Martyn's Law

Understanding Martyn’s Law – and impact on venues and events

Ahead of the implementation of the so-called Martyn’s Law, Krishna Pancholi, Associate at UK and Ireland law firm Browne Jacobson, explains what it involves and considerations for emergency planning.    

The Terrorism (Protection of Premises) Act 2025, known more commonly as Martyn’s Law, was introduced following the 2017 Manchester Arena attack and named after Martyn Hett, one of the victims. 

The attack exposed serious failings in venue security and emergency planning. At the time, there were no legal requirements for premises to assess the risk of a terrorist attack or plan accordingly. Martyn’s Law was introduced to close this gap.
Martyn’s Law is now on the statute books after receiving royal assent in April 2025, but is not yet in force. The government has indicated at least a 24-month implementation period for establishments to prepare for compliance and put appropriate plans in place. 

Preparing now is best advised to ensure compliance by the time the Act is in force. Once the Act takes effect, the Security Industry Authority (SIA) will be responsible for enforcement of the legislation. 

The proactive approach mandated by the Act aims to prevent future attacks by ensuring venues are well-prepared and can effectively respond to terrorist incidents.

Premises and events affected by Martyn’s Law
The Act imposes a duty to improve physical security measures and organisational preparedness. Premises are considered under tiers.

Standard tier – involves qualifying premises (explained further below) or events holding a capacity of 200-799 individuals, although the government’s terrorism threat level could lead to a reduction in the threshold to 100 people. The standard duty holder is responsible for ensuring public protection procedures are in place to reduce and mitigate the risk of harm to people attending the premises should a terrorist act occur. Procedures are seen as reactive to an attack. 

Enhanced tier – involves venues and events anticipating over 800 individuals and requires a more robust approach to security. It imposes the duties expected of a standard duty holder, with the addition of further requirements to assess, implement and review appropriate public protection measures. Enhanced measures will be proactive and preventative, designed to mitigate the risk of a terrorist attack, reducing the risk of harm to people attending the premises or in the immediate vicinity. Immediate vicinity must be included in any measures implemented.  

The Act mandates who is responsible for identifying the risk from terrorism and the subsequent response. The regime will be enforced by the SIA, using the two-year implementation period to allow time to become familiar with the new obligations and plan compliance accordingly. It is acknowledged that while awaiting official guidance, there may be some uncertainty on what compliance for your establishment means and the associated costs implications. The appropriateness of any measures will be determined by the premises concerned, the event and the capacity.

Qualifying premises, which are contained within Schedule 1 of the Act, could include retail, food and drink vendors, entertainment venues, sports and recreation grounds, leisure centres, libraries, museums, galleries, hotels, holiday parks, hospitals, educational establishments, places of worship and public buildings. 

Excluded premises, contained within Schedule 2, include Parliament and transport premises, such as ports, airports, railway and underground services.

Who is the responsible person?
The responsible person (RP) will be the person (an individual or corporate entity) with overall control of the premises for the purposes of the qualifying use. 
This will not necessarily be the building owner, who will not have responsibility under the Act if they are not involved in the running of the premises. 

The appropriate RP may be, for example, the premises operator or event organiser. The RP has a duty to notify the SIA they are responsible for that premises, and must document the proposals or public protection measures in place.

The Act imposes a statutory duty of co-ordination to ensure compliance where more than one person (or organisation) has responsibility for a qualifying premises or event – recognising the various ways in which co-ordination may be required.

This also includes where one part of a premises forms part of another qualifying premises, such as a department store within a retail complex. In such cases, both the store and the complex owner must co-ordinate as far as is reasonably practicable.

Martyn’s Law requires RPs to take action that is “reasonably practicable”. This means balancing the measure in reducing the risk against the effort it takes to do so. What is appropriate and reasonably practicable depends on the individual circumstances of each premises – what might work for one premises may not necessarily work for another.

Public protection procedures
The RP must ensure that public protection procedures are implemented to reduce the risk of harm to individuals if an act of terrorism were to occur on the premises or the immediate vicinity. 

The following types of procedure are identified as appropriate and reasonably practicable. They are designed to be pragmatic, focusing on getting people to safety and mitigating the risk.

Evacuation: Safely removing people from the premises.

Invacuation: Moving people to a secure area inside the premises.

Lockdown: Locking down or securing the premises.

Communication: Alerting staff and pupils quickly.

Enforcement 
The SIA’s enforcement powers include:
Compliance or restriction notices: These have the effect of limiting numbers at premises or the time at which an event can take place. Appeals to notices are by way of tribunal. 

Financial penalties: The maximum non-compliance penalty for standard tier premises is £10,000. Enhanced tier premises can attract a maximum penalty of £18m or 5 per cent of worldwide turnover – whichever is higher. Daily penalties can apply for each day the contravention continues after the date the non-compliance penalty is due.

Closing down of premises. 

What preparations should I consider for my premises?
1.    Pay early consideration to whether the new Act applies to your premises and whether you fall within the standard or enhanced tier. 

2.    Identify the RP(s) and whether the co-ordination element within the Act requires consideration.

3.    Evaluate whether your existing safety policies can act as a platform on which to build further arrangements to comply.

4.    Consult ProtectUK for the latest guidance ahead of implementation.