What Does Martyn’s Law Mean for Businesses?
Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025.
- The Act applies across England, Wales, Scotland and Northern Ireland.
- It covers premises and events where 200 or more people may reasonably be present at the same time.
- Two tiers apply. The standard tier covers 200 to 799 people. The enhanced tier covers 800 or more.
- Capacity counts staff, not only customers, visitors or audience members.
- The Security Industry Authority (SIA) is the regulator.
- Standard tier breaches carry penalties up to £10,000. Enhanced tier breaches reach £18 million or 5% of worldwide revenue, whichever is greater.
- Enforcement is expected to begin in April 2027.
Why Martyn’s Law Exists
The law is named after Martyn Hett, one of 22 people killed in the Manchester Arena attack in 2017. His mother, Figen Murray, led the campaign that brought the Act through Parliament.
The Manchester Arena Inquiry, published in 2021, found that many public venues were not ready to deal with a terrorist threat. Martyn’s Law responds directly to that finding. It builds on the Protect and Prepare strands of the government’s wider counter terrorism strategy, CONTEST.
For businesses, this reflects a wider direction of travel. Protective security and emergency preparedness are no longer optional good practice for public venues. They are becoming a legal requirement.
Who Martyn’s Law Applies To
A premises falls within scope when three conditions are met.
- There is at least one building, or a building and other land.
- The site is used wholly or mainly for one or more activities listed in Schedule 1 of the Act.
- It is reasonable to expect that 200 or more people may be present at the same time.
Schedule 1 lists 17 categories. These include shops, food and drink venues, entertainment and leisure sites, sports grounds, libraries, museums and galleries, halls, visitor attractions, hotels, places of worship, healthcare settings, transport hubs, childcare, and primary and secondary education.
Offices and residential developments are not in scope. Certain premises are excluded under Schedule 2, such as the Houses of Parliament.
One point catches many organisations out. Capacity is measured against peak use and includes staff. A community hall that holds 150 people most weeks but runs an annual event for 850 must factor that event into its assessment.
The Two Tiers Explained
Martyn’s Law sorts premises and events using a single test: how many people may reasonably be expected to be present at the same time.
The standard tier applies where 200 to 799 people may be present. If you are responsible for a standard tier premises, you must:
- Notify the SIA that you are responsible for the premises.
- Put in place appropriate public protection procedures, so far as is reasonably practicable.
These procedures cover four areas: evacuation, invacuation (moving people to a safer place inside), lockdown, and communication with people on site. Standard tier compliance is designed to be low cost. The main investment is time spent planning, recording procedures and briefing staff. There is no requirement to install physical security equipment at this tier.
The enhanced tier applies where 800 or more people may be present, and to qualifying events at that scale. Enhanced tier sites carry the standard tier duties plus further requirements. If you are responsible for an enhanced tier premises or event, you must also:
- Put in place appropriate public protection measures to reduce the vulnerability of the premises or event to an attack.
- Designate a senior individual responsible for compliance, where the responsible person is an organisation.
- Prepare a compliance document recording your procedures and measures, and provide it to the SIA.
Public protection measures might include bag search policies, CCTV and monitoring, vehicle checks, controlling movement in and out of the site, and physical measures such as safety glass or hostile vehicle mitigation. They also cover how you protect sensitive information such as floor plans.
Marauding Terrorist Attacks and Run Hide Tell
Martyn’s Law sits alongside established counter terrorism guidance, and your procedures should reflect it.
A marauding terrorist attack involves one or more attackers moving through a location, often on foot, using weapons such as knives or firearms to cause harm across multiple areas. Police and the National Protective Security Authority publish guidance on planning for this kind of fast moving threat.
The national public response message is Run, Hide, Tell. Move away from danger if you can. If you cannot, find a place to hide and stay quiet. Tell the police by calling 999 when it is safe. Staff training under Martyn’s Law should make these principles familiar to your whole team.
What Happens If You Do Not Comply
The SIA can support, advise and guide responsible persons. Where there is serious or persistent non-compliance, it can take enforcement action.
The regulator can issue compliance notices, restriction notices and monetary penalties. For standard tier premises the maximum penalty is £10,000, with a daily penalty of up to £500. For enhanced tier premises and qualifying events the maximum is £18 million or 5% of qualifying worldwide revenue, whichever is greater, with a daily penalty of up to £50,000. The Act also creates criminal offences for the most serious breaches.
Both compliance and restriction notices can be appealed to a tribunal.
Why Businesses Should Act Now
Waiting for the 2027 deadline is never the most effective approach. The strongest position is proactive preparation, which protects the public, reduces risk and demonstrates a clear commitment to compliance.
Key actions to take now include:
- Assess your capacity against peak use, counting staff as well as visitors, to confirm your tier.
- Identify the responsible person for each premises or event.
- Review your existing evacuation, lockdown and communication plans.
- Draft your public protection procedures across the four required areas.
- For enhanced tier sites, plan your public protection measures and begin your compliance document.
- Train your staff so they know how to act during an attack.
The government has confirmed you do not need to hire consultants to comply, and neither the Home Office nor the SIA endorses third party compliance products. Even so, many businesses want practical support to turn the requirements into working procedures, trained staff and the right security measures.
Staying Ready for Martyn’s Law
Martyn’s Law represents one of the most significant changes in UK counter terrorism legislation in recent years. It moves responsibility for public safety to individual venues and events on a much wider basis than before.
For businesses, the message is to prepare, protect and respond. Organisations that review their security arrangements early, train their teams and document their procedures will be best placed to meet their duties when enforcement begins in 2027.
Need Expert Security Installations?
At Croma Fire & Security, we help businesses across the UK strengthen their protective security with professional security installations and ongoing compliance support.
If you would like to upgrade your security to remain compliant with Martyn’s Law, contact Croma Fire & Security today to speak with one of our experienced security specialists.
