In short: Martyn’s Law is the Terrorism (Protection of Premises) Act 2025. It received Royal Assent on 3 April 2025 and applies across the UK [1]. Premises for 200–799 people are standard tier: notify the Security Industry Authority (SIA) and have evacuation, invacuation, lockdown and communication procedures. Premises for 800+, and entry-checked public events of 800+, are enhanced tier: they must also put security measures in place and send a compliance document to the SIA [2][3]. The SIA expects the law to come into force in spring 2027 [3].
What is Martyn’s Law?
Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025 (2025 c. 10). It is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in May 2017. His mother, Figen Murray, campaigned for years for a legal duty on venues to prepare for terrorism [2][3].
The Act does not ask you to predict an attack. It assumes one could happen anywhere and requires those responsible for certain premises and events to be ready to reduce harm. Larger sites must also reduce their vulnerability [2].
You may also see “Protect Duty”, the working name used for the government’s 2021 consultation [9].
Who does Martyn’s Law apply to?
Duties fall on the “responsible person”: whoever controls the qualifying premises or event, usually the occupier who decides how the site is run [2][3]. You can use a security adviser, but responsibility stays with you [3].
Qualifying premises
Premises are in scope if all of these apply [1][3]:
- They include a building, part of a building or a group of buildings.
- They are wholly or mainly used for a purpose listed in Schedule 1. Examples include retail, food and drink, entertainment and leisure, visitor attractions, sports grounds, places of worship, healthcare, childcare and education.
- 200 or more people, including staff, can reasonably be expected to be present at the same time, from time to time.
- They are not excluded under Schedule 2.
The test is the number you can reasonably expect at busy times, not your fire-safety capacity. In a Home Office example, a clothing shop with a fire-safety occupancy of 300 that has gone over 200 on several occasions during Black Friday and the January sales is in scope [2].
Qualifying events
An event is a qualifying event if all of these apply [2][3]:
- It is open to the public.
- There are entry checks, such as tickets, passes, payment or membership.
- 800 or more people, including staff, can reasonably be expected to be present at the same time.
- It is not held at enhanced tier premises.
- It is not held at excluded premises. Events at places of worship, childcare settings, and primary, secondary or further education premises can never be qualifying events.
Events on open land, such as a fenced festival site, can qualify.
The two tiers: standard and enhanced
| Duty | Standard tier | Enhanced tier and qualifying events |
|---|---|---|
| Who | Premises where 200–799 people may be present at the same time | Premises where 800+ people may be present at the same time, plus qualifying events (800+) |
| Notify the SIA | Yes | Yes |
| Public protection procedures | Yes | Yes, and keep them under review |
| Public protection measures | Not required | Yes |
| Compliance document sent to the SIA | Not required | Yes |
| Senior individual (if an organisation) | Not required | Yes |
| Maximum non-compliance penalty | £10,000 | £18 million or 5% of qualifying worldwide revenue, whichever is greater |
Special rule for places of worship and education. Some premises always stay in the standard tier, even with 800 or more people present. These are places of worship, childcare settings, and primary, secondary and further education. Higher education, such as universities, follows the normal thresholds and can be enhanced tier [2][6].
Standard tier duties
If you run standard tier premises, you must do two things [1][2][3].
- Notify the SIA that you are the responsible person, and tell it if you stop being responsible. You will do this through an online portal the SIA is building. The rules are set out in the Notification Requirements Regulations 2026 [5].
- Have appropriate public protection procedures, so far as is reasonably practicable. These are the actions staff would take if they suspected an attack on the premises or in the immediate vicinity:
- Evacuation: moving people out of danger.
- Invacuation: moving people to a safer place inside.
- Lockdown: securing the premises so people cannot get in or out.
- Communication: getting information to people quickly.
“Reasonably practicable” means proportionate. You weigh what a procedure achieves against its cost, time and difficulty [2][3]. The standard tier does not require physical security measures or new equipment. The Home Office describes these duties as “simple, low-cost activities” [7].
Enhanced tier and qualifying event duties
Enhanced tier premises and qualifying events must meet all the standard tier duties, plus the following [1][2][3].
- Public protection measures, so far as is reasonably practicable, covering four areas:
- monitoring, for example staff vigilance or CCTV
- movement into, out of and within the site, for example access control or searches
- physical safety and security, for example protection against a vehicle being used as a weapon
- security of information about the site and how it operates.
- A compliance document. This sets out your procedures and measures, with an assessment of how each one reduces harm and vulnerability. You send it to the SIA as soon as reasonably practicable once it is first prepared, and again within 30 days of any revision [2].
- A senior individual. If the responsible person is an organisation, it must name someone involved in its management or control to oversee compliance [2][3].
- Regular review of procedures and measures. Anyone else with some control of the site, such as a promoter hiring the venue, must cooperate [2].
The Act does not specify equipment such as search arches or barriers. You decide what is appropriate and reasonably practicable for your site, and explain your reasons in the compliance document [2].
When does Martyn’s Law come into force?
- 3 April 2025: Royal Assent [1].
- At least 24 months: the government has committed to this minimum implementation period, so no duties can start before 3 April 2027 [2][5].
