Martyn's Law for events and festivals

The short answer

Martyn's Law, the Terrorism (Protection of Premises) Act 2025, covers events as well as permanent venues. Under section 3, an event is a qualifying event if it meets all six of these conditions:

If an event qualifies, the person responsible must meet the enhanced duties for that event. Those duties are not yet in force. They are expected to start in spring 2027. Our main guide to qualifying events covers the definition in more depth, and the free tier checker can help you test a single event.

Testing the hard cases

Most of the difficulty sits in conditions 4 and 5. The Home Office statutory guidance gives clear pointers.

• Peak, not total: a festival with 280 people on site until 6pm and a further 640 arriving for the evening has a peak of 920, so it qualifies.
• Timed entry: a light show in a park that allocates entry slots so no more than 300 people are present at once is not a qualifying event.
• Free but registered: free events qualify if there is a specific check, such as a QR code, wristband or emailed ticket, checked at a perimeter. The guidance gives the example of a temple's free, ticketed Holi celebration in a fenced-off park.
• Donations and dress codes: a suggested donation, a dress code or search criteria are not entry checks.
• Participation fees: a fun run where runners pay to take part but spectators gather freely along an open route has no entry check for the area, so it is not in scope.
• Members' events: a ticketed members-only event in a park can qualify, because members of a club count as an entry condition. A company's invitation-only customer event does not.

Mixed events need splitting. For marathons, carnivals, parades and city-wide races, each area with entry controls and 800 or more expected at once, such as a grandstand or start area, is assessed separately. Open roads, pavements and towpaths without entry checks are not in scope, unless they form part of the immediate vicinity of a qualifying area.

One-off, annual or regular: event or venue?

The same crowd can trigger different rules depending on where and how often it happens.

• A one-off event of 800 or more at a standard tier venue, or at a site that is otherwise out of scope, such as a private warehouse or a country estate, is a qualifying event for its duration.
• If a venue with buildings reasonably expects 800 or more from time to time, even once a year, the venue itself becomes enhanced tier. The guidance's example is a pub with 100 at peak that hosts an annual music festival of 950 in its building and garden: the pub is enhanced tier, and the pub operator is responsible all year.
• A recurring festival on open land with no building is different. Land without a building cannot be qualifying premises, so each year's festival is assessed as a qualifying event.
• Parks, gardens and recreation grounds with open access are excluded as premises, but events held in them can still be qualifying events.
• Events at places of worship, schools, nurseries and further education colleges can never be qualifying events, whatever the size. The host's own duties, if it is in scope, cover the occasion instead. See places of worship and schools, colleges and universities.

Organisers, landowners and venues: who is responsible

The responsible person for a qualifying event is whoever will have control of the premises in connection with their use for the event. Control usually means possession of the site and the right to decide how it is run and who may stay. The statutory guidance's examples show how this plays out.

• A company hires part of a council park under a contract that gives it control of the area for a concert. The company is responsible, not the council.
• If the council keeps control of the area, the council is responsible, even if it contracts out stewarding, security or ticketing.
• A private company hires a standard tier village hall for a one-off ticketed fundraiser of 800. The company is responsible for the event and must notify the SIA and prepare a compliance document. The hall committee stays responsible outside the event, and the two must co-ordinate.
• An organiser hires part of a stately home's grounds for a food festival. The organiser is responsible for the festival area, and the stately home operator stays responsible for the rest of the site.

Legal responsibility cannot be handed to a contractor, but tasks can. An organiser can use a production company, a security firm and a ticketing agent, and still be the responsible person.

Section 8 of the Act links the parties. A landowner or venue owner with some control over the site of a qualifying event must co-operate with the responsible person, so far as reasonably practicable. Where a qualifying event is held at standard tier premises with a different responsible person, both must co-ordinate. Put these arrangements in the hire contract: who controls which areas, when control passes, and what each party will provide.

What the enhanced duties mean for an event

For a qualifying event, the responsible person must:

• have public protection procedures for evacuation, invacuation, lockdown and communication, so far as reasonably practicable
• assess and keep under review public protection measures covering monitoring, movement of people, physical safety and security, and security of information, and put appropriate ones in place so far as reasonably practicable
• prepare a compliance document stating the procedures and measures and assessing how they reduce risk, and give it to the SIA as soon as reasonably practicable after first preparing it, with any revision provided within 30 days
• designate a senior individual if the responsible person is a company or other organisation
• notify the SIA

The notification rules are in the Terrorism (Protection of Premises) (Notification Requirements) Regulations 2026. For events first publicised after the duty starts, you must notify within 14 days of first publicity, meaning the date details are first made public by you or with your authority, including to club members. You will need, among other things, the event dates and admission times, the peak number expected and how you calculated it, relevant licences such as a premises licence or temporary event notice, the date and format of first publicity, and any senior individual's details. See our guide to notifying the SIA.

