Will Martyn’s Law affect my business?

The Terrorism (Protection of Premises) Act 2025 (the Act), commonly known as “Martyn’s Law” officially became law on 3 April 2025.

The Act is named after Martyn Hett, a victim of the Manchester Arena attack, after many years of campaigning by his family. It will apply in England, Wales, Scotland and Northern Ireland and is subject to a two-year implementation period.

The Act intends to strengthen the security of public premises at qualifying premises or larger public events and will require those responsible for certain premises and events to assess and mitigate the risk of terrorist activity at or proximate to their events/premises.

In scope premises include: publicly accessible locations primarily used for entertainment, leisure, retail and food and drink as well as museums, galleries, sports grounds, government buildings, visitor attractions, places of worship, health, and educational establishments where it is reasonable to anticipate at least 200 individuals may be present at one time.

Tiered System

The Act establishes a tiered system which is linked to the reasonable number of individuals expected to be present at one time at a premises or event. The obligations will depend on the size and nature of activities at these locations.

“Standard duty premises” are locations with a capacity of 200 to 799 individuals.

“Enhanced duty premises” are locations where it is reasonable to expect 800 or more individuals to be present at the same time.

The Act also applies to “qualifying events,” which are public events where 800 or more individuals may be present at the same time at some point during the event.

Obligations

Parties in control of in scope premises will need to appoint a responsible person (RP). For qualifying events the RP would be the individual who has control of the premises where the event is being held.

For standard duty premises, the RP must implement and communicate reasonably practicable public protection procedures relating to evacuation, invacuation, lockdown and communication. This will not require physical changes to premises but proportionate procedures and training.

Enhanced duty premises and qualifying events must implement and regularly review public protection measures to reduce vulnerability to terrorist acts as well as minimising the risk of physical harm to individuals. These measures must be specifically documented and submitted to the Security Industry Authority (SIA) who will regulate and enforce compliance.

Enforcement

Penalties for non-compliance for standard duty premises include fixed penalties up to £10,000. Enhanced duty premises and qualifying events could face fixed penalties of up to £18 million or 5% of worldwide revenue, with additional daily penalties for ongoing contraventions. The Act also introduces criminal offences for failing to comply with notices and obstruction.

Next Steps

There is a two-year transition period for compliance and it is anticipated further guidance will be published to assist businesses taking appropriate steps to comply with the new specific protect duty, however businesses should take steps now to ensure compliance, particularly given that overarching health and safety law would already anticipate that organisations’ health and safety management would address security risks.

Sensible steps to take would be:

• Review premises within the business’ control to consider which have the potential to be Standard Duty or Enhanced Duty premises, whether this is on a permanent basis or for temporary events.
• Evaluate existing risk assessments and security plans and consider the strength of existing policies for public protection in the event of a security/terrorist situation.
• Consider how vulnerability to terrorism events can be further reduced at enhanced duty premises.
• Consider additional measures that can be implemented throughout the transition period to increase security measures and act as a deterrent.
• Document specific policies related to security/terrorism procedures but ensure those are managed and controlled in a highly secure manner.
• Ensure that employees are aware of the steps to take in case of an emergency and provide appropriate supervision and training in line with the risk assessment.

For more information about whether this will affect your business, contact one of our regulatory team here.