Martyn's Law explained: what the Terrorism (Protection of Premises) Act 2025 means for your venue

The Terrorism (Protection of Premises) Act 2025 is known as Martyn's Law. It is named after Martyn Hett, who was killed in the Manchester Arena attack on 22 May 2017, and his mother, Figen Murray, campaigned for it. The Act received Royal Assent on 3 April 2025.

The Act makes whoever controls certain public premises responsible for being prepared. It does not ask you to prevent an attack or to become a security expert. Its objective, in the words of section 5, is to reduce the risk of physical harm to people if an act of terrorism were to occur on the premises or in the immediate vicinity.

The Home Office published statutory guidance on the Act, with three supplementary documents, on 15 April 2026. The Security Industry Authority (SIA) will regulate it.

Premises are covered, as "qualifying premises", only if all three of the following are true and they are not in one of the excluded categories below.

The three tests

1. 01It is a building, or a building with land. The Act covers a building, part of a building, a group of buildings, or a building together with other land. A beer garden, a car park or a churchyard can form part of the premises.
2. 02It is wholly or mainly used for a listed use. Schedule 1 of the Act lists the uses covered, including shops and services, food and drink, entertainment and leisure, sports grounds, halls for hire, visitor attractions, hotels, places of worship, health care, childcare, schools, further and higher education, and public authority buildings open to the public. The full list of covered buildings gives everyday examples of each.
3. 03It is reasonable to expect 200 or more people there at the same time, from time to time. The count includes staff, contractors and volunteers as well as the public. It is your busiest regular period, not your average and not a one-off that will not happen again. Our guide on how to work out your capacity explains the six methods the Home Office describes.

People still count as visiting members of the public if they have had to pay, hold a ticket or pass, or be a member or guest of a club.

What is not covered

Schedule 2 of the Act excludes a short list of premises. The main ones for everyday venues are open-air parks, gardens, recreation grounds, non-designated sports grounds and other open-air leisure spaces where there are no checks on entry (payment, tickets or membership). Parliament and the devolved legislatures, and transport premises already covered by aviation, rail, Channel Tunnel or port security regimes, are also excluded.

A building used mainly for something not on the list, such as a factory or private offices, is not covered, although a listed part, such as a factory shop, is assessed on its own.

Qualifying events

Separately from premises, an event can be a "qualifying event" if it is held somewhere that is not enhanced tier premises, 800 or more people are expected at some point, the public have access, and there are checks on entry such as tickets or payment. Qualifying events carry enhanced duties. Events held at places of worship, childcare settings, schools and further education colleges cannot be qualifying events.

Covered premises fall into one of two tiers, depending on the number of people reasonably expected at the same time.

Places of worship and education settings are standard tier at any size

Four kinds of premises stay in the standard tier however many people attend: places of worship, nurseries and other childcare settings, primary and secondary schools, and further education colleges. A cathedral that holds 2,000 people, or a secondary school of 1,500 pupils, has standard tier duties. Universities and other higher education institutions do not get this treatment and can be enhanced tier.

This guide, and our Standard Tier Pack, are written for the standard tier. If you expect 800 or more and are not one of those four kinds of premises, you have further duties, and you should read the government guidance and consider professional help.

The standard tier has two legal duties, and the statutory guidance adds a practical expectation about the people who will carry the procedures out.

Notify the SIA

Once the Act is in force, the responsible person must tell the SIA about the premises and that they are responsible for them. You must update the SIA if you stop being responsible, if someone else becomes responsible, or if information you have given stops being accurate. The SIA is building an online portal for notification and has said it will invite volunteers to test it from early 2027. You cannot notify until the Act is in force, but you can prepare the information now with a responsible person and SIA notification record.

Have public protection procedures in place

The responsible person must ensure, so far as is reasonably practicable, that appropriate public protection procedures are in place. These are the steps the people working at your premises would follow if they had reason to suspect an attack was happening or about to happen. The Act sets out four kinds:

• Evacuation: moving people out of the premises. See the evacuation procedure.
• Invacuation: moving people to a safer place inside the premises, away from danger outside. See the invacuation procedure.
• Lockdown: securing the premises, or part of them, so that people cannot enter or leave. See the lockdown procedure.
• Communication: giving people on the premises the information they need about what to do. See the communication procedure.

The procedures should take account of an attack in the immediate vicinity, not only inside the building. The statutory guidance says there is no fixed distance for this, and gives the example of the public pavement outside a music venue.

Make sure your people can carry them out

A procedure that exists only on paper is not enough. The statutory guidance says procedures must be capable of being put into practice rapidly and effectively, which means staff and volunteers need to be aware of them and know how to carry them out. There is no mandatory training course at standard tier. A short staff briefing sheet and a briefing and review log are a practical way to do this and to show that you have.

Free ACT Awareness e-learning, which covers recognising and responding to a terrorist incident, is available from ProtectUK for staff and members of the public.

