What is Martyn's Law? A plain English guide

Martyn's Law in one paragraph

Martyn's Law is a UK law that requires the people in charge of certain public premises and events to be prepared for a terrorist attack. Its formal name is the Terrorism (Protection of Premises) Act 2025. It does not ask you to predict whether an attack will happen at your venue. The Home Office statutory guidance says the Act is based on the assumption that an attack might occur anywhere, so the question is simply whether your team would know what to do to keep people safe. Smaller qualifying venues need sensible procedures. Larger venues and events also need to reduce their vulnerability to attack and document what they have done.

If you only have a minute, use our free tier checker to see whether your premises are likely to be in scope and which tier applies.

Why it is called Martyn's Law

The Act is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack on 22 May 2017. His mother, Figen Murray OBE, led the Martyn's Law Campaign Team and campaigned for years for a legal duty on venues to prepare for terrorism. In May 2024 she walked around 200 miles from the Manchester Arena to Downing Street, arriving on the seventh anniversary of the attack, to press for the law to be introduced.

The campaign was supported by findings from official inquiries. The statutory guidance notes that the 2019 Prevention of Future Deaths report on the London Bridge and Borough Market attack called for action, and that the Manchester Arena Inquiry Volume One report in 2021 recommended legislation to improve the safety and security of public venues. Research cited in the guidance also found that, without a legal duty, counter terrorism security tends to be deprioritised behind other legal requirements such as fire safety.

What the Act actually does

Part 1 of the Act creates the public protection requirements. It sets out which premises and events are covered, who is responsible for them, what they must do, and how the SIA will enforce it. Part 2 makes a separate change to licensing law in England, Wales and Scotland so that sensitive premises plans held on public licensing registers can be restricted where they could help someone plan an attack.

The duties in Part 1 are tiered, so the burden rises with the size of the premises or event. Throughout, the test is what is appropriate and "reasonably practicable". The guidance describes this as weighing what can be done to achieve the objective against the cost, time and difficulty, taking account of the resources you have. A village hall and a national stadium are not expected to do the same things.

Who it applies to

Premises are in scope ("qualifying premises") if all four tests in section 2 of the Act are met. They consist of a building, or a building and other land. They are wholly or mainly used for one or more uses listed in Schedule 1, such as shops, pubs, restaurants, entertainment and leisure, hotels, places of worship, health care, education and public authority services. It is reasonable to expect that, from time to time, 200 or more people may be present at the same time. And they are not excluded by Schedule 2. Our guide to qualifying premises walks through each test.

Events can also be in scope. A qualifying event is one where members of the public attend, 800 or more people are expected at the same time at some point, and there are entry checks such as tickets, payment or membership. See qualifying events for the detail.

The numbers include staff, contractors and volunteers, not just customers. Places of worship, childcare settings and schools and further education colleges stay in the standard tier even if they reach 800, and events held at them cannot be qualifying events. Getting the number right matters, so read how to calculate capacity before you decide.

What you must do

Every responsible person for qualifying premises or a qualifying event must notify the SIA when they become responsible and when they stop being responsible. They must also have appropriate public protection procedures in place, so far as is reasonably practicable. The Act names four:

• Evacuation: getting people out of the premises, or part of them, away from danger.
• Invacuation: moving people to a safer place inside the premises, which can include bringing people in from outside.
• Lockdown: securing the premises to stop people entering or leaving, for example to keep an attacker out.
• Communication: giving people information and instructions quickly, where it is safe to do so.

Procedures only count if staff can actually carry them out, so the guidance expects staff to be aware of them and trained or instructed as needed. There is no requirement at standard tier to make physical alterations or buy equipment, and no legal duty to produce a written document, although the guidance strongly recommends writing your procedures down because it may otherwise be hard to show the SIA you comply.

Enhanced tier premises and qualifying events must also assess and put in place reasonably practicable public protection measures covering monitoring, the movement of people, physical safety and security, and the security of information. They must prepare a compliance document, send it to the SIA and keep it up to date. Where the responsible person is a company or other organisation, it must designate a senior individual. Our standard vs enhanced tier comparison sets these side by side.

The regulator and the penalties

The SIA, already the regulator of the private security industry, is the regulator for Martyn's Law. It will receive notifications through an online portal and enhanced tier compliance documents, carry out desk based assessments and inspections, and give advice. It can require information, enter premises (usually with at least 72 hours' written notice), and issue compliance notices, restriction notices for enhanced tier premises and events, and penalty notices. The SIA has said it will be supportive and proportionate but will enforce where it needs to. Read more in our guide to the SIA as regulator.

Failing to comply with a restriction notice is also an offence. Some offences apply whatever the tier: failing to comply with an SIA information notice, obstructing an inspector, and knowingly or recklessly giving the SIA false or misleading information. Senior managers can also be prosecuted for some offences committed by their organisation with their consent or connivance, or through their neglect. Our guide to penalties explains how these work.

When it starts

The duties are not in force yet. The government committed to an implementation period of at least 24 months from Royal Assent, to give venues time to prepare and to set up the SIA as regulator. The Home Office and the SIA both say the Act is expected to come into force in spring 2027, with the exact date to be set by regulations. Until then there is no legal requirement to comply, and you cannot notify the SIA yet.

Much of the detail is already published. The Home Office statutory guidance came out on 15 April 2026, regulations on notification were made in July 2026, and regulations on how to decide the principal use of multi use premises came into force on 15 October 2026. The Martyn's Law timeline lists every key date.

What to do now

You do not need to buy anything to prepare. The SIA has warned against products that claim to guarantee compliance, and the guidance says third party services are optional. A sensible order of work looks like this:

1. Check whether your premises qualify and which tier applies, and keep a note of how you worked out your numbers. Our tier checker is a quick first pass.
2. Confirm who the responsible person is. It is whoever has control of the premises for their main public use, which may be a tenant or operator rather than the owner. See who is the responsible person.
3. Gather what you already have: fire risk assessment, emergency plan, floor plans, licence conditions, staff rotas and contact lists.
4. Draft simple procedures for evacuation, invacuation, lockdown and communication that fit your layout and staffing. Start with our guide to public protection procedures.
5. Brief your staff, give them a short reference card and practise. Free resources such as ACT Awareness e-learning on ProtectUK are a good start.
6. If you are in the enhanced tier, start planning your measures and compliance document early, and consider specialist support for 800+ venues.
7. Sign up for SIA updates so you hear when the commencement date and notification portal are confirmed.

If you would rather follow a ready made structure, our fixed price Martyn's Law packs give standard tier venues tailored procedures, a staff briefing, staff training, an SIA notification checklist and a drill log in one place. Either way, starting now means you will be ready well before the SIA starts assessing compliance.

Frequently asked questions

Sources

• Terrorism (Protection of Premises) Act 2025 (legislation.gov.uk)
• Terrorism (Protection of Premises) Act 2025: Statutory guidance (Home Office)
• Understanding Martyn's Law and the SIA's role as regulator (SIA)
• SIA's consultation on its Martyn's Law guidance closes (SIA)
• Figen Murray completes walk to Downing Street (Planet Radio)