Penalties for enhanced duties can reach £18 million or 5% of qualifying worldwide revenue, whichever is higher, and some failures are criminal offences. Our guides to enhanced tier duties and public protection measures explain the requirements in full.

Outdoor sites and temporary venues

Outdoor events raise problems that buildings do not. The statutory guidance and its supplementary examples point to several practical considerations.

• Invacuation may not be possible. The guidance's example of a firework display in a park concludes that, with no safe internal space, evacuation is the likely response. A marquee or tent is not a protected space.
• Queues are part of the picture. In the guidance's cycling race example, the queuing areas leading into grandstands are treated as the immediate vicinity and included in procedures.
• Long perimeters may not be fully controllable. In one supplementary example, a racecourse with a three-kilometre perimeter decides a full physical barrier is not reasonably practicable, and instead concentrates monitoring at the main entrance and stands, with sweeps, unpredictable patrols and pre-shift briefings.
• Egress is a vulnerable moment. Plan how you would stop or reroute departing crowds if something happens outside the gates.

Temporary sites also change during build and break. Agree when the event's procedures start and finish, and how contractors on site will be alerted.

Stewarding and staff

Your stewards, security staff, bar teams and volunteers carry out your procedures, so they need to know them. There is no statutory requirement for a specific course, but the guidance says people with a role in procedures must be made aware of them and given the understanding and tools to carry them out. Briefings, induction sessions and prompt cards are all recognised methods.

• Include every staff group in your peak count: stewards, contractors, traders' staff, artists' crews and volunteers.
• Give stewards a short, event-specific briefing on the four procedures, the alert signals and who decides. The guidance notes that even staff with SIA licences are likely to need site-specific instruction.
• Check licensing rules under other legislation. Some security roles require SIA licences under the Private Security Industry Act 2001, and Martyn's Law does not change that.
• Make sure every member of staff knows how to report suspicious behaviour or items quickly.
• If stewarding is contracted out, write your procedures into the contract and check the supplier's briefing actually happens. You remain responsible.

Our guide to staff training requirements covers briefing formats and records.

Ticketing data and security of information

Ticketing does three jobs under Martyn's Law. It can be the entry check that brings an event into scope. It is often your best evidence for the peak number you notify to the SIA. And it holds information that must be protected.

• Use ticket types, entry scans and timed slots to estimate the peak present at once, then add staff. Keep the workings, because the SIA can ask how you reached your figure.
• If you use timed entry to keep the peak below 800, keep evidence that the system works on the day.
• Treat site plans, security arrangements, staff rotas and attendee data as sensitive. The guidance on security of information suggests auditing what is published on websites, social media, apps and licensing applications, and sharing detailed plans only with those who need them.
• Check that ticketing agents and other suppliers protect security-sensitive information.

Common mistakes and next steps

• Counting the daily total instead of the peak, or forgetting staff.
• Assuming a free event is out of scope despite registration checks.
• Assuming the landowner or venue is responsible when the hire contract gives you control.
• Missing the 14-day notification window after announcing the event.
• Copying a generic plan rather than one built for the site, the crowd and the egress routes.

Start by testing each event against the six conditions and recording your reasoning. Then check the hire contract for control and co-operation, and plan notification into your publicity timeline. If you run a venue that hosts events, see our conference and events venues page. For enhanced duty events, our enhanced tier page explains how we can introduce you to a specialist.

Frequently asked questions

Sources

• Terrorism (Protection of Premises) Act 2025, section 3 (legislation.gov.uk)
• Terrorism (Protection of Premises) Act 2025, section 8 (legislation.gov.uk)
• Home Office statutory guidance on the Terrorism (Protection of Premises) Act 2025 (GOV.UK)
• Non-statutory supplementary document B: Scope, illustrative examples (GOV.UK)
• The Terrorism (Protection of Premises) (Notification Requirements) Regulations 2026 (legislation.gov.uk)
• Terrorism (Protection of Premises) Act 2025: notification requirement (GOV.UK)