Martyn’s Law, officially the Terrorism (Protection of Premises) Act 2025, changes how certain public premises and events across the UK need to approach protective security and preparedness.
Named in honour of Martyn Hett, one of the 22 people who lost their life in the 2017 Manchester Arena incident, the Act creates legal requirements for those responsible for qualifying premises and events to prepare for a terrorist attack and reduce the risk of physical harm.
That potentially includes a wide range of organisations and locations, from shops, restaurants and hotels to entertainment venues, healthcare settings, places of worship and education establishments.
The Act received Royal Assent on 3 April 2025. However, its requirements are not yet in force. The government has said there will be an implementation period of at least 24 months before commencement, giving organisations time to understand the requirements and prepare. As of September 2026, no specific commencement date has been confirmed in the latest statutory guidance.
Key takeaways
- Martyn’s Law is the commonly used name for the Terrorism (Protection of Premises) Act 2025.
- The Act applies to qualifying premises where it is reasonable to expect 200 or more people, including staff, to be present at the same time from time to time.
- Most qualifying premises expecting 200–799 people will fall within the standard tier.
- Most qualifying premises expecting 800+ people will fall within the enhanced tier and have additional requirements.
- Qualifying events have separate criteria and require 800+ people to be reasonably expected at the same time, alongside other conditions.
- Childcare, primary, secondary and further education premises receive special treatment and remain standard tier where they are in scope, even if 800+ people may be present. Higher education premises do not receive this special treatment.
- The Security Industry Authority (SIA) is the regulator.
- The Act is not yet in force, so organisations have time to understand their responsibilities and prepare.
Core requirements of Martyn’s Law
At its core, the Terrorism (Protection of Premises) Act 2025 is about preparedness. For qualifying premises and events, the responsible person will need to notify the SIA and ensure appropriate public protection procedures are in place, so far as is reasonably practicable.
Those procedures cover four areas:
- Evacuation: getting people away from danger by moving them out of all or part of the premises or event.
- Invacuation: moving people to a safer location within the premises or event.
- Lockdown: securing premises to prevent or restrict people entering or leaving.
- Communication: getting information and instructions to people quickly during an incident.
People responsible for carrying out these procedures also need to know what they are expected to do. ProtectUK describes this as a proportionate approach, with expectations varying depending on the size and nature of the premises.
For standard tier premises, the government says the Act does not require physical alterations or the purchase of specific equipment simply to put public protection procedures in place.
Enhanced tier premises and qualifying events have additional requirements. They must put appropriate public protection measures in place, so far as is reasonably practicable, with the objectives of reducing vulnerability to terrorism and reducing the risk of physical harm if an attack occurs.
Standard Tier vs. Enhanced Tier: key differences
For most premises, the tier is determined by the greatest number of people it is reasonable to expect will be present at the same time, from time to time.
Standard tier
Most qualifying premises where 200–799 people may reasonably be expected at the same time will fall within the standard tier.
The responsible person will need to:
- notify the SIA as required
- put appropriate public protection procedures in place, so far as reasonably practicable
- make the people responsible for implementing those procedures aware of them and their roles
The focus is on practical preparedness rather than unnecessary complexity.
Enhanced tier
Most qualifying premises where 800 or more people may reasonably be expected at the same time will fall within the enhanced tier.
Alongside the requirements applying to standard tier premises, enhanced tier premises have additional obligations around public protection measures and documenting compliance.
Where the responsible person is an organisation rather than an individual, it must also designate a senior individual to ensure that the organisation complies with the relevant requirements. Enhanced tier premises must document their compliance, including their public protection procedures and measures and assessments of how they are expected to reduce harm and vulnerability.
The education exception
There is an important exception to the usual 800-person threshold.
Premises principally used for childcare, primary education, secondary education or further education remain within the standard tier if they are in scope, even where 800 or more people may reasonably be expected to be present.
Higher education premises are treated differently. Universities and other higher education premises follow the normal thresholds and can therefore fall within either the standard or enhanced tier.
Which premises could be affected by Martyn’s Law?
The Act covers a broad range of premises used for purposes listed in Schedule 1, provided the other conditions are met.
Depending on their individual circumstances, this can include places such as:
- shops and retail premises
- restaurants, cafés, bars and other food and drink venues
- hotels and other visitor accommodation
- entertainment and leisure venues
- sports grounds and facilities
- visitor attractions
- healthcare premises
- community and public buildings
- places of worship
- childcare and education premises
Being open to the public does not automatically bring a location within scope. Organisations need to consider the specific criteria in the Act, including how the premises are used and the number of people reasonably expected to be present.
For complex locations such as shopping centres or sites containing several different premises, responsibilities may also overlap. The Act contains requirements for responsible persons to co-operate and co-ordinate in certain circumstances.
What about events?
Martyn’s Law also covers certain events, but the rules are different from those for qualifying premises. There is no standard tier for qualifying events.
For an event to be a qualifying event, it must meet all the relevant criteria in the Act. Among other requirements, it must be reasonable to expect 800 or more people, including staff, to be present at the same time, the event must be accessible to members of the public, and entry must be controlled by checking that attendees meet a condition of entry, such as holding a ticket or pass.
Events below the 800-person threshold are not qualifying events under the Act. There are also special rules for events held at childcare, primary, secondary and further education premises and places of worship.
What does Martyn’s Law mean for schools and education?
Education remains an important part of Martyn’s Law, but the requirements are more nuanced than simply applying the standard 200/800 thresholds.
