Martyn’s Law, formally the Terrorism (Protection of Premises) Act 2025, is legislation requiring those responsible for certain accessible premises and events to take proportionate steps to protect the public from terrorist attacks. It received Royal Assent on 3 April 2025 and is expected to come into force from April 2027. The Act is named after Martyn Hett, one of 22 people murdered in the Manchester Arena attack on 22 May 2017, and is the result of an eight-year campaign by his mother, Figen Murray. It implements recommendations from Volume 1 of the Manchester Arena Inquiry, published in 2021, and forms part of the Protect and Prepare strands of the UK Government’s wider counter-terrorism strategy, CONTEST.
Martyn’s Law is a vital piece of counter-terrorism legislation. It is officially named the Terrorism (Protection of Premises) Act 2025. The Act received Royal Assent on 3 April 2025. You may also hear it referred to as the Protect Duty.
On 22 May 2017, a terrorist attack at the Manchester Arena claimed 22 innocent lives.
A public inquiry into the tragedy found that public venues and events must do more to stop future attacks. It stressed the clear need for effective, up-to-date security
procedures to minimise physical harm.
The Act is commonly known as Martyn’s Law. It is named in memory of Martyn Hett, a victim of the attack. His mother, Figen Murray, campaigned tirelessly to make this a reality.
Martyn’s Law aims to improve preparedness and public protection across the UK. It requires qualifying venues and events to prepare for a potential terrorist attack.
Ultimately, it is designed to help keep people safe.
Venues must create simple but effective plans to respond to an incident.
You need clear public protection procedures in place. These must cover evacuation, invacuation,
lockdown, and communication.
Larger locations in the enhanced tier must also consider their vulnerability to terrorism. They must take reasonable steps to put extra measures in place. This includes things like monitoring and screening to reduce risks.
Venues and events have at least 24 months from the date the Act became law to become compliant. This gives qualifying premises and events time to understand the rules and get ready. You have until April 2027 at the earliest before legal enforcement begins.
We are now over a year into this period. Understanding your current position and figuring out what needs to be done takes time.
Making the right decisions and setting up your new procedures and measures does not happen overnight. Because of this, you should act now.
Starting your preparedness planning today will ensure you achieve compliance in time before the deadline.
To fall under the Martyn’s Law, your location must be a “qualifying premises.”
You must meet four specific rules to fall into this category. If you do, you must take steps to improve your preparedness and help protect the public against a terrorist attack.
Your premises must be a building, a part of a building, or a building with land. A completely open space or field without a building does not count as a qualifying premises.
Sometimes, a building has parts used for different reasons. The law only applies to the parts of the building used for specific public purposes.
For example, imagine a large factory that makes sports goods. The factory floor is not covered. However, if there is a public shop inside the factory, the shop itself could be a qualifying premises.
Your premises must be used mainly for a specific public purpose. The law calls these “Schedule 1” uses. This includes shops, food and drink venues, nightclubs, sports grounds, museums, hotels, and education facilities. The common theme is that these locations are public facing.
You must reasonably expect 200 or more individuals to be on your premises at the same time. This number must always include your staff.
The law says you must reach this number “from time to time”. This simply means occasionally. You do not need 200 people every day. If you reach this number during peak trading hours, sales, or seasonal rushes, you will meet this rule.
Finally, your premises must not be on the excluded list. Government buildings and transport hubs already covered by other strict security laws are excluded.
Parks, gardens, and recreation grounds are also excluded, but only if they are completely open. If an outdoor space uses measures to control access—like checking that people have paid, or have tickets or passes—it may still fall under the rules.
First, the event must take place at a specific location. This can be a building, a mix of buildings and land, or just open land. This means an event in a park or a field can count, if it meets all the other requirements.
Second, the location must not already be an enhanced-tier premises. If the venue is already in the enhanced tier, the venue’s existing security rules cover the event. It does not become a separate qualifying event.
Third, the event must be publicly accessible. Members of the general public must be able to attend. Private events, like a wedding reception or a corporate staff party, do not count.
Fourth, you must reasonably expect 800 or more individuals to be present at the same time. This number must always include your staff. You only need to reach this number at some point during the event, rather than for the whole duration.
Because the threshold is 800 people, all qualifying events must follow strict enhanced tier requirements.
Fifth, you must have control measures in place to check people as they enter. Attendees must have a ticket, a pass, a club membership or similar to get in. Paying an entry fee at the door also counts. A suggested donation does not count as a strict entry check.
Finally, the event must not happen at an excluded location. Events held at primary schools, secondary schools, childcare centres, and places of worship are excluded. Government buildings and certain transport hubs are also excluded.