What the standard tier does not require

The standard tier does not require physical security measures such as barriers, CCTV or bag searches, and it does not require professional security advice. It also does not legally require a written document. However, the statutory guidance says it is good practice for even the simplest procedures to be documented, and a written set is far easier to brief, review and explain to the SIA than one held in someone's head. Our public protection procedures document is designed to be that written set.

The duty is not absolute. The statutory guidance explains that "so far as reasonably practicable" involves weighing how effective a particular procedure is likely to be against the burden of putting it in place. A village hall run by volunteers is not expected to do what a large stadium does.

In practice your procedures should fit your building and be realistic for the staff or volunteers you actually have on a busy day. Where you decide something is not practicable, write down why.

The responsible person is whoever has control of the premises in connection with their main listed use. Control usually means physical possession and the right to make decisions about how the premises are managed and used. In most cases it is an organisation, not an individual.

• Pub: whoever controls the pub day to day, usually the operating company or, in a tenanted or leased pub, the tenant. The statutory guidance, as corrected in August 2026, gives an example where a brewery or pub company owns a pub and holds the licence, a tenant leases it, and the tenant is the responsible person because they are in control.
• Church: usually the parochial church council (PCC) or the trustees.
• Mosque, synagogue, gurdwara or temple: usually the trustees, committee or governing body.
• Village hall: the management committee or trustees, not the people who hire it.
• School: the governing body or, where there is none, the proprietor.
• Shop: the company, partnership or sole trader operating it, normally the tenant under the lease rather than the landlord.

The responsible person can delegate tasks, but not the legal responsibility: it cannot be passed to a contracted service provider, and a hirer does not become responsible for a building by booking it. Most organisations name a lead contact, such as a churchwarden, a general manager or a hall secretary, to act for them day to day.

Where more than one person is responsible for premises, or one set of premises sits inside another (a unit in a shopping centre, for example), the responsible persons must co-ordinate with each other so far as reasonably practicable.

The SIA will check compliance through desk-based assessments and on-site inspections, using a risk-based approach. It has said it will focus on whether people have taken reasonable steps to comply, and will typically give at least 72 hours' notice of an inspection.

If the SIA finds a breach, it can issue a compliance notice at any tier, setting out what must be done. It can also issue a penalty notice. At standard tier the maximum penalty is £10,000, and the penalty notice can add up to £500 for each day the breach continues after the payment period. At enhanced tier the maximum is the greater of £18 million or 5% of qualifying worldwide revenue.

Failing to comply with a compliance notice is a criminal offence only at enhanced tier and for qualifying events. At any tier, it is an offence to knowingly or recklessly give the SIA false or misleading information, to fail to comply with an SIA information notice, or to intentionally obstruct an SIA inspector.

For most standard tier venues the realistic risk is not a fine. It is that, on the day something goes wrong, the people on site do not know what they are expected to do. In the first minutes of any serious incident, before the emergency services arrive, what happens depends on the staff and volunteers who are already there.

Clear procedures give those people two things: a decision already made about the options, and permission to act on them without waiting to be told. A steward who knows which exits open from the inside, or a bar manager who knows which room locks, can act in seconds. That is what the Act is asking for.

Much of the thinking also overlaps with work you already do. Your fire risk assessment and evacuation plan are a starting point, and the same knowledge of exits, rooms and roles supports your response to other emergencies. A written set that has been briefed and reviewed is also the simplest way to show the SIA, your insurer or your own trustees what you have in place.

The government expects the Act to come into force in spring 2027, after an implementation period of at least 24 months from Royal Assent. The SIA has said it will confirm the exact date ahead of time, so that premises can prepare. Until then there is nothing to notify, but procedures take time to agree, brief and test, particularly where you rely on volunteers or casual staff, so it makes sense to start now.

1. 01Check whether you are covered. Use the free checker to confirm your use and tier.
2. 02Work out and record your numbers. Choose one of the Home Office methods and keep a capacity assessment record showing the figure, the method and your reasoning. The SIA can ask how you reached it.
3. 03Confirm the responsible person. Agree which organisation holds the duty and who acts for it, and record it.
4. 04Agree your four procedures. Walk the building with the people who will carry them out. Identify exits, safe areas inside, rooms that lock and how you will tell people what to do.
5. 05Brief your people. Make sure every member of staff and every regular volunteer knows the procedures, and put a wall poster where staff will see it.
6. 06Review regularly. Look again every year, after any change to the building or how you use it, and after any incident.

Sector guides: pubs and bars · churches and places of worship · village halls and community centres · sports clubs and leisure centres · shops and retail

Our Standard Tier Pack turns your answers into ten editable documents, covering the four procedures, briefing, records and a poster, for £79 a year. See pricing. It is a set of templates for your organisation to review and adopt. It does not make you compliant and it is not legal advice; whether your procedures are appropriate is for the SIA to judge.