Early years, primary, secondary and further education premises that meet the qualifying criteria and expect 200 or more people will be standard tier, regardless of whether the number present exceeds 800. That means a secondary school with 1,200 pupils does not automatically become enhanced tier simply because of its size.
Higher education is different. Universities and other higher education premises can be standard or enhanced tier depending on the number of people reasonably expected to be present and the other criteria in the Act.
For education leaders, the practical priority is therefore understanding whether the premises are in scope, identifying the responsible person and making sure appropriate procedures can work in a real emergency.
How organisations can start preparing
The Act is not yet in force, but organisations do not need to wait until commencement to understand their current level of preparedness. A useful starting point is to review how your premises operate today. Consider:
- Who is responsible for the premises?
- Is the premises likely to meet the criteria for the standard or enhanced tier?
- What is the greatest number of people reasonably expected to be present at the same time, from time to time?
- Are evacuation, invacuation, lockdown and communication procedures already in place?
- Do the people expected to implement those procedures understand their responsibilities?
- How quickly can you understand who is on site during an incident?
- How will you communicate with employees, visitors, contractors or members of the public?
- For enhanced tier premises, what public protection measures may be appropriate and reasonably practicable?
- Where responsibilities overlap with other organisations or premises, are the right people able to co-operate and co-ordinate?
The goal is to make preparedness part of your every day operations. A procedure is much more valuable when the right people understand it and have the information they need to act.
Practical preparedness checklist
Every organisation will have different risks, layouts and resources, so Martyn’s Law deliberately avoids a one-size-fits-all approach.
For organisations reviewing their readiness, useful questions include:
For premises in scope
- Have you established who the responsible person is?
- Have you assessed the number of people reasonably expected to be present?
- Do you understand which tier applies?
- Are appropriate evacuation procedures in place?
- Are appropriate invacuation procedures in place?
- Are appropriate lockdown procedures in place?
- Is there a clear way to communicate during an incident?
- Do the people responsible for implementing those procedures understand what to do?
- Can you quickly establish who is on site?
- Are procedures kept current as your premises and operations change?
Additional considerations for enhanced tier premises
- Have appropriate public protection measures been considered?
- Have responsibilities been clearly assigned?
- Has a senior individual been designated where required?
- Can you document the procedures and measures in place?
- Can you explain how those procedures and measures are expected to reduce harm or vulnerability?
- Are appropriate security controls considered in the context of your specific premises?
- Is there a clear process for keeping documentation up to date?
Martyn’s Law in practice: example scenarios
The same legislation can look very different depending on the premises.
Scenario 1: A restaurant that regularly accommodates 300 people
If the restaurant meets the other qualifying criteria, it would be expected to fall within the standard tier. The focus would be on appropriate and reasonably practicable procedures for evacuation, invacuation, lockdown and communication, and ensuring the relevant people know how to put them into action.
Scenario 2: A large entertainment venue expecting 2,000 people
If the venue meets the other qualifying criteria, it would generally fall within the enhanced tier. Alongside public protection procedures, the responsible person would need to consider appropriate and reasonably practicable public protection measures and meet the enhanced tier requirements around areas such as documentation and governance.
Scenario 3: A secondary school with 1,200 pupils
Provided it meets the qualifying criteria, a secondary school of this size would still be treated as standard tier because of the special consideration for primary, secondary and further education premises. Its size alone would not move it into enhanced tier.
Scenario 4: A university building expecting more than 800 people
Higher education does not receive the same special treatment as schools and further education. If the relevant premises meet the other criteria and 800 or more people may reasonably be expected to be present at the same time from time to time, they may fall within the enhanced tier.
Scenario 5: A ticketed outdoor event for 5,000 people
If the event meets all the qualifying event criteria - including the 800-person threshold, public accessibility and entry-control requirements - it may be a qualifying event and subject to the enhanced requirements.
These examples show why organisations should assess their actual premises, uses and expected numbers rather than relying on a broad label such as “school,” “venue” or “event.”
How visitor management can support Martyn’s Law preparedness
Martyn’s Law does not require organisations to purchase a visitor management system, and technology alone does not make an organisation compliant. But the right systems can support the wider operational picture.
When an incident happens, fragmented information creates friction at exactly the wrong moment. Knowing who has entered a site, who is still present and how to reach people can help teams put their established procedures into practice.
Know who is on site
Digital visitor and employee records can provide a current view of the people who have signed into a premises. For workplaces, campuses and other controlled environments, that can help teams understand the presence of visitors, employees and contractors without relying solely on paper records.
Build more consistent access processes
Pre-registration, visitor approvals, identity checks and sign-in workflows can help organisations apply their access processes more consistently. The appropriate controls will depend on the premises. The objective is to give teams useful visibility without creating unnecessary friction for the people arriving.
Support emergency response
Live presence information, emergency notifications and evacuation tools can support established emergency procedures by helping teams understand who may be on site and communicate quickly. That matters whether the people present are employees in an office, contractors at a manufacturing site, parents at a school or visitors at a public venue.
Create stronger operational records
Digital records can also provide a clearer audit trail of visits, sign-ins and associated processes. For enhanced tier organisations in particular, good information management can support the wider discipline of maintaining accurate, current documentation - although visitor records themselves should not be confused with the specific compliance documentation required by the Act.
Visitor management is one part of a much bigger preparedness picture. Its value is in giving teams better visibility and information when they need to make decisions and act. To learn more about how visitor management can support safety processes, start a 15-day free trial of Sign In App or book a demo with the team.
.png)
