Martyn's Law for multi-site operators and groups

The short answer

Martyn's Law, the Terrorism (Protection of Premises) Act 2025, applies premises by premises. A group running 40 restaurants does not have one Martyn's Law duty. It has a separate duty for every site that qualifies, and no duty for sites that do not. Standard tier premises are those where 200 to 799 people can reasonably be expected to be present at the same time, from time to time. Enhanced tier premises are 800 or more. Staff count towards these figures, including employees, contractors and volunteers.

The Home Office statutory guidance speaks directly to groups. Where the same organisation is responsible for several premises, such as a chain of restaurants or shops, it should consider how the requirements can be met at each individual premises, avoiding a one-size-fits-all approach. That is the theme of this guide: set the standard centrally, but build and prove compliance locally.

The duties are not yet in force. They are expected to commence in spring 2027, which gives groups time to plan a proper rollout rather than a rush.

Assess each premises separately

Start with a full list of every site and run each one through the same tests: is it used for a listed purpose, is the public admitted, and how many people can reasonably be expected to be there at the same time at its busiest. Our guides to qualifying premises and calculating capacity explain the tests.

The statutory guidance gives the example of a supermarket chain with several stores of different sizes in one city. It assesses each store separately. Some are out of scope, some are standard tier and two superstores are enhanced tier. The closest two qualifying stores are 800 metres apart with other buildings between them, so they are not a group of buildings. Each store is premises in its own right, with its own circumstances and its own tailored procedures.

The figures above are illustrative. Your numbers must come from each site's own evidence, such as occupancy limits, ticketing, till data or headcounts. Record how you reached each figure, because the SIA notification asks for it. The free tier checker is a quick way to get a first view for individual sites before you build a full register.

Who is the responsible person at each site

The responsible person is whoever has control of the premises in connection with their listed use. The statutory guidance says control ordinarily means physical possession plus the right and ability to make decisions about management and use, especially who may remain on site. Ownership is not the test. See who is the responsible person for the detail.

For a group, the answer can differ across the estate:

• Managed sites run by your operating company: the operating company is usually the responsible person, even if the property is leased from a landlord.
• Tenanted or leased-out sites: the tenant who controls the premises is usually responsible. The Home Office corrected its pub example in August 2026 to say that the tenant who controls a pub, not the brewery or pub company, is the responsible person.
• Franchised or licensed sites: the Act does not mention franchising. Apply the control test to the facts of each arrangement and record your reasoning.
• Concessions inside larger premises: where a qualifying unit sits inside other qualifying premises, both responsible persons must co-ordinate with each other under section 8 of the Act. This applies at both tiers.

Where different companies in a group hold different leases, check which legal entity actually controls each site. The SIA notification asks for the registered name and company number of each responsible person, so this needs to be right. If responsibility is genuinely unclear, section 11 of the Act allows the SIA, or anyone with some control of the premises, to ask the First-tier Tribunal to decide.

Central standards, local procedures

Groups gain a lot from a common approach: one format, one training standard, one way of recording. The statutory guidance accepts this. It notes that appointing the same senior individual across several enhanced tier sites may bring consistency and standardisation, but says procedures and measures must still be tailored to individual sites and not put in place generically.

A practical split looks like this:

The test is simple. If you could swap the site name on two sets of procedures and nobody would notice, they are not tailored enough. A basement bar with one street exit needs a different lockdown plan from a ground floor restaurant with a rear yard. Our guide to public protection procedures covers what each procedure should contain.

Notifying the SIA for each premises

Notification is made for each set of qualifying premises. The Home Office notification guidance lists what must be provided, including the postal address of the premises, the relevant listed use, the greatest number of people reasonably expected at the same time and how that figure was calculated, and whether the responsible person is responsible for other qualifying premises or events. It also asks whether the premises form part of larger premises, and for anyone you must co-ordinate with.

• Existing premises: the responsible person must notify within three months of the notification requirement coming into force.
• Sites acquired or opened later: notify within 28 days of becoming responsible (or by the end of the first three months, if later).
• Sites sold, closed or handed back: notify within 28 days of ceasing to be responsible.
• Changes to notified information, such as a new capacity figure or new contact: notify within 28 days.

Notifications go through the SIA's online portal. The SIA has said it will publish practical details on using the portal before commencement, so check the SIA's guidance for how multi-site submissions will work rather than assuming a bulk upload.

