap belongs to the rule, not to the promoter.
What to do with this
Four checks, all verifiable in an afternoon:
1. The date of the self-protection plan and the name in chapter 6.2. RD 393/2007 requires it to be reviewed at least every three years: check the date of the last review and of its registration under Article 5. Then open it at the alarm mechanisms section and check there is a named person and contact details for the emergency coordination centre. If there is only a generic job title, the plan is not implemented.
2. The insured amount and sub-limits. Match your policy's sum insured against the table above, and don't stop at the headline figure: in Catalonia, Article 82.1 requires a minimum per-victim sub-limit of €150,000, and in the Valencian Community, Article 60.3 bans sub-limits that cap the overall amount. If you are building a temporary installation in Madrid, the figure that governs is in your licence.
3. What your licence says about medical cover and security staff. National law does not quantify ambulances, and both the Catalan licence and the Andalusian authorisation can impose specific provisions. Read the resolution for your event, not the general rule. It's the lesson of Tomorrowland and its fireworks permit: the specific administrative condition carries more weight than the general framework.
4. Write the notification protocol the law doesn't write for you. Decide in advance who calls 112, who calls the police, who notifies the insurer within the seven-day window, who informs the town council even when not obliged to, who secures the area, and what personal data is shared and with whom. One sheet with names and phone numbers, held by the venue manager. And know exactly how many people are inside: an evacuation is planned around real-time capacity, not tickets sold.
None of these four costs any money. The last one is the only one nobody will ask you for — until the day you need it.