If you have read through these rules and consider yourself a qualifying premises or event, you will need to be compliant with Martyn’s Law.
The “responsible person” in control of the event or premises must follow the compliance duties.
For qualifying events, you will always need to meet the enhanced duty.
For qualifying premises, you may be subject to the standard or enhanced tier. This depends on how many people you expect at your premises at the same time.
Under Martyn’s Law, your exact compliance duties depend on your tier. There are two tiers. These are the standard tier and the enhanced tier. Your tier is based on how many people you expect to be present at your location.
If you expect between 200 and 799 people to be present, you are in the standard tier.
This tier focuses on simple, low-cost procedures. You must do two main things:
First, you must notify the Security Industry Authority (SIA) that you are responsible for the premises.
Second, you must put clear Public Protection Procedures in place. These help keep people safe during a terrorist attack. Your plan must cover four main actions:
Special Rule: Places of worship, childcare facilities, and primary, secondary and further education schools are always standard tier. This applies even if they expect over 800 people.
If you expect 800 or more people, you fall into the enhanced tier. This includes all qualifying events. Because these locations are larger, they face stricter rules.
You must:
1 – Complete all the standard tier duties.
2 – Put physical Public Protection Measures in place. These actively reduce your vulnerability to an attack. They include:
3 – Write a compliance document. This must outline your procedures and measures. You must send this document to the SIA.
4 – Name a “senior individual” if you are an organisation. This person oversees your overall compliance.
Under Martyn’s Law, every premises and event must have a ‘responsible person’. This is the individual or business that has control of the premises or event. They must make sure the venue or event meets the new rules.
For qualifying premises, the responsible person is whoever has “control” of the building for its main public use.
This means the operator or business running the site is usually responsible, not the landlord who simply owns the building.
If a building has multiple uses, the person in control of the main public use takes charge.
For qualifying events, the responsible person is whoever has control of the location during the event.
For example, imagine an event organiser hires a public park for a large music festival.
Because the organiser takes control of the space to run the festival, the event organiser is the responsible person.
If your organisation runs a premises or event in the enhanced tier, you must name a ‘senior individual’. This person oversees your overall compliance.
They must have real management power, like a board director.
You cannot give this role to a lower-level employee.
The Security Industry Authority (SIA) is the regulator. They have strong powers to enforce the law.
First, the SIA has the power to inspect your premises. They can observe your procedures and measures and check your documents.
They can also require your staff to provide information or answer questions.
If necessary, inspectors can get a court warrant. This allows them to force entry and seize evidence.
Next, if you fail to meet your duties, the SIA can issue legal notices. A “compliance notice” orders you to fix your mistakes by a strict deadline.
Additionally, if you run an enhanced-tier venue or a qualifying event, they can issue a “restriction notice”. This notice can restrict how you use your building.
Ignoring the rules will cost you. The SIA can issue heavy financial penalties for non-compliance. For a standard tier venue, the maximum fine is £10,000.
On the other hand, fines for the enhanced tier are much larger. They can reach up to £18 million or 5% of your worldwide revenue.
Furthermore, you can face daily fines until you fix the specific problem.
Finally, serious breaches of the law are criminal offences. It is a crime to ignore a restriction notice, provide false information, or obstruct an inspector.
If a company commits a crime, the “senior individual” or other managers can also face personal prosecution. This happens if the crime occurred because of their clear neglect or consent.
If your event takes place at an enhanced duty premises, it does not meet the legal definition of a “qualifying event”. As a result, you will not be considered the “responsible person” for the event. Instead, the individual or company that controls the venue remains the responsible person.
The venue operator must ensure that appropriate public protection procedures and measures are in place at their premises. The law requires them to do this so far as is reasonably practicable.
These measures and procedures will need to be in place during your event. If you have control of the premises to any extent during the event, you must co-operate with the venue operator. This helps the venue ensure its procedures and measures are effective for the duration of the event.
The law does not expect the impossible. Instead, you only need to take steps that are “reasonably practicable”. You must weigh the goal of public protection against the cost, time, and effort required.
Because of this, your plans should be smart, proportionate, and realistic for your specific business.
Within recently published guidance, the government suggests several methods to you can use to calculate this figure. You can use:
Enhanced Tier and Qualifying Events
If you run an enhanced tier venue or a qualifying event, you must document your compliance. This is a strict legal requirement. You must prepare a formal compliance document and send it to the Security Industry Authority (SIA).
This document must list your public protection procedures and physical measures. You must also explain how these steps reduce your vulnerability to a terrorist attack.