- 15 April 2026: the Home Office published its statutory guidance under section 27 [5].
- 15 April to 12 June 2026: the SIA consulted on its own guidance. It says the final version will be published in autumn 2026 [3].
- Early 2027: the SIA plans to invite volunteers to test its notification portal [3].
- Spring 2027 (expected): the SIA expects the Act to come into force and will confirm the exact date in advance [3].
As of October 2026 the duties are not yet enforceable, but the guidance is published, so you can prepare now [2][4].
Penalties and enforcement
The SIA regulates Martyn’s Law through desk-based assessments and inspections, normally with at least 72 hours’ notice [3]. It can issue compliance, restriction and penalty notices [1][2].
- Standard tier: non-compliance penalty of up to £10,000, plus daily penalties of up to £500 for ongoing breaches of a notice [1][2].
- Enhanced tier and qualifying events: up to £18 million or 5% of qualifying worldwide revenue, whichever is greater, plus daily penalties of up to £50,000 [1][2].
- Failing to attend an interview when required: up to £5,000 [2].
- Criminal offences include failing to comply with an enhanced tier compliance notice or any restriction notice, and knowingly or recklessly giving the SIA false or misleading information, which applies to anyone who provides it, not only the responsible person. On conviction on indictment, these can carry an unlimited fine and up to two years’ imprisonment. Failing to comply with an SIA information notice is a separate, summary-only offence with an unlimited fine in England and Wales [2].
The SIA says it will focus on whether you took reasonable steps for your circumstances [3].
Martyn’s Law for events vs venues
Venues and events are treated differently [2].
- Venues are judged by what normally happens there. If a venue reaches 800 even a few nights a year, it is enhanced tier, and events held there come under the venue’s own duties.
- A one-off event of 800 or more at a smaller venue is usually a qualifying event. The organiser who controls the space for the event is the responsible person.
- Events have no standard tier. A public event with fewer than 800 people present at the same time is not a qualifying event, although the venue hosting it may be in scope in its own right.
- Timed entry counts. If staggered entry means fewer than 800 people are expected at the same time, the event is not a qualifying event.
- Private, invitation-only events are not publicly accessible. A wedding reception for invited guests is one example.
- Open streets and towpaths without entry checks are outside the Act, unless they form the immediate vicinity of a site that is in scope.
- Shared sites need coordination. Where there is more than one responsible person, they must work together.
Safety Advisory Group (SAG) processes continue; Martyn’s Law adds a counter-terrorism layer your event safety plan should reflect.
Martyn’s Law for schools
Schools are in the standard tier if 200 or more people (pupils and staff) may be present at the same time. They stay in the standard tier however large they are [2][6]. The same applies to childcare and further education. Events held at these premises are not qualifying events, even when 800 or more people attend [2].
In practice, schools must notify the SIA and make sure their evacuation, invacuation, lockdown and communication procedures work for a terrorist incident. Many already have similar procedures through existing safety and safeguarding rules [2]. Universities can be enhanced tier [6]. If you hire out school premises, the school’s responsible person stays responsible. The Home Office’s worked example for a hired place of worship, which sits in the same special-consideration category, says responsibility cannot be delegated under the Act but the hire agreement can bind the hirer to carry out public protection duties [2].
Martyn’s Law training: is it required?
The Act contains no statutory requirement for specific counter-terrorism training [2]. However, a procedure only counts as “in place” if the staff who carry it out know about it and can act on it. The guidance says it would be hard to show compliance if those staff have not been informed or trained [2].
Inductions, briefings, e-learning and exercises all count. ProtectUK and NPSA offer free options, including ACT Awareness e-Learning (around 45 minutes), ACT for Education and SCaN (See, Check and Notify) [8]. Keep a record of who was trained, on what and when.
Martyn’s Law compliance checklist
- Check your scope. Work out the most people, including staff, you can reasonably expect at the same time [2][3].
- Identify your tier. You will be standard (200–799), enhanced (800+) or a qualifying event (800+ with entry checks). Remember the special rule for places of worship and education.
- Confirm the responsible person. If you are an organisation in the enhanced tier, also name your senior individual.
- Map your immediate vicinity. Include queues, forecourts, car parks and dispersal routes.
- Write your four procedures. Cover who decides, how staff are alerted and how the public is told.
- Coordinate with landlords, neighbours, promoters and contractors.
- Brief and train staff on their roles, and keep records.
- Exercise your procedures, such as a tabletop walk-through or lockdown drill.
- Enhanced tier only: assess your vulnerabilities and decide on monitoring, movement, physical security and information security measures. Record any measures you are deferring and the reasons.
- Enhanced tier only: prepare your compliance document for the SIA.
- Be ready to notify the SIA when its portal opens.
- Set review points, for example annually, after a layout change or after an incident.
How SafetyDocs helps
Much of Martyn’s Law comes down to good organisation: clear procedures, the current version in the right hands, and evidence of what you did. SafetyDocs is built for that kind of work.
- One set of current documents. You can build event safety plans and risk assessments from templates. Master details, such as contacts, roles and site information, update across every linked document.
