Martyn’s Law: What Does It Mean for UK Businesses?

The Terrorism (Protection of Premises) Act 2025, widely known as Martyn’s Law, introduces new legal requirements intended to strengthen preparedness and protective security at certain publicly accessible premises and events across the UK.

The Act received Royal Assent on 3 April 2025. While its requirements are not yet in force, organisations that may fall within its scope now have an opportunity to understand what will be expected of them and begin considering their preparedness.

For businesses responsible for public-facing premises, the first questions are relatively straightforward: Does Martyn’s Law apply to us? If it does, which tier are we in? And what will we need to have in place?

The story behind Martyn’s Law

On 22 May 2017, a terrorist attack took place at Manchester Arena following an Ariana Grande concert. Twenty-two people were killed, including 29-year-old Martyn Hett, and many more were injured. 

Following the attack, the Manchester Arena Inquiry examined the circumstances surrounding the incident and the emergency response.

Martyn Hett’s mother, Figen Murray, subsequently campaigned for legislation designed to improve security and preparedness at publicly accessible venues. The UK Government has described her campaigning as crucial in driving the legislation forward. martyns law prestige social

That legislation became the Terrorism (Protection of Premises) Act 2025.

What is Martyn’s Law?

Martyn’s Law is designed to improve protective security and organisational preparedness across the UK.

At its core, the legislation requires those responsible for qualifying premises and events to consider how they would respond if a terrorist attack occurred. Larger qualifying premises and events face additional requirements relating to measures intended to reduce vulnerability and the risk of physical harm.

Importantly, the legislation applies across England, Wales, Scotland and Northern Ireland.

The framework is proportionate: the requirements placed on a smaller qualifying premises are different from those applying to a large venue or event.

Who will Martyn’s Law affect?

Not every business or publicly accessible location automatically falls within the Act.

According to the Home Office, premises must meet four conditions to be within scope. Among them, the premises must be wholly or mainly used for a purpose specified by the legislation, must not fall within an applicable exclusion, and it must be reasonable to expect at least 200 people, including staff, to be present at the same time from time to time.

The Act then establishes two principal tiers.

Standard tier: 200-799 people

A qualifying premises falls within the standard tier where it is reasonable to expect between 200 and 799 people, including staff, to be present at the same time.

This can include qualifying premises used for purposes such as hospitality, entertainment, retail and community activities, depending on the particular circumstances and statutory criteria.

Enhanced tier: 800+ people

Where it is reasonable to expect 800 or more people, including staff, a qualifying premises will generally fall within the enhanced tier, subject to the provisions and exceptions in the Act.

The enhanced tier carries additional obligations because of the greater number of people potentially exposed to harm.

What about events?

The legislation doesn't apply only to permanent venues.

Certain public events can also qualify where it is reasonable to expect 800 or more people to be present at the same time and other statutory conditions are met.

Among those conditions, the event must be accessible to the public and have measures in place to check that attendees satisfy an entry condition, for example, holding a ticket or pass, making a payment, or being a member or guest of an applicable organisation.

This distinction matters for organisations that operate or support concerts, festivals, sporting events and other large public gatherings.

What will standard-tier premises need to do?

For standard-tier premises, Martyn’s Law focuses primarily on preparedness and procedures.

Once the requirements come into force, the responsible person will need to notify the Security Industry Authority (SIA) of the premises and have appropriate public protection procedures in place, so far as reasonably practicable.

Those procedures concern four particularly important areas, also highlighted in Synergy Prestige's original guide: martyns law prestige social

• Evacuation - getting people safely out of the premises.

• Invacuation - moving people to a safer place within the premises.

• Lockdown -securing the premises against an attacker.

• Communication - ensuring people on the premises can be alerted to danger and given appropriate information.

These aren't simply documents to have sitting in a folder. Effective procedures need to make sense for the particular premises and for the people expected to implement them.

The Home Office describes the standard-tier requirements as centred around simple, low-cost activities, with costs expected to relate primarily to staff time.

What changes for enhanced-tier premises?

Enhanced-tier premises and qualifying events must meet the core requirements applying to qualifying premises, but the Act goes further.

The responsible person will also be required, so far as reasonably practicable, to put appropriate public protection measures in place that could reasonably be expected to reduce both the premises or event's vulnerability to terrorism and the risk of physical harm should an attack occur there or nearby.

The relevant procedures and measures will also need to be documented and provided to the SIA, including an assessment of how they reduce vulnerability and/or the risk of harm.

Where the responsible person is an organisation rather than an individual, a senior individual must also be designated with responsibility for ensuring that the organisation complies with the relevant requirements.

Who is responsible?

One of the most important questions for businesses is identifying the responsible person.

For qualifying premises, this will generally be the individual, company or organisation that has control of the premises in connection with its relevant use.

For qualifying events, it is the person or organisation controlling the premises in connection with their use for that particular event. This can therefore be different from whoever normally controls the site.

Tasks can be delegated to employees or service providers, but the Home Office makes clear that the responsible person cannot delegate the underlying legal responsibility to a contracted service provider.

When does Martyn’s Law come into force?

The Act is already law, but its substantive requirements are not yet in force.

The Government intends there to be an implementation period of at least 24 months from Royal Assent on 3 April 2025. This period is intended to give organisations time to understand their obligations and prepare, while allowing the SIA's new regulatory function to be established.

The Government published statutory guidance on 15 April 2026 to help responsible persons understand the requirements and how they may be met in practice.

There is currently no legal requirement to comply before commencement. However, the Home Office explicitly notes that organisations likely to fall within scope may wish to start considering the requirements during the implementation period.

What should businesses be doing now?

For organisations operating public-facing premises or events, preparation begins with understanding the basics.

Establish whether your premises or events are likely to fall within scope. Consider the number of people, including staff, that could reasonably be expected to be present at the same time. Identify who would be the responsible person and review the procedures already in place for evacuation, invacuation, lockdown and communication.

For larger premises and events, the conversation also needs to include vulnerability, protective measures, monitoring and how those measures will eventually be documented.

Existing information can be useful when assessing expected occupancy. The Home Office specifically notes that organisations may use methods they already understand, including fire-safety occupancy calculations and historic attendance data.

Preparation, not panic

Martyn’s Law represents an important change for many organisations responsible for publicly accessible premises and events, but preparation should be proportionate to the premises and its circumstances.

It is also important to distinguish legal requirements from commercial services being offered around them. The Home Office specifically states that businesses do not need to spend money on consultants in order to comply, and neither the Home Office nor the SIA endorses third-party products marketed for Martyn’s Law compliance.

For businesses, the sensible starting point is therefore not purchasing a particular product.

It is understanding your responsibilities, reviewing existing arrangements and identifying where genuine gaps exist.

How Synergy Prestige can support your wider security planning

For organisations reviewing their security arrangements ahead of Martyn’s Law, this is also an opportunity to consider how existing people, procedures and physical security measures work together.

Synergy Prestige can support organisations with their wider security requirements and help businesses consider practical security arrangements appropriate to their premises and operations.

The objective should not simply be preparing for legislation. It should be creating an environment in which staff understand what to do, security arrangements are appropriate to the risks, and people using the premises are better protected.

For authoritative information on the legislation and its requirements, businesses should always refer to the official Martyn's Law Factsheet or The Terrorism (Protection of Premises) Act 2025