Martyn’s Law – What the new Act says

White paper from Assurity Consulting

Following a period of consultation and amendments the Terrorism (Protection of Premises) Act 2025, also known as Martyn’s Law, received Royal Assent on Thursday 3rd April 2025. The aim of the legislation is to improve protective security and organisational preparedness across the UK, following the Manchester Arena Attack.

So, what does this mean for your business?

1. The background to Martyn’s Law

At 22:30 on 22nd May 2017, in a foyer filling with people following an Ariana Grande concert at the Manchester Arena, Salman Abedi detonated a bomb killing 22 children, teenagers, parents and others, injuring another 1,017. One of those who died was 29-year-old Martyn Hett, after who the law is named and who’s mother Figen Murray led the campaign for the new law.

Since them Counter Terrorism Policing (CTP) report that they “and the UK Intelligence Services have stopped seven late-stage terror attacks since the start of the Covid-19 pandemic”.

“That takes the total number of foiled terrorism plots since March 2017 to 32 – with 18 related to Islamist extremism, 12 to Extreme Right Wing Terrorism (XRWT) and two to Left, Anarchist or Single Issue Terrorism (LASIT)”.

The Act therefore finally delivers on successive governments commitment to strengthen the security of public events and venues. GOV.UK explaining that the law will see “the public are better protected from terrorism by requiring those responsible for certain public premises and events to take reasonably practicable steps to be prepared and ready to keep people safe in the event of an attack. Certain larger premises will be required to consider and, where appropriate, take steps to reduce their vulnerability to acts of terrorism.”

2. What does Martyn’s Law cover?

The Act sets out a tiered approach to make sure that the controls required are in keeping with the level of risk posed. Subject to conditions, qualifying premises will be where 200 or more individuals (including staff) must, from time to time, be reasonably expected to be present at the same time in connection with one or more uses specified in the Act.

Dependant on numbers likely to be present at the premises or event, a two-tiered approach Standard and Enhanced.

Standard duty premises (Standard tier) – Premises whereby it is reasonable to expect that at least 200 individuals may be present at least occasionally but not more than 799. If 800 or more individuals may be expected, the premises will be enhanced duty.

Responsible person – For qualifying premises, the responsible person is the person who has control of the premises in connection with the use e.g. the use of a venue as a sports ground. For multi-use premises this is the person who is responsible for the premises principal use.

Requirements for standard duty premises:

-Notify the Security Industry Authority (SIA) of their premises; and

-Have in place, so far as reasonably practicable, appropriate public protection procedures.

These public protection procedures are those which should be followed by people working at the premises if an act of terrorism were to occur at the premises, or in the immediate vicinity. These are meant to be simple, low-cost activities with costs relating primarily to time spent. There is no requirement to put in place physical measures.

Enhanced duty premises (Enhanced tier) – An event where it is reasonable to expect that there will be at least 800 individuals present at some point during it.

Responsible person – For qualifying events, the responsible person is the person who has control of the premises at which the event will be held for the purposes of the event. For example, if a concert is to be held in a park and the company putting on the event takes control of an area of the park for the purposes of that concert, the company putting on the event will be the responsible person. However, if a stately home puts on a concert in its grounds and maintains control of the site for the purposes of that concert, the stately home will be the responsible person.

Requirements for enhanced duty premises:

• As per standard duty

• Have in place, so far as reasonably practicable, appropriate public protection measures that could be expected to reduce both (i) the vulnerability of the premises or event to an act of terrorism, and (ii) the risk of physical harm being caused to individuals if an attack was to occur there or nearby. For example, bag checks, scanners, CCTV or physical security presence.

• Document the public protection procedures and measures in place and provide this document to the SIA.

• Where the responsible person is not an individual, they must designate a senior individual with responsibility for making sure that the responsible person complies with these requirements.

