Martyn’s Law, officially the Terrorism (Protection of Premises) Act 2025, changes how certain public premises and events across the UK need to approach protective security and preparedness.
Named in honour of Martyn Hett, one of the 22 people who lost their life in the 2017 Manchester Arena incident, the Act creates legal requirements for those responsible for qualifying premises and events to prepare for a terrorist attack and reduce the risk of physical harm.
That potentially includes a wide range of organisations and locations, from shops, restaurants and hotels to entertainment venues, healthcare settings, places of worship and education establishments.
The Act received Royal Assent on 3 April 2025. However, its requirements are not yet in force. The government has said there will be an implementation period of at least 24 months before commencement, giving organisations time to understand the requirements and prepare. As of September 2026, no specific commencement date has been confirmed in the latest statutory guidance.
At its core, the Terrorism (Protection of Premises) Act 2025 is about preparedness. For qualifying premises and events, the responsible person will need to notify the SIA and ensure appropriate public protection procedures are in place, so far as is reasonably practicable.
Those procedures cover four areas:
People responsible for carrying out these procedures also need to know what they are expected to do. ProtectUK describes this as a proportionate approach, with expectations varying depending on the size and nature of the premises.
For standard tier premises, the government says the Act does not require physical alterations or the purchase of specific equipment simply to put public protection procedures in place.
Enhanced tier premises and qualifying events have additional requirements. They must put appropriate public protection measures in place, so far as is reasonably practicable, with the objectives of reducing vulnerability to terrorism and reducing the risk of physical harm if an attack occurs.
For most premises, the tier is determined by the greatest number of people it is reasonable to expect will be present at the same time, from time to time.
Most qualifying premises where 200–799 people may reasonably be expected at the same time will fall within the standard tier.
The responsible person will need to:
The focus is on practical preparedness rather than unnecessary complexity.
Most qualifying premises where 800 or more people may reasonably be expected at the same time will fall within the enhanced tier.
Alongside the requirements applying to standard tier premises, enhanced tier premises have additional obligations around public protection measures and documenting compliance.
Where the responsible person is an organisation rather than an individual, it must also designate a senior individual to ensure that the organisation complies with the relevant requirements. Enhanced tier premises must document their compliance, including their public protection procedures and measures and assessments of how they are expected to reduce harm and vulnerability.
There is an important exception to the usual 800-person threshold.
Premises principally used for childcare, primary education, secondary education or further education remain within the standard tier if they are in scope, even where 800 or more people may reasonably be expected to be present.
Higher education premises are treated differently. Universities and other higher education premises follow the normal thresholds and can therefore fall within either the standard or enhanced tier.
The Act covers a broad range of premises used for purposes listed in Schedule 1, provided the other conditions are met.
Depending on their individual circumstances, this can include places such as:
Being open to the public does not automatically bring a location within scope. Organisations need to consider the specific criteria in the Act, including how the premises are used and the number of people reasonably expected to be present.
For complex locations such as shopping centres or sites containing several different premises, responsibilities may also overlap. The Act contains requirements for responsible persons to co-operate and co-ordinate in certain circumstances.
Martyn’s Law also covers certain events, but the rules are different from those for qualifying premises. There is no standard tier for qualifying events.
For an event to be a qualifying event, it must meet all the relevant criteria in the Act. Among other requirements, it must be reasonable to expect 800 or more people, including staff, to be present at the same time, the event must be accessible to members of the public, and entry must be controlled by checking that attendees meet a condition of entry, such as holding a ticket or pass.
Events below the 800-person threshold are not qualifying events under the Act. There are also special rules for events held at childcare, primary, secondary and further education premises and places of worship.
Education remains an important part of Martyn’s Law, but the requirements are more nuanced than simply applying the standard 200/800 thresholds.
Early years, primary, secondary and further education premises that meet the qualifying criteria and expect 200 or more people will be standard tier, regardless of whether the number present exceeds 800. That means a secondary school with 1,200 pupils does not automatically become enhanced tier simply because of its size.
Higher education is different. Universities and other higher education premises can be standard or enhanced tier depending on the number of people reasonably expected to be present and the other criteria in the Act.
For education leaders, the practical priority is therefore understanding whether the premises are in scope, identifying the responsible person and making sure appropriate procedures can work in a real emergency.
The Act is not yet in force, but organisations do not need to wait until commencement to understand their current level of preparedness. A useful starting point is to review how your premises operate today. Consider:
The goal is to make preparedness part of your every day operations. A procedure is much more valuable when the right people understand it and have the information they need to act.
Every organisation will have different risks, layouts and resources, so Martyn’s Law deliberately avoids a one-size-fits-all approach.
For organisations reviewing their readiness, useful questions include:
The same legislation can look very different depending on the premises.
If the restaurant meets the other qualifying criteria, it would be expected to fall within the standard tier. The focus would be on appropriate and reasonably practicable procedures for evacuation, invacuation, lockdown and communication, and ensuring the relevant people know how to put them into action.
If the venue meets the other qualifying criteria, it would generally fall within the enhanced tier. Alongside public protection procedures, the responsible person would need to consider appropriate and reasonably practicable public protection measures and meet the enhanced tier requirements around areas such as documentation and governance.
Provided it meets the qualifying criteria, a secondary school of this size would still be treated as standard tier because of the special consideration for primary, secondary and further education premises. Its size alone would not move it into enhanced tier.
Higher education does not receive the same special treatment as schools and further education. If the relevant premises meet the other criteria and 800 or more people may reasonably be expected to be present at the same time from time to time, they may fall within the enhanced tier.
If the event meets all the qualifying event criteria - including the 800-person threshold, public accessibility and entry-control requirements - it may be a qualifying event and subject to the enhanced requirements.
These examples show why organisations should assess their actual premises, uses and expected numbers rather than relying on a broad label such as “school,” “venue” or “event.”
Martyn’s Law does not require organisations to purchase a visitor management system, and technology alone does not make an organisation compliant. But the right systems can support the wider operational picture.
When an incident happens, fragmented information creates friction at exactly the wrong moment. Knowing who has entered a site, who is still present and how to reach people can help teams put their established procedures into practice.
Digital visitor and employee records can provide a current view of the people who have signed into a premises. For workplaces, campuses and other controlled environments, that can help teams understand the presence of visitors, employees and contractors without relying solely on paper records.
Pre-registration, visitor approvals, identity checks and sign-in workflows can help organisations apply their access processes more consistently. The appropriate controls will depend on the premises. The objective is to give teams useful visibility without creating unnecessary friction for the people arriving.
Live presence information, emergency notifications and evacuation tools can support established emergency procedures by helping teams understand who may be on site and communicate quickly. That matters whether the people present are employees in an office, contractors at a manufacturing site, parents at a school or visitors at a public venue.
Digital records can also provide a clearer audit trail of visits, sign-ins and associated processes. For enhanced tier organisations in particular, good information management can support the wider discipline of maintaining accurate, current documentation - although visitor records themselves should not be confused with the specific compliance documentation required by the Act.
Visitor management is one part of a much bigger preparedness picture. Its value is in giving teams better visibility and information when they need to make decisions and act. To learn more about how visitor management can support safety processes, start a 15-day free trial of Sign In App or book a demo with the team.