Martyn's Law explained: What UK businesses and employers need to know

Martyn's Law introduces new requirements for certain UK premises and events to improve preparedness for terrorist incidents. But does it apply to your business, and what do you need to consider?

Whether you manage a leisure centre, restaurant, hotel, entertainment venue or other public-facing premises, understanding the legislation is an important part of preparing for the future.

What is Martyn's Law?

Martyn's Law, officially known as the Terrorism (Protection of Premises) Act 2025, was introduced following the Manchester Arena terrorist attack in May 2017.

The legislation is named in memory of Martyn Hett, one of the 22 people who lost their lives in the attack.

Its purpose is to improve public safety by ensuring certain premises and events have appropriate arrangements in place to respond to a terrorist incident.

The Act received Royal Assent on 3 April 2025. Its main operational requirements are not yet in force. The Security Industry Authority (SIA) currently expects commencement in spring 2027, but the exact date has not been confirmed.

Which businesses does Martyn's Law apply to?

Martyn's Law does not automatically apply to every employer or workplace.

It covers qualifying premises wholly or mainly used for one or more activities listed in Schedule 1 of the Act, such as retail, hospitality, leisure or education, where 200 or more people may reasonably be expected to be present at the same time, from time to time.

The number includes people attending or working in connection with those uses, including visitors, customers, employees, contractors and volunteers.

Depending on their use and occupancy, examples of premises that may fall within scope include:

• Leisure centres, gyms and sports facilities
• Hotels and hospitality venues
• Restaurants, pubs and entertainment venues
• Shopping centres and larger retail premises
• Museums, galleries and visitor attractions
• Community centres and public buildings
• Theatres, concert venues and stadiums
• Certain educational establishments and places of worship

Importantly, the assessment is not based solely on how many people are present on an average day. Businesses need to consider the greatest number of people who may reasonably be expected to be present at the same time, including during busier periods. This is not simply the licensed maximum capacity or the total number visiting over a whole day.

The premises must also meet the other qualifying conditions set out in the legislation. Certain premises are excluded under Schedule 2, including specified legislative and government premises, some open-access outdoor premises and specified transport premises. These exclusions have conditions, so check the official guidance rather than assuming a whole type of venue is exempt.

What are the two tiers?

Martyn's Law introduces two main levels of requirements.

Standard tier: 200–799 people

Qualifying premises that can reasonably expect between 200 and 799 people at the same time will generally fall within the standard tier.

The emphasis is on practical procedures to help protect people during an incident.

Once the duties commence, responsible persons will be required to notify the SIA and ensure that appropriate public protection procedures are in place, so far as reasonably practicable, to reduce the risk of physical harm if a terrorist incident occurs at the premises or in the immediate vicinity.

The responsible person is the individual or organisation with control of the premises in connection with the use that brings them within scope. This is not automatically the property owner or every employer based there.

These procedures cover four key areas:

Evacuation: How people can be moved safely away from danger.

Invacuation: How people can be moved to a safer location within the premises when leaving the building may expose them to greater danger.

Lockdown: Securing the premises or event to prevent individuals entering or leaving, where appropriate to the circumstances.

Communication: How clear information and instructions can be provided to staff, visitors and customers during an incident.

The arrangements should reflect the nature of the premises and the people using them.

Enhanced tier: 800 or more people

Larger qualifying premises, generally those expecting 800 or more people at the same time, will have additional responsibilities.

Once the duties commence, responsible persons must meet the public protection procedure and SIA notification requirements. They must also assess and keep appropriate public protection measures under review and, so far as reasonably practicable, ensure those measures are in place. The objectives are to reduce vulnerability to terrorist attacks and the risk of physical harm if an attack occurs.

The four areas of public protection measures are:

• Monitoring arrangements, such as CCTV where appropriate
• Managing the movement of people into, out of and within the premises
• Physical security measures
• Protecting sensitive information about the building and its operation

CCTV is an example, not a universal requirement. The appropriate measures will depend on the circumstances and what is reasonably practicable.

Responsible persons must also prepare and keep a compliance document up to date, explaining the procedures and measures and assessing how they reduce risk, and supply it to the SIA. Where the responsible person is an organisation rather than an individual, it must designate a senior individual involved in its management or control to oversee compliance.

Certain public events at which 800 or more people, including staff, may reasonably be expected at the same time also qualify. They must meet the other event conditions, including checks that attendees satisfy an entry condition, such as payment, a ticket or pass, or membership or guest entitlement. Qualifying events can take place on outdoor land, must not be at premises already covered by the enhanced tier, and are subject to exclusions. They have the same requirements as enhanced-tier premises; there is no separate 200-person standard tier for events.

