Martyn’s Law
The Terrorism (Protection of Premises) Act 2025 (the Act) —commonly referred to as Martyn’s Law—received Royal Assent on 3 April 2025. Named after Martyn Hett one of 22 people who died at the Manchester Arena bombing in May 2017, Martyn’s Law is designed to improve the preparedness of public venues in the event of a terrorist attack. Its purpose is to ensure that practical steps are taken to minimise both physical harm and the wider impact of such incidents.
This legislation mandates that venues with a capacity of 200 or more must have a formal plan in place to respond effectively in the event of a terrorist attack. For the first time, the law places a clear responsibility on designated individuals or organisations to assess the risk of terrorism and outline how they would respond. The aim is to promote a consistent approach to preparedness and responsibility across all applicable premises and events.
The intention is for duty holders to be supported with straightforward, accessible guidance that requires no specialist knowledge to implement. The Security Industry Advisor will serve as regulator, overseeing compliance and providing support and to help venue owners and event organisers meet the requirements of the law and keep the public safe.
Royal Assent
The Act received Royal Assent on 3 April 2025, although the Government has confirmed there will be an implementation period of two years before the Act comes into force. The Home Office has indicated that it will publish statutory guidance during the 24-month implementation period to help those responsible to implement the legislation. The intention is that the legislation will be implemented by duty holders who will make straightforward practical assessments as to meeting the requirements without need for complex professional intervention and advice.
Identify Qualifying Premises
The legislation introduces a tiered framework – a standard and an enhanced duty– based on the nature of a premises’ use and the number of individuals reasonably expected to be present at the premises at any one time. Requirements are intended to be proportionate to the potential impact of a terrorist attack, with larger venues and events expected to implement more robust protective measures. The first step is to determine whether premises fall under the standard or enhanced tier—or whether they are excluded entirely.
Qualifying Premises, which are subject to the new standard or enhanced measures, must be wholly or mainly used for one or more of the Qualifying Purposes, which encompass a wide range of public-facing commercial spaces:
- Retail premises, including the sale or display of goods and the provision of services to the public
- Food and drink establishments, where consumption primarily takes place on the premises
- Sports grounds
- Libraries, museums, and galleries open to the visiting public
- Halls used for events, activities, conferences, or exhibitions
- Visitor attractions of cultural, historic, or educational significance
- Hotels, hostels, and holiday parks
- Places of worship
- Hospitals and healthcare facilities
- Bus and railway stations
- Airports
- Childcare facilities
- Further and higher education venues (universities and post-16 education facilities)
Under the new legislation, organisations or individuals responsible for Qualifying Premises—such as entertainment venues, large retail outlets, and public spaces with a capacity of 200 or more people—are required to take appropriate and proportionate steps to reduce the risk of terrorist attacks. The law introduces a two-tiered system of duties based on venue capacity:
The Standard Duty applies where it is reasonable to anticipate between 200 and 799 people may be present at one time in connection with a Qualifying Purpose. When the requirements take effect, those responsible for implementing the Standard Duty must:
- Notify the regulator (the Security Industry Authority) that the premises are Qualifying Premises; and
- Implement public protection procedures as far as reasonably practicable.
These procedures—such as plans for evacuation, lockdown, and communication in the event of an emergency—are designed to reduce the risk of physical harm during or near a terrorist incident. The Standard Duty focuses on straightforward, low-cost actions, with no obligation to install physical security measures. Compliance is primarily time-based rather than financial.
The Enhanced Tier applies where it is reasonable to anticipate 800 or more people may be present simultaneously in connection with a Qualifying Purpose. In addition to meeting the Standard Duty a senior person must be identified who is responsible for the following:
- Implementing appropriate public protection measures, so far as reasonably practicable, to reduce both (i) the vulnerability of the premises or event to a terrorist attack, and (ii) the risk of physical harm to individuals in the event of an attack. This includes monitoring the Qualifying Premises and their immediate surroundings;
- Prepare and maintain documentation outlining the public protection procedures and measures in place including an assessment of how these are expected to reduce vulnerability and/or risk. This document must be provided to the Security Industry Authority by the responsible senior person.
Oversight, Guidance & Enforcement
The Security Industry Authority will serve as the regulator under the Act, with responsibility for investigating suspected non-compliance and, where necessary, taking enforcement action.
The Government has emphasised that the Security Industry Authority’s core role is to advise, support and guide those responsible for implementing these changes and meeting their legal obligations under the Act. Guidance as to the Standard and Enhanced Tier Duties is anticipated in due course and property owners are assured it has been designed to be straightforward to follow and implement.
Dr Emily Carroll
University of Birmingham