- Procedures on staff phones. Stewards and supervisors can open the current version in the SafetyDocs mobile app.
- Evidence when asked. The audit trail records edits and approvals, and incident reports are time-stamped. Both help you show the SIA, your SAG or your insurer what was in place.
- Contractor paperwork for venues. Event Compliance Management collects and tracks RAMS, insurance and training records.
- A free first step. Our Venue Threat Assessment helps you think through your vulnerabilities.
Software doesn’t make you compliant; that rests with the responsible person. SafetyDocs keeps the work current, shared and easy to evidence.
Frequently asked questions
What is Martyn’s Law?
Martyn’s Law is the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025. It requires those responsible for certain public premises and events to prepare for a terrorist attack and reduce harm. It is named after Martyn Hett, killed in the 2017 Manchester Arena attack.
When does Martyn’s Law come into effect?
The SIA expects the Act to come into force in spring 2027 and will confirm the date in advance. The government committed to at least 24 months after Royal Assent on 3 April 2025, so commencement cannot come before 3 April 2027.
Is Martyn’s Law the same as the Protect Duty?
Yes. “Protect Duty” was the working name used during consultation. The law that passed is the Terrorism (Protection of Premises) Act 2025.
What are the Martyn’s Law enhanced tier requirements?
Enhanced tier premises and qualifying events must do everything required in the standard tier. They must also:
- put in place appropriate monitoring, movement, physical security and information security measures
- keep their procedures and measures under review
- send a compliance document to the SIA
- name a senior individual if the responsible person is an organisation.
What are Martyn’s Law event requirements?
Public events with entry checks and 800+ people (including staff) expected at the same time must meet enhanced tier duties, unless held at enhanced premises. Private, invitation-only events are not covered.
What are Martyn’s Law venue requirements?
Venues where 200–799 people may be present must notify the SIA and have evacuation, invacuation, lockdown and communication procedures. Venues where 800 or more may be present must also put security measures in place and send a compliance document to the SIA.
Does Martyn’s Law apply to schools?
Yes. Under the Terrorism (Protection of Premises) Act 2025, schools, colleges and childcare settings that can reasonably expect 200 or more people (including staff) at the same time are in scope. They always sit in the standard tier, even if 800 or more people attend, so the enhanced tier duties never apply. Events held at these premises cannot become qualifying events either. The responsible person is whoever controls the premises, typically the governing body, and this responsibility cannot be passed to an event organiser who hires the site.
Is Martyn’s Law training mandatory?
No specific training is required by law, but staff must know your procedures or compliance will be hard to show.
How do I comply with Martyn’s Law?
- Confirm your tier.
- Confirm who the responsible person is.
- Prepare your four public protection procedures and brief staff on them.
- Get ready to notify the SIA.
- If you are in the enhanced tier, also add security measures, prepare a compliance document and name a senior individual.
What are the penalties under Martyn’s Law?
- Standard tier: up to £10,000.
- Enhanced tier premises and qualifying events: up to £18 million or 5% of qualifying worldwide revenue, whichever is greater.
- Daily penalties and criminal offences: these can also apply in some cases.
Who regulates Martyn’s Law?
The Security Industry Authority (SIA).
Sources
- Terrorism (Protection of Premises) Act 2025, legislation.gov.uk. https://www.legislation.gov.uk/ukpga/2025/10/contents
- Home Office, Terrorism (Protection of Premises) Act 2025: statutory guidance (section 27), GOV.UK. https://www.gov.uk/government/publications/the-terrorism-protection-of-premises-act-2025/terrorism-protection-of-premises-act-2025-statutory-guidance
- Security Industry Authority, Understanding Martyn’s Law and the SIA’s role as regulator (published 17 July 2026), GOV.UK. https://www.gov.uk/guidance/understanding-martyns-law-and-the-sias-role-as-regulator
- Security Industry Authority, Martyn’s Law: scope, support and what’s next (11 September 2026), GOV.UK. https://www.gov.uk/government/news/martyns-law-scope-support-and-whats-next
- Explanatory Memorandum to the Terrorism (Protection of Premises) (Notification Requirements) Regulations 2026 (SI 2026/793), legislation.gov.uk. https://www.legislation.gov.uk/uksi/2026/793/pdfs/uksiem_20260793_en_001.pdf
- Department for Education, How Martyn’s Law will affect education settings, GOV.UK. https://www.gov.uk/government/publications/martyns-law-for-education-settings/how-martyns-law-will-affect-education-settings
- Home Office, Martyn’s Law factsheet, Home Office in the media blog. https://homeofficemedia.blog.gov.uk/2025/04/03/martyns-law-factsheet/
- ProtectUK, Free training and awareness resources and ACT Awareness e-Learning. https://www.protectuk.police.uk/free-training-and-awareness-resources and https://www.protectuk.police.uk/group/130
- Home Office, Protect Duty consultation (26 February to 2 July 2021) and Government publishes Protect Duty consultation findings (10 January 2022), GOV.UK. https://www.gov.uk/government/consultations/protect-duty and https://www.gov.uk/government/news/government-publishes-protect-duty-consultation-findings
This page is general guidance, not legal advice. Last reviewed: 9 October 2026.