An important exception: Qualifying premises whose principal use is childcare, primary, secondary or further education, or a place of worship, remain in the standard tier even where 800 or more people are reasonably expected. Higher education premises, such as universities, do not receive this exception and may fall within the enhanced tier.

What if your business has fewer than 200 people?

If your premises do not meet the qualifying threshold of 200 people, they will generally be outside the premises duties. However, an event using the site, including its outdoor land, could separately qualify if it meets the event conditions, including the 800-person threshold.

However, this does not mean that considering wider emergency preparedness is unnecessary.

Businesses of all sizes can benefit from reviewing how they would respond to incidents such as a security threat, suspicious package or situation where it is safer to remain inside the building.

These considerations may also complement existing health and safety and emergency planning arrangements.

What should employers and venue managers consider now?

Although the main legal requirements have not yet commenced, there are several sensible steps businesses can take in preparation. The suggestions below are recommended good practice now; they should not be confused with duties already in force or treated as a complete compliance checklist.

1. Understand your occupancy

Establish how many people, including visitors, customers and staff, may reasonably be present at the same time in connection with the qualifying uses.

Consider peak periods, special events and seasonal variations rather than relying solely on average attendance.

2. Review existing emergency arrangements

Many workplaces already have fire evacuation procedures.

However, responding to a terrorist incident may require a different approach.

For example, evacuating outside may not always be the safest option if a threat is immediately outside the premises.

Consider whether your existing arrangements address evacuation, invacuation, lockdown and emergency communication.

3. Consider staff awareness and training

Staff need to understand their responsibilities during an emergency.

Appropriate awareness and instruction can help employees recognise potential threats, communicate effectively and respond in accordance with the premises' emergency procedures.

Training should be relevant to their role and the nature of the premises.

4. Consider communication arrangements

How would staff communicate quickly with each other?

How would visitors receive instructions?

Are there arrangements for people who may need additional assistance, including children or individuals with disabilities?

These are useful questions to explore when reviewing emergency preparedness.

5. Coordinate with other occupiers

Coordination is not only recommended good practice. Once the duties commence, where more than one person is responsible for qualifying premises or an event, they must coordinate so far as reasonably practicable. The same applies between responsible persons for qualifying premises within larger qualifying premises.

For example, a business operating within a shopping centre or community building may rely on shared entrances, exits, security arrangements or emergency procedures.

Other people with control over enhanced-tier premises or the premises hosting a qualifying event must also cooperate with the responsible person, so far as reasonably practicable, to support compliance.

Establishing responsibilities and communication arrangements between occupiers can help avoid confusion during an incident.

Does Martyn's Law require every business to install expensive security equipment?

No.

The legislation takes a proportionate approach.

For standard-tier premises, the focus is on appropriate public protection procedures. The Act does not require physical alterations or equipment purchases to put those procedures in place.

Enhanced-tier premises and qualifying events must assess and keep appropriate public protection measures under review and ensure they are in place so far as reasonably practicable. This is not a blanket requirement to buy particular equipment.

The arrangements needed will depend on the premises, its use, the people present and the particular risks involved.

When does Martyn's Law come into force?

Although the Act became law in April 2025, its main operational requirements have not yet commenced.

The SIA currently expects commencement in spring 2027, but the exact date has not been confirmed. The Government has described an implementation period of at least 24 months from Royal Assent, rather than a fixed start date exactly two years later. The operational duties will apply when brought into force by commencement regulations.

Businesses potentially within scope are encouraged to familiarise themselves with the official guidance and begin considering how the requirements may affect their premises.

Final thoughts

Martyn's Law represents an important development in how certain public premises and events prepare for potential terrorist incidents.

For employers and venue managers, the starting point is understanding whether their premises fall within scope and reviewing the suitability of existing emergency arrangements.

Even where the legislation does not apply, considering wider emergency scenarios can be a valuable part of maintaining a safe and prepared workplace.

At Peace of Mind Training, we believe that effective emergency preparedness starts with awareness, clear procedures and appropriate staff training.

Taking time to review existing arrangements now can help businesses become better prepared for a range of emergency situations.

Further information

For the latest official guidance, visit:

• UK Government – Terrorism (Protection of Premises) Act 2025
• Home Office – Statutory guidance
• SIA – Understanding Martyn's Law and the regulator's role
• ProtectUK – Martyn's Law guidance

Information reviewed 23 October 2026. This article provides general guidance, not premises-specific legal advice, and should be read alongside the legislation and official government guidance.