What is Martyn's Law? A Complete Guide to the Terrorism (Protection of Premises) Act 2025

Martyn's Law — formally known as the Terrorism (Protection of Premises) Act 2025 — represents the most significant piece of counter-terrorism legislation in the United Kingdom in over a decade. Named after Martyn Hett, one of the 22 people killed in the Manchester Arena bombing on 22 May 2017, the Act places a legal duty on those responsible for certain premises and events to take proportionate steps to protect the public from terrorism.

The Act received Royal Assent on 3 April 2025, with enforcement expected within 24 months — meaning premises and event operators must be compliant by approximately April 2027. If you are responsible for a venue, public space, or event that regularly hosts 200 or more people, this legislation directly affects you.

Background: Why Martyn's Law Was Created

On 22 May 2017, a suicide bomber detonated an improvised explosive device in the foyer of the Manchester Arena as concert-goers — many of them children and young people — were leaving an Ariana Grande concert. Twenty-two people were killed and over a thousand were injured, making it the deadliest terrorist attack in the UK since the 7 July 2005 London bombings.

Among those killed was Martyn Hett, a 29-year-old from Stockport. In the aftermath of the attack, Martyn's mother, Figen Murray, began campaigning for stronger protective security measures at public venues. Her tireless advocacy, including a 200-mile walk from Manchester to London in 2023, helped bring the issue to the forefront of public and political attention.

The Manchester Arena Inquiry, chaired by Sir John Saunders, published its findings across three volumes between 2021 and 2023. Volume One concluded that failures in protective security at the Arena contributed to the loss of life. The Inquiry made wide-ranging recommendations for improving venue security, many of which directly informed the drafting of Martyn's Law.

What Does the Act Require?

The Terrorism (Protection of Premises) Act 2025 establishes a legal framework requiring those responsible for qualifying premises and events to take steps to reduce vulnerability to terrorist attacks and to improve preparedness. The Act uses a proportionate, two-tier approach based on the capacity of the premises or event, ensuring that requirements are reasonable and scalable.

At its core, the Act recognises a fundamental principle: protective security should not be left to chance. The people responsible for public venues have a duty of care to those who use them, and that duty extends to taking reasonable and proportionate steps to protect against the threat of terrorism.

The Two-Tier System

Martyn's Law operates on a two-tier system designed to ensure that the requirements placed on premises operators are proportionate to the size and nature of the venue. This prevents small businesses from facing the same obligations as major stadiums, while ensuring that all qualifying premises take some level of protective action.

Standard Tier: Premises with Capacity of 200 to 799

The Standard tier applies to premises that have a capacity of 200 or more but fewer than 800 individuals. This tier is designed to impose straightforward, low-cost requirements that can be implemented without specialist security expertise. The focus is on awareness and basic preparedness rather than physical security infrastructure.

Standard tier duty holders are required to:

• Notify the Security Industry Authority (SIA) that their premises are qualifying premises under the Act
• Implement public protection procedures to reduce vulnerability to acts of terrorism and to reduce harm in the event of an attack
• Ensure that relevant staff are aware of the public protection procedures and have received appropriate training
• Maintain and regularly review their public protection procedures

Public protection procedures at the Standard tier are expected to be simple, practical measures such as ensuring staff know how to lock doors and direct people away from danger, understanding the "Run, Hide, Tell" guidance, and knowing how to contact emergency services quickly. These are not onerous requirements — they are basic steps that any responsible venue operator should already be taking.

Enhanced Tier: Premises with Capacity of 800 or More

The Enhanced tier applies to premises with a capacity of 800 or more individuals. These larger venues face a higher level of obligation reflecting the greater potential consequences of an attack at a location that holds large numbers of people.

In addition to the Standard tier requirements, Enhanced tier duty holders must:

• Conduct a terrorism risk assessment of the premises and review it regularly
• Implement reasonably practicable measures to reduce vulnerability, which may include bag searches, CCTV monitoring, and vehicle access controls
• Appoint a designated senior individual responsible for compliance (a security coordinator)
• Develop and maintain a counter-terrorism security plan
• Consider measures relating to physical security, including access control and perimeter security
• Ensure staff training goes beyond basic awareness to include recognising hostile reconnaissance and responding to specific attack methodologies

Who Is Affected by Martyn's Law?

