KEY POINTS
- The responsible person is whoever has control of the premises in connection with their Schedule 1 use (or, for a qualifying event, control of the premises for the event). It is set by the Act, not chosen.
- Control usually means being in occupation with the right and ability to make decisions about management and use, especially who may stay on site. That is often the tenant or operator, not the owner.
- Where premises have two or more Schedule 1 uses, the person controlling the principal use is responsible. Regulations on how to decide the principal use came into force on 15 October 2026.
- There can be more than one responsible person. They must co-ordinate, and landlords and others with partial control of enhanced tier premises must co-operate.
- Tasks can be delegated to staff or contractors, but legal responsibility cannot. Companies running enhanced tier premises or events must also designate a senior individual.
The short answer
Under section 4 of the Terrorism (Protection of Premises) Act 2025, a person is responsible for qualifying premises if they have control of the premises in connection with their relevant Schedule 1 use. For a qualifying event, the responsible person is whoever will have control of the premises where the event is held, in connection with their use for the event. "Person" includes companies, charities, councils and other organisations, and in practice the Home Office expects the responsible person to be an organisation more often than an individual.
The statutory guidance stresses that this is not a matter of choice. You cannot nominate someone else, and you cannot contract the duty away. If you are not yet sure your premises are in scope at all, check that first with our tier checker or the guide to qualifying premises.
What "control" means in practice
The Act says control means control "as occupier or otherwise". The Home Office guidance explains that a person in control will ordinarily have physical possession of the premises at the relevant time, together with the right and the ability to make decisions about their management and use, particularly who may or may not remain on site. The SIA summarises it as typically having both possession (being the occupant) and decision making power.
Control does not depend on ownership or on having exclusive rights. A leaseholder or licence holder can be in control. The same principle is used in fire safety law, so if you are already the responsible person for fire safety, you may well be the responsible person for Martyn's Law too. It is worth checking rather than assuming, because the two tests are not word for word the same.
Useful questions to ask yourself:
- Who decides the opening hours, staffing and how the space is used day to day?
- Who can refuse entry or ask people to leave?
- Who would make the call to lock the doors or evacuate?
- Who holds the keys and runs the building's alarm, PA and shutters?
If the answer to most of these is the same organisation, that is very likely your responsible person.
Owners, landlords, tenants and operators
Most confusion comes from leased and managed buildings. The guidance and its illustrative examples point in a consistent direction: the person running the Schedule 1 use on the ground is usually responsible, and the landlord usually is not.
| Illustrative scenario | Likely responsible person | Why |
|---|---|---|
| A company leases a building and runs a shop in it | The company running the shop | It controls the premises for the retail use; the owner does not |
| A pension fund owns a retail park; a managing agent lets units to retailers | Each retailer, for its own unit | Each occupant controls its unit for its Schedule 1 use |
| A pub owned by a brewery or pub company and leased to a tenant, with the owner holding the premises licence | The tenant | The Home Office corrected its original example in August 2026: the tenant controls the pub, even though it does not hold the licence |
| A shopping centre operator controls the common areas, entrances and exits | The operator, for the centre as a whole | Large units inside may also be qualifying premises with their own responsible persons |
| A hotel with a restaurant and conference suite run as one operation | The hotel operator | Hotel is the principal use, so whoever controls the hotel use is responsible |
Landlords are not off the hook entirely. Under section 8, anyone who has some control of enhanced tier premises or a qualifying event but is not the responsible person must co-operate with the responsible person, so far as reasonably practicable. The guidance gives the example of a gallery tenant needing freeholder consent to install concrete planters against vehicle attacks: the freeholder must co-operate with, and consider, that request.
Buildings with more than one use
Where premises are used for two or more Schedule 1 uses, the responsible person is whoever controls the premises for the principal use. The Terrorism (Protection of Premises) (Principal Use of Premises) Regulations 2026 came into force on 15 October 2026 and the Home Office has published guidance on applying them.
You start by asking which use relates most closely to the purpose and nature of the premises, taking account of whether they were built or adapted for a particular use, whether they still serve that use, their physical characteristics, and how the local authority treats them (for example planning permission or licences). If that does not settle it, you weigh all the circumstances, including how much of the premises each use occupies, how much time is spent on each, and whether one use exists to support another. The guidance suggests keeping a record of your decision and reasoning.
For example, a stadium that also hosts conferences and tours will normally have "sports ground" as its principal use, because it was built and is still used for sport. The principal use test only applies within single premises. A separate unit inside a shopping centre, with its own entrances and boundaries, is its own premises and does not need it.
When there is more than one responsible person
Section 4(4) accepts that more than one person can be responsible for the same premises or event. Each of them carries the duties, and they may act jointly to comply. Section 8 then requires them to co-ordinate with each other so far as reasonably practicable.
Co-ordination also applies where qualifying premises sit inside other qualifying premises, such as a department store inside a shopping centre. The guidance's example has both parties deconflicting their evacuation plans and aligning lockdown and communication, so that people are not funnelled into the same exit or locked in the wrong place. Practical tools include a tenants' group with security as a standing agenda item and a real time communication channel between duty managers. Our guide to multi-tenant and shared buildings covers this in depth.