The law only expects you to take steps that are “reasonably practicable”. Because of this, you might decide a specific security measure is too difficult or costly. If so, you must write down your reasons. This justifies your choices and proves to the SIA why you made them.
Standard Tier Premises
If your venue is in the standard tier, the rules are different. There is no strict legal duty to write a formal compliance document. However, you must still ensure your procedures are in place.
In reality, it is extremely difficult to do this safely without written plans. Documentation is vital. It helps staff understand their specific roles. It gives them the confidence to act quickly during a threat. Furthermore, if the SIA inspects your venue, written plans easily prove your compliance.
Protecting Your Venue
Ultimately, the unthinkable can happen. If a terrorist attack does occur, your venue will face intense scrutiny. Therefore, written records prove you did everything reasonably practicable to keep the public safe from physical harm.
At United Outcomes, we provide comprehensive support to private-sector organisations in preparing for and complying with the Act’s requirements. Our approach is incremental, helping you define what actions you may need to take and how our solutions will allow you to comply with the legislation.
This consultation forms the starting point that will help your organisation understand your specific responsibilities with respect to Martyn’s law, including considering risk assessment, recording information, developing and implementing security plans, training staff, and emergency response procedures.
At United Outcomes, we provide comprehensive support to private-sector organisations in preparing for and complying with the Act’s requirements. Our approach is incremental, helping you define what actions you may need to take and how our solutions will allow you to comply with the legislation.
We have prepared a short assessment to help you determine your organisation’s or venue’s compliance tier by answering a six-question assessment. Participation is free of charge and carries no obligation. Please don’t worry; all information you provide will be treated with the utmost confidentiality.
This assessment will help your organisation prepare for Martyn’s law requirements, including considering risk assessment, recording information, developing and implementing security plans, training staff, and emergency response procedures.
Our expertise helps define vulnerability and your organisation's exposure to risk. We offer training in completing Martyn's Law risk assessments, a platform that shows the completion of risk assessments, recording of compliance, and an auditable system that will satisfy all aspects of compliance. We provide complete online risk assessment tools and simple technology to manage risks. We offer training resources, including practical modules for staff readiness. Our record-keeping system for compliance documentation ensures audit capability. These steps will ensure compliance and enhance safety. All of this is delivered via our user-friendly app.
Through our consultancy service, we offer in-person strategic guidance on Martyn's Law and how risk assessment applicable to larger venues can be applied with suitable mitigation activity. Through this activity, we develop strategies that focus on enhancing public safety within your venues, including crowd management, evacuation procedures, and communication plans. UO's approach ensures that your venue is secure and provides a safe and reassuring environment for the public.
We offer a bespoke solution to your venue as there is significant variation under the requirements of Martyn's Law that apply to both venue and event. It is vital that those carrying out planning and implementation with you have the correct skills and understand counter-terrorism to reach the required compliance.
United Outcome's experts assist in designing and implementing bespoke security plans tailored to the unique needs of your venue, ensuring they meet the highest standards of protection and compliance.
Our plans include physical security measures, access control systems, surveillance, and emergency response protocols to deter and respond to potential terrorist threats.
The regulator, the Security Industry Agency, will have tools to address non-compliance. The SIA will have the power to issue a range of civil sanctions, and the regime is underpinned by relevant criminal offences and investigatory powers. United Outcomes can support you in ensuring that you understand Martyn’s Law legislation and take all necessary measures to ensure compliance with all its aspects. This includes recording risk assessments, mitigating risk, and, where necessary, providing support so that all regulatory matters are addressed.
United Outcomes has partnered with a renowned training provider to develop specific Martyn's Law training relevant to the various roles and responsibilities of those involved in assessing risk and implementing measures to mitigate risk and ensure compliance. We recognise that many small venues will have limited resources to carry out risk assessments and may struggle with an understanding of requirements; we have designed a high-quality, inexpensive, easy-to-use training package that fits within our standard venue platform.
Our Martyn’s Law consultancy offer includes support for venues to complete essential emergency response procedures, including evacuation plans, first aid, and safety measures, tailored to your organisation's specific needs. Venues can then practice, with our support these procedures through simulations and drills, ensuring preparedness.
In the event of a terrorist incident, we offer immediate crisis management support and guide your organisation through the response and recovery process.
Our experts work with you to manage communication, support affected individuals and restore normal operations as quickly and safely as possible.
1. Estimated number of premises meeting either the Standard or Enhanced tier specifications
2. A study by the Meetings Industry Association (MIA)
3. Since 2017, Counter Terrorism Policing assesses that there have been 15 domestic terror attacks in the UK (not including Northern Ireland-related terrorism), and agencies and law enforcement have disrupted 43 late-stage plots.