The Act applies to a wide range of premises and events across numerous sectors. If your premises regularly accommodate 200 or more individuals at any one time, you are likely to fall within scope. The types of premises affected include:

• Entertainment venues: theatres, cinemas, concert halls, nightclubs, stadiums, arenas
• Retail: large shops, shopping centres, department stores, retail parks
• Hospitality: hotels, restaurants, bars, conference centres, banqueting halls
• Education: universities, colleges, schools with public-facing events
• Healthcare: hospitals, large medical centres, clinics with public waiting areas
• Places of worship: churches, mosques, synagogues, temples, gurdwaras
• Transport hubs: railway stations, bus stations, airports (to the extent not already covered)
• Public spaces: museums, galleries, libraries, leisure centres, parks hosting events
• Events: festivals, markets, outdoor gatherings, sporting events

It is important to note that the capacity threshold refers to the maximum number of individuals who could reasonably be present at any one time, not the average footfall. If your premises could accommodate 200 or more people — even if they rarely do — you may still fall within scope.

The SIA as Regulator

The Security Industry Authority (SIA) has been designated as the regulator for Martyn's Law. The SIA, which already regulates the private security industry in the UK through the licensing of security operatives, will take on responsibility for overseeing compliance with the new requirements. This includes maintaining a register of qualifying premises, conducting inspections, and taking enforcement action where necessary.

The choice of the SIA as regulator reflects the government's desire to use existing infrastructure and expertise rather than creating a new body. The SIA has stated that it will adopt a proportionate and supportive approach to enforcement, prioritising education and guidance over punitive measures in the early stages of implementation.

Implementation Timeline

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. The Act includes a provision allowing for a period of up to 24 months before enforcement begins, giving duty holders time to understand and prepare for their new obligations. This means that enforcement is expected to commence by approximately April 2027.

The government has indicated that secondary legislation — the detailed regulations that will flesh out the requirements — will be published in advance of the enforcement date. Guidance documents and toolkits are also expected from the SIA and from ProtectUK (the online platform managed by Counter Terrorism Policing) to support duty holders in understanding and meeting their obligations.

How to Prepare for Martyn's Law

Whether your premises fall into the Standard or Enhanced tier, preparation is key. The following steps will help you get ahead of the enforcement deadline:

1. Determine Whether You Are in Scope

Assess the maximum capacity of your premises. If it is 200 or more, you are likely a qualifying premises. If it is 800 or more, you will fall into the Enhanced tier. Consider not just your main area but all spaces that form part of the premises, including foyers, corridors, car parks, and outdoor areas.

2. Conduct a Protective Security Risk Assessment

Even if you are in the Standard tier, conducting a risk assessment is good practice. This involves identifying potential threats, assessing your vulnerabilities, and determining what measures would reduce risk. For Enhanced tier premises, a formal terrorism risk assessment is a legal requirement under the Act.

3. Train Your Staff

Staff training is central to the Act's requirements at both tiers. At a minimum, all relevant staff should understand basic protective security principles, know how to respond in the event of an attack (Run, Hide, Tell), and be familiar with your venue's specific procedures. For Enhanced tier premises, training should extend to recognising hostile reconnaissance, understanding attack methodologies, and contributing to the security plan.

4. Develop and Document Procedures

Written public protection procedures are essential. These should cover lockdown procedures, evacuation routes, communication protocols, and responsibilities. Test your procedures through exercises and drills, and review them regularly to ensure they remain current and effective.

5. Invest in Professional Qualifications

For those responsible for compliance — particularly at Enhanced tier premises — professional counter-terrorism qualifications provide the knowledge and credibility needed to fulfil the role effectively. The CTPSaP (Counter Terrorism Protective Security and Preparedness) qualification is the only counter-terrorism qualification endorsed by Counter Terrorism Policing and is directly relevant to the competencies required under Martyn's Law.

Get Qualified Before the Deadline

Martyn's Law is coming, and the organisations that prepare now will be best placed to comply when enforcement begins. Whether you need to understand your obligations, conduct a risk assessment, or train your team, the CTPSaP qualification provides the foundation you need.