You can authorise an employee, agent or consultant to submit notifications for you, but legal responsibility stays with the responsible person. The guidance recommends keeping a written record of who is authorised and when. For a large estate, assign one central owner for notifications and build the 28-day change deadline into property, acquisitions and refit processes. See notifying the SIA for the full list of information.

Training and records across many sites

The Act does not require any specific training course. The statutory guidance does say that staff responsible for carrying out procedures must be made aware of them and their role, and given the understanding and tools to carry them out. Generic modules alone are not enough: training should focus on the specific procedures at the premises. Even staff with prior security training, such as an SIA licence, are still likely to need site-specific instruction.

For groups, the hard part is consistency across high staff turnover, agency workers and shift patterns. Things that work:

• A short core briefing written once, plus a site addendum completed by each site lead.
• Briefing on induction for every new starter, agency worker and regular contractor, logged with the date and the person who gave it.
• A prompt card at each site with that site's exits, safe areas and how to raise the alarm.
• Free counter-terrorism awareness material from ProtectUK, such as ACT Awareness e-Learning, set as the common baseline.
• One record format across the estate, so head office can see gaps at a glance.

There is no statutory duty to document compliance at the standard tier, but records are how you show the SIA that procedures exist and staff know them. For enhanced tier sites, the guidance treats a record of training as a necessary part of the compliance document. Our guides to staff training and record keeping go further.

Governance and reporting

Give Martyn's Law a clear owner at group level, usually whoever already leads health and safety or security. For any enhanced tier site run by a company, the Act requires a designated senior individual who is concerned in the management or control of the organisation. One senior individual can cover several sites. The guidance's example is a board member at a cinema chain's headquarters who delegates day-to-day compliance to a named person at each site while keeping overall responsibility. See the designated senior individual.

A simple reporting pack for the board or operations committee might show:

• The site register: tier, responsible entity, notification status and date of last review for every site.
• Exceptions: sites with missing procedures, overdue drills or training gaps.
• Changes pending notification and their 28-day deadlines.
• Lessons from drills or incidents that should change the central template.

Keep sensitive detail out of wide circulation. The guidance warns against sharing security information more widely than needed, and lists managing what suppliers and contractors can access as a security of information measure. Board papers can report status without including site layouts.

A rollout plan for 10 or 100 sites

1. Build the site register: address, listed use, controlling entity, lease or tenancy model, and any larger premises the site sits within.
2. Assess capacity and tier for every site using one method, and record the evidence and reasoning.
3. Confirm the responsible person for each qualifying site, flagging tenanted, franchised and concession sites for a closer look.
4. Set central standards: templates, training baseline, record format, review cycle and escalation routes.
5. Pilot at two or three contrasting sites, such as a large flagship, a small standard tier site and a unit inside a shopping centre. Fix the templates before scaling.
6. Roll out in waves, enhanced tier and larger standard tier sites first. Each site lead completes the local detail, briefs staff and runs a walk-through.
7. Prepare notifications so they are ready when the portal opens, then submit within the three-month window.
8. Move to business as usual: annual review, drills, new starter briefings and the 28-day change process.

Scale changes the shape of the work. With 10 sites, a central lead can visit each one and check the local detail in person. With 100 sites, you will rely on site leads, a standard self-check and sampling: for example, a head office review of a set proportion of sites each quarter, with every site covered over the year. Plan the notification workload early. Several hundred sites submitting in the same three months is a real project.

Common mistakes and next steps

• Assessing the estate as a whole instead of site by site, or using one capacity figure for every format.
• Copying one set of procedures across all sites with only the name changed.
• Assuming the parent company is responsible for every site, including tenanted or franchised ones.
• Forgetting sites inside shopping centres or transport hubs, where co-ordination with the larger premises is required.
• Treating notification as a one-off, and missing the 28-day deadlines when sites open, close or change.
• Training head office and missing the agency staff and contractors who are on site at peak times.

Begin with the register and a tier view of every site. Our sample documents show what tailored procedures and records look like. For groups, our multi-site pack covers three or more premises from £199 + VAT per premises, with consistent templates completed for each site and one dashboard to track progress across the estate. Details are on our packs page.

Frequently asked questions

Sources

• Terrorism (Protection of Premises) Act 2025: Statutory guidance, corrected version (Home Office)
• Terrorism (Protection of Premises) Act 2025: notification requirement (Home Office)
• Terrorism (Protection of Premises) Act 2025, section 8 (legislation.gov.uk)
• Terrorism (Protection of Premises) Act 2025, contents (legislation.gov.uk)