The introduction of the Terrorism (Protection of Premises) Act 2025 (the Act), known as Martyn’s Law, was created in the wake of the Manchester bombings in 2017. 

Figen Murray, the mother of Martyn Hett, who tragically died at the MEN arena, became increasingly concerned over the lack of security for large venues. The Act ensures that qualifying venues will be required to implement proportionate security plans, minimise mass casualties and protect the public.

Martyn’s Law introduces new legal duties designed to improve preparedness for terrorist attacks. This legislation applies across the UK and is expected to come into force after a 24-month implementation period, likely to be in April 2027.

Under the Act, premises and events have been categorised into two tiers based upon capacity. The Standard Duty Premises are those that can accommodate between 200 and 799 people, whilst the Enhanced Duty Premises are those with a capacity of 800 or more, or qualifying events with anticipated attendees of 800 or more. 

Does the act apply to your venue?

The Act applies to any publicly accessible venue with a building where 200 or more people (including staff) could reasonably be present at the same time, including shops, food and drink establishments, entertainment and leisure venues, cultural spaces, event halls, hotels, visitor attractions, places of worship, and healthcare premises. However, venues expecting fewer than 200 people are exempt. So for charities or their trading subsidiaries that operate from a building where 200 or more people (including staff) could reasonably be expected to be present at the same time, the Act will apply.

A range of methods can be used to make a reasonable assessment of whether a premises meets the threshold.  This includes methods which those responsible for premises and events may already be familiar with, e.g. safe occupancy calculations for the purposes of fire safety or the use of historic data.  

Who is the responsible person? 

For qualifying premises, the responsible person is the person who has control of the premises in connection with the use.  Where there is more than one use (e.g. a church that also has a play group or nursery), it will be the person in control of the premises in connection with whichever use is the principal use.  

The same applies to qualifying events, which are events which hold over 800 people. The responsible person is the person who has control of the premises at which the event will be held for the purposes of the event. For instance, if a concert is taking place in a premises and the company putting on the event takes control of an area of the premises for the purposes of that concert, the company putting on the event will be the responsible person and that company will designate a senior individual, who is concerned in the management or control of the company as having responsibility for ensuring that the company complies with the requirements.

What are the Standard Duty Requirements?

The obligations for Standard Duty Premises are designed to be simple and low-cost. They will focus on the planning and training of staff rather than expensive physical security measures. Such measures are likely to be:

• Public Protection Procedures: The preparation of plans for evacuation to reduce the risk of physical harm being caused to individuals (safe exit routes), invacuation (the moving to safer secure areas inside the premises), lockdown processes (restricting access in the premises), and emergency communications (such as alerting attendees and the emergency services).
• Training: Staff and volunteers will be trained adequately to understand these procedures. There will be no requirement to hire external trainers.
• Documentation: You must keep records of your procedures and training.

What are the Enhanced Duty Requirements?

Those events where it is anticipated that 800 or more attendees (including staff numbers) may be present must adhere to standard duty measures, but in addition have further measures such as: 

• appropriate public protection measures that could be expected to reduce both (i) the vulnerability of the premises or event to an act of terrorism, and (ii) the risk of physical harm being caused to individuals if an attack were to occur there or nearby. This will include measures related to the monitoring of the premises and their immediate vicinity;
• documenting the public protection procedures and measures in place, or proposed to be put in place, and providing these documents to the Security Industry Authority (SIA). This will include documenting how the public protection procedures and measures reduce vulnerability and/or the risk of harm; and
• where the responsible person is not an individual, they must designate a senior individual with responsibility for ensuring that the responsible person complies with these requirements.  

Enforcement and penalties

The Security Industry Authority (SIA) will act as the regulator. It will have powers to inspect premises, issue compliance notices, and impose penalties. For Standard Duty Premises, fines can reach up to £10,000 per breach, and a daily penalty of up to £550 per day. 

For enhanced Duty Premises, those fines are increased to up to £18 million or 5% of worldwide revenue. The daily penalty is increased to up to £50,000 per day.

Therefore, there will be severe penalties for non-compliance, and criminal sanctions may apply for serious or persistent breaches, including potential imprisonment for those responsible persons. Senior managers and those in control of an organisation can be personally liable for offences committed by the organisation under the Act if they consented, were involved, or were negligent.

What should you do now?

The government has set out a period of time to ensure that those responsible for premises and events have sufficient time to understand these new obligations before they come into force, being able to plan and prepare accordingly.

A person, or the senior person of a company, identified as a responsible person, should start preparing by familiarising themselves with the Act and the upcoming guidance. Begin planning simple procedures for evacuation, invacuation, lockdown, and communication. Identify responsible persons, such as trustees or senior volunteers, and monitor updates from the Home Office and SIA for statutory guidance.