Martyn’s Law: Preparing UK Businesses for the Terrorism (Protection of Premises) Act

How Martyn’s Law Came About

In 2017 the Manchester Arena bombing killed twenty-two people and injured hundreds. Figen Murray, whose son Martyn was among the victims, has campaigned tirelessly for stronger protections ever since. Her efforts inspired “Martyn’s Law,” a new law that received Royal Assent on 3 April 2025 and will be implemented over the next two years.

It forms part of the UK government’s CONTEST strategy to reduce terrorism. The Home Office notes that there have been more than fifteen domestic terror attacks since 2017 and forty‑three plots have been disrupted. The nature of the threat has evolved – with lone actors, inexpensive weapons and attacks targeting crowded spaces. The government concluded that clear, consistent legal duties are needed so owners and operators plan for attacks and save lives.

Martyn’s Law aims to improve public safety by making it a legal duty for those responsible for publicly accessible locations to consider terrorism risks and how they would respond. It also honours the memories of those killed in Manchester and gives victims and families a sense of justice.

Who Will Be Affected?

Martyn’s Law applies to most venues and events that are open to the public, including:

• Entertainment venues such as concert arenas, theatres, sports stadiums, nightclubs, cinemas and tourist attractions.
• Shops, restaurants and cafes, from large retail centres to small independent bars.
• Hospitality venues, including hotels and holiday parks.
• Places of worship – churches, mosques, temples and other religious sites.
• Educational institutions - like schools, colleges and universities.
• Healthcare facilities – hospitals, clinics and GP surgeries.
• Temporary events like festivals, fairs and markets.

These venues are considered **publicly accessible locations** because people can enter without appointment. Offices and residential buildings are *not* included, and government buildings, transport hubs and open public spaces (like parks or beaches) are exempt.

The law adopts a tiered approach based on capacity and risk:

• Standard tier: premises that can hold 200 to 799 people. These include mid‑sized clubs, theatres, conference centres and busy restaurants.
• Enhanced tier: premises with a capacity of 800 or more and temporary events with 800+ attendees. Examples include major concert arenas, premiership football stadiums and large outdoor festivals.

The tiers ensure that legal obligations are proportionate. Smaller venues must put in place basic procedures and training, while large sites handling thousands of people need more comprehensive measures.

Standard vs Enhanced Tier Requirements

In both tiers, the central duty is to notify the Security Industry Authority (SIA)– the regulator – and to develop procedures to protect life.

Standard Duty

Premises in the standard tier must:

• Assess the risk of a terrorist attack at their site and the potential impact.
• Create a terrorism plan outlining how they would respond (evacuation, invacuation or lockdown).
• Provide basic staff training so employees know what to look out for and how to act.
• Communicate procedures clearly to workers, suppliers and visitors.

Importantly, there is no requirement to install new physical security measures. The law recognises that many small and medium businesses operate on tight margins. Simple, low‑cost actions such as keeping doors locked when appropriate, checking deliveries and having safe exit routes often make a big difference.

Enhanced Duty

Enhanced tier venues and events must do everything in the standard duty plus implement additional measures to reduce vulnerability. Obligations include:

• Implementing measures like bag searches, metal detectors, CCTV and vehicle access controls.
• Recording a detailed security plan that documents risk assessments, procedures and training logs; this must be kept up to date and available for inspection.
• Designating a senior responsible individual who oversees security and ensures compliance.
• Training staff extensively to recognise hostile reconnaissance, suspicious behaviour and suspicious items, and to lead evacuations or lockdowns.

These measures must be ‘reasonably practicable’. A small festival may decide that bag searches and stewards with radios are reasonable, while a stadium may invest in CCTV upgrades and controlled entry points. The key is tailoring the approach to the venue’s specific risks and capacities.

Businesses can expect the SIA to engage with them. Inspectors may issue compliance notices and impose penalties if duties are ignored.

Preparing Your Business or Venue

Here’s how you can start preparing for Martyn’s Law today:

1. Conduct a terrorism risk assessment. Identify the vulnerabilities in and around your premises, consider different types of attacks (vehicle, explosives, knife) and evaluate how quickly you can respond. For example, are exit routes clear? Where could suspicious individuals loiter unnoticed?
2. Develop a clear response plan. Create procedures for evacuation (moving people out), invacuation (moving people to a safer location inside) and lockdown. Include step-by-step instructions, assign roles to staff members and practice the plan regularly.
3. Train your people. Staff are your eyes and ears. Training should cover identifying suspicious behaviour, recognising unattended bags or suspicious packages, understanding when to raise an alarm and knowing how to guide customers to safety. Consider e-learning for frontline teams and scenario-based training for managers.
4. Implement proportionate measures. Depending on your tier and risk profile, this may include bag searches at entry points, ID checks, CCTV, queue management and restricting vehicle access. For smaller venues, simple steps like improving lighting, locking unused doors and clearly marking emergency exits might suffice.
5. Engage with authorities. Work with your local authority, police force, fire service and the SIA. They can provide guidance on threat intelligence and ensure your plans align with broader emergency plans.
6. Document everything. Keep records of risk assessments, plans, training sessions and drills. For enhanced tier venues, documentation will be a legal requirement; even standard tier premises benefit from clear records if the worst happens.

By taking these steps early you’ll embed security into everyday operations rather than scrambling to comply at the last minute.

Timeline and What Happens Next

Although Martyn’s Law received Royal Assent on 3 April 2025, it will not come into force immediately. The legislation provides for a 24‑month implementation period. That means standard and enhanced duties are expected to become law by mid‑2027, after secondary regulations are drafted and guidance published.

During this period you should:

- Stay up to date. The Home Office and SIA will issue detailed guidance and codes of practice. These will clarify definitions (like what counts as “capacity”), procedures for notifications and the level of training required.

- Begin budgeting for any physical security upgrades if you fall into the enhanced tier.

- Allocate time for staff training and drills. Embedding a security culture takes repetition and reinforcement.

- Review your insurance coverage and liability; some insurers may require evidence of compliance as a condition of cover.

- Integrate your terrorism response plan with other emergency plans (fire, first aid, evacuation for natural disasters).

When the Act fully commences, the SIA will have powers to inspect premises, issue compliance notices and impose civil penalties for non‑compliance. Early preparation will protect your visitors and your reputation.

How Tayl Can Help

Martyn’s Law can seem daunting, but you don’t have to navigate it alone. Tayl specialises in compliance and safety training for hospitality, retail, education and event venues across the UK. Our new course “Martyn’s Law and the Protection of Premises” gives your team the knowledge and tools they need to meet your legal duties and keep customers safe.

What the course covers

- Understanding the law: Detailed explanations of the standard and enhanced tier requirements, exemptions and the role of the Security Industry Authority (SIA).

- Risk assessment and mitigation: Step‑by‑step guidance on how to identify vulnerabilities, assess