Smaller premises that are out of scope have no duties of their own. But if they sit within enhanced tier premises, they may still need to co-operate with the larger premises, and the guidance expects this to be built into leases, for example requiring a small coffee shop in a hospital to follow the hospital's evacuation procedure.
Hiring out premises and running events
If you hire out qualifying premises, you normally remain the responsible person while hirers use them. The guidance expects you to explain the legal requirements to hirers, set out what you expect of them (ideally in the hire contract), and be able to show the SIA you did so and took reasonable steps to check they followed through. A conference centre that requires hirers to deliver parts of its procedures, and monitors that they do, is the guidance's model.
There is one important exception. If a qualifying event (800 or more people, public access and entry checks) is held at standard tier premises, and the organiser takes control of the premises for the event, the organiser becomes the responsible person for the event. The usual responsible person remains responsible for the rest of the time, and for any parts of the site the event does not use, and the two must co-ordinate.
Some settings have the person fixed by the Act itself. For hospitals, it is the NHS trust, health board or the hospital's governing body. For schools it is the governing body or proprietor (or the local authority for pupil referral units). For further and higher education it is generally the governing body or provider, and for premises used by a public authority to serve the public, it is the public authority. Responsibility does not move to an event organiser at places of worship, schools, further education colleges or childcare settings, because events there cannot be qualifying events. See qualifying events for how event responsibility works.
Companies, charities and the senior individual
Where the responsible person is an organisation, its duties at standard tier are the same as an individual's: notify the SIA and have appropriate procedures. For enhanced tier premises and qualifying events, section 10 adds a requirement to designate an individual who is concerned in the management or control of the organisation to be responsible for ensuring compliance.
This must be someone genuinely senior, such as a director, board member or, in a volunteer run body, a management committee member. A junior employee with limited influence is unlikely to qualify. The senior individual can delegate day to day tasks to site managers or a security lead but keeps overall responsibility. One senior individual can cover several sites, provided procedures are still tailored to each site. Read more in our guide to the designated senior individual.
Penalty notices go to the responsible person, not to the senior individual personally. However, for certain offences committed by an organisation, such as ignoring a compliance or restriction notice, directors and senior managers (including the senior individual) can be prosecuted if the offence happened with their consent or connivance or through their neglect.
Common mistakes and what to do next
- Assuming the owner or licence holder is responsible when a tenant or operator actually runs the premises.
- Thinking a security contractor or consultant becomes responsible because they deliver the work. They do not. You can delegate tasks, not liability.
- Ignoring hirers. If you hire out your hall or venue, your contracts should say who does what under your procedures.
- Forgetting to co-ordinate with the centre, landlord or neighbouring tenants who share exits and routes.
- Not recording the reasoning. If responsibility could be argued either way, write down why you reached your view. Either party, or the SIA, can ask the First-tier Tribunal to decide who is responsible.
Once you know who is responsible, that person or organisation will need to notify the SIA when the law starts. Read notifying the SIA to see what you will be asked. If you are a standard tier venue, our packs set out roles and decision makers alongside tailored procedures and a staff briefing, so it is clear who does what.
Frequently asked questions
If I lease my premises, is my landlord the responsible person?
Usually not. The responsible person is whoever controls the premises for their Schedule 1 use, which for a let shop, bar or restaurant is normally the tenant who runs it. Landlords with some control of enhanced tier premises must co-operate with the tenant so far as reasonably practicable.
Can I hand responsibility to my security company or consultant?
No. The Home Office guidance is clear that the responsible person can delegate tasks but cannot delegate legal responsibility. You must be satisfied any provider is suitable, properly resourced and delivering what you need.
Is the responsible person the same as for fire safety?
Often, because both regimes are based on control, but not automatically. Check against the Martyn's Law test: control of the premises in connection with their Schedule 1 use, ordinarily meaning occupation plus the right and ability to decide how they are managed and used.
Who is responsible when someone hires my venue for an event?
You normally remain responsible and should set out hirers' obligations in the hire agreement. The exception is a qualifying event of 800 or more people with entry checks at standard tier premises, where the organiser who takes control becomes responsible for the event.
What if we disagree about who is responsible?
Section 11 of the Act allows the SIA, or anyone with some control of the premises or event, to apply to the First-tier Tribunal for a determination of whether a person is responsible.
Sources
- Terrorism (Protection of Premises) Act 2025, sections 4, 8, 10 and 11 (legislation.gov.uk)
- Terrorism (Protection of Premises) Act 2025: Statutory guidance, chapter 6 and correction slip (Home Office)
- Terrorism (Protection of Premises) Act: principal use of premises (Home Office)
- Understanding Martyn's Law and the SIA's role as regulator (SIA)
General information based on the Act and published guidance, not legal advice. Check the official statutory guidance on GOV.UK for your situation.