3. What premises and events qualify/fall in scope for Martyn’s Law?

For qualifying premises, those in scope for standard tier will be:

• There is at least one building (or the premises are in a building);

• The premises are wholly or primarily used for one or more of those specified in Schedule 1 of the Act (see below);

• It is reasonable to expect that at least 200 individuals may be present “at least occasionally”; and

• The premises are not excluded under Schedule 2 of the Act

Where 800 or more people would be expected at the premises, these will become enhanced duty premises.

For qualifying events the criteria that apply to those falling into scope for enhanced tier are:

• They take place at a building, other land or a building and other land, including parts or groups of buildings;

• Members of the public will have access for the purpose of the event;

• It is reasonable to expect that, at some point, 800 or more individuals present for the event;
• Measures will be in place, for the purpose of attending the event, to secure or check that members of the public who wish to access it:

-Have paid to do so;

-Have tickets or passes allowing access; or

-Are members or guests of a club, association or similar body; and the event is not excluded as mentioned above in relation to premises.

Schedule 1 of the Act “Specified uses of Premises” includes:

• Shops etc. – where the sale, display or service is principally to visiting members of the public

• Food and drink – where the food or drink is principally for consumption on the premises by visiting members of the public;

• Entertainment or leisure activities – where the activity is principally for the benefit of visiting members of the public;

• Sports grounds (UK definitions apply);

• Use as a library, museum or gallery where admittance is principally to visiting members of the public;

• Halls etc. used as venue for hire for events or activities/an exhibition hall, or a conference centre;

• Visitor attractions – where used of cultural, historic, touristic or educational value;

• Hotels – incl. hostels and holiday parks;

• Places of worship;

• Healthcare – inc. hospitals;

• Bus and railway stations;

• Aerodromes (exc. military);

• Childcare (UK definitions apply);

• Primary and secondary education;

• Further education;

• Higher education;

• Public authorities – use (other than use mentioned elsewhere in the Schedule) for the provision by a public authority of facilities or services to visiting members of the public; and

• References to visiting members of the public – the schedule states: In determining for the purposes of this Schedule whether premises are used by visiting members of the public, it is irrelevant that access to the premises may be limited (at all times or particular times) to members of the public who:

a. Have paid to access the premises;

b. Have tickets or passes allowing access; or

c. Are members or guests of a club, association or similar body

Schedule 2 of the Act “Excluded premises and events” includes:

1. Legislatures and devolved administrations – purposes of either House of Parliament;
2. Devolved parliaments in Wales, Scotland and Northern Ireland;
3. Parks, gardens, etc. where members of the public have not paid to do so, don’t have tickets or passes allowing access, are not members or guests of a club, association or similar body;
4. Transport security (various exceptions apply);
5. Events to be held on certain excluded premises; and
6. Events at certain places of worship, schools, etc.

4. Martyn’s Law other considerations

Regulator and enforcement – The Security Industry Authority (SIA) will be the regulator and responsible for providing guidance and making sure compliance is up held with the new legislation. Sections 12 to 26 of the Act covers enforcement, fines and offences, with penalties for non-compliance as big as £18 million or 5% of qualifying worldwide revenue.

Commencement – It has been proposed that the requirements will not be enforceable for 24 months, providing time for the responsible persons of qualifying premises and events will have time to appropriately plan and implement as relevant the requirements, as well as the SIA to set up their new internal functions and provide further guidance

Public protection procedures – Measures to be followed by individuals working on the premises or at the event if there is reason to suspect that an act of terrorism is occurring, or is about to occur, on the premises, at the event or in the immediate vicinity of the premises or event include:

a. For evacuating individuals from the premises or event;

b. For moving individuals to a place on the premises or at the event where there is less risk of physical harm being caused to them;

c. For preventing individuals entering or leaving the premises or event; and

d. For providing information to individuals on the premises or at the event.

For enhanced duty premises and qualifying events, they also relate to:

a. The monitoring of the premises or event and the immediate vicinity of the premises or event;

b. The movement of individuals into, out of and within the premises or event;

c. The physical safety and security of the premises or the premises at which the event is to be held; and

d. The security of information in relation to the premises or event.