What Is Martyn's Law? What It Means for UK Businesses

When You Book Multiple Courses.

Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025. It requires the people responsible for certain publicly accessible premises and events to be prepared to keep people safe if a terrorist attack happens, and requires larger ones to reduce their vulnerability to attack as well. The Act became law on 3 April 2025, but its main duties are not yet in force: they are expected to start in spring 2027, and the regulator will be the Security Industry Authority (SIA).

This guide draws on the Home Office statutory guidance and government factsheets.

Why is it called Martyn’s Law?

The law is named in memory of Martyn Hett, one of 22 people killed in the Manchester Arena terrorist attack. It follows years of campaigning by his mother, Figen Murray OBE. The government first consulted on the idea in 2021 under the name Protect Duty.

When does Martyn’s Law come into force?

The Act received Royal Assent on 3 April 2025, and the Home Office has committed to an implementation period of at least 24 months from that date. The SIA says the law is expected to come into force in spring 2027, and the Home Office will confirm the exact date through Parliament. Until the duties are commenced by regulations, there is no legal requirement to comply. Here is where things stand:

Date	What happened
3 April 2025	Royal Assent: the Terrorism (Protection of Premises) Act 2025 becomes law
10 April 2026	Section 27 (statutory guidance) brought into force
15 April 2026	Home Office publishes the section 27 statutory guidance; the SIA consults on its own draft guidance
15 June 2026	Provisions on SIA guidance and its statement on worldwide revenue brought into force
14 July 2026	Notification Requirements Regulations 2026 laid, setting out how premises and events will notify the SIA
Spring 2027 (expected)	Main duties expected to start, with the exact date to be confirmed through Parliament

Which premises are covered?

Under section 2 of the Act, premises are in scope if they meet all of these conditions:

they consist of a building, or a building and other land (a building includes part of a building or a group of buildings)
they are wholly or mainly used for one or more uses listed in Schedule 1 of the Act
it is reasonable to expect that 200 or more people, including staff, may be present at the same time from time to time
they are not excluded premises

The Schedule 1 uses include shops, food and drink, entertainment and leisure, sports grounds, libraries, museums and galleries, halls, visitor attractions, hotels, places of worship, health care, bus and railway stations, aerodromes, childcare, schools, further and higher education, and public authorities. Excluded premises include the Houses of Parliament and devolved legislatures, open parks and recreation grounds without access controls, and transport premises already covered by other security laws.

Events can also be in scope. A qualifying event must be open to the public, have entry checks such as tickets or wristbands, and reasonably expect 800 or more people (including staff) at the same time at some point (events factsheet).

Standard tier and enhanced tier

	Standard tier	Enhanced tier
Who	Qualifying premises where 200 to 799 people (including staff) may be present at the same time	Premises where 800 or more people may be present, and qualifying events
Notify the SIA	Yes	Yes
Public protection procedures	Yes, so far as reasonably practicable	Yes, so far as reasonably practicable
Public protection measures	No	Yes, so far as reasonably practicable
Designate a senior individual	No	Yes, where the responsible person is an organisation
Compliance document for the SIA	No	Yes
Maximum penalty	£10,000	£18 million or 5% of qualifying worldwide revenue, whichever is greater

Premises used for childcare, primary or secondary education, further education or as a place of worship are always treated as standard tier, even if 800 or more people may be present.

What standard tier premises must do

Every qualifying premises and event must have appropriate public protection procedures: the actions staff take if they suspect a terrorist attack is happening or about to happen nearby. There are four types:

Evacuation: getting people away from danger by moving them out of the premises or part of it.
Invacuation: moving people to a safer place inside the premises, which can include bringing people in from outside.
Lockdown: securing the premises to stop people entering or leaving, for example by locking doors or closing shutters.
Communication: alerting people to danger quickly and telling them what to do.

The Act does not require physical alterations or new equipment for these procedures, and there is no statutory training requirement. Staff with a role in carrying them out must be made aware of the procedures and their part in them. In the government’s own example, a shop of about 200 people covers this with a one-page summary and a staff room poster.

What enhanced tier premises and events must also do

On top of the procedures, enhanced tier premises and qualifying events need appropriate public protection measures to reduce their vulnerability to attack. These cover monitoring (for example awareness material or CCTV), movement (such as bag checks, screening or barriers), physical safety and security (such as stand-off zones, safety glass or hostile vehicle mitigation) and security of information (such as keeping floor plans secure). They must also designate a senior individual where the responsible person is an organisation, and prepare a compliance document, keep it up to date and send it to the SIA, with any revised version sent within 30 days.

Notifying the SIA

All responsible persons must notify the SIA using its online portal. Under the notification guidance, those responsible for qualifying premises when the requirement starts will have three months to notify, and changes must then be reported within 28 days. For qualifying events, the general rule is to notify within 14 days of the event date first being publicised.

The regulator and penalties

The SIA will support and advise first, but it can inspect (usually with at least 72 hours’ written notice), require information and issue compliance notices, restriction notices for enhanced tier premises and events, and penalty notices. Section 18 sets the maximum penalties shown in the table above. Daily penalties of up to £500 (standard) or £50,000 (enhanced) can follow if a notice is still not complied with, and there is a right of appeal to the Tribunal.

How Martyn’s Law fits with fire safety

The statutory guidance makes clear that the Act does not replace other legislation, including fire safety law. It also warns that terrorism plans may need to differ from fire plans. One example is a church whose fire assembly point is an open area outside: in a suspected attack, that same spot could be a target, so the terrorism procedure tells people to disperse in several directions instead. Your fire risk assessment and fire evacuation duties carry on exactly as before.

If your fire wardens will also help with these procedures, make sure the fire side is solid first. Target Zero’s Fire Warden and Fire Marshal course covers emergency evacuation and fire assembly for those roles. It is a fire safety course, not Martyn’s Law compliance.

What to do now

Work out the most people, including staff, you can reasonably expect on site at the same time, and check whether your main use is in Schedule 1.
Think through evacuation, invacuation, lockdown and communication for your building, and how staff would be told.
Watch for the SIA notification portal and the confirmed start date.

The government says premises and events should be able to comply without buying specialist services, and ProtectUK offers free resources such as ACT Awareness e-learning.

FAQs

What is Martyn’s Law in simple terms?

A UK law that makes those responsible for larger public premises and events plan how to keep people safe in a terrorist attack. Bigger venues and events must also make themselves harder to attack.

When does Martyn’s Law come into force?

The Act became law on 3 April 2025 with an implementation period of at least 24 months. The SIA expects it to come into force in spring 2027, and the exact date will be confirmed through Parliament.

Does Martyn’s Law apply to my business?

It applies if your premises are mainly used for a listed use, such as a shop, restaurant, hotel, museum or entertainment venue, and 200 or more people including staff may be there at the same time. Public events with entry checks and 800 or more people are also covered.

Who enforces Martyn’s Law?

The Security Industry Authority (SIA) is the regulator. It can inspect, issue compliance and restriction notices and impose penalties.

What are the penalties under Martyn’s Law?

Up to £10,000 for standard tier premises, and up to £18 million or 5% of qualifying worldwide revenue, whichever is greater, for enhanced tier premises and qualifying events.

Is Martyn’s Law the same as the Protect Duty?

Protect Duty was the name of the government’s 2021 consultation on the idea. The law that was eventually passed is the Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law.

Martyn’s Law adds to your duties; it does not replace fire safety. If your fire wardens need to be confident leading an evacuation, see our Fire Warden and Fire Marshal course or call 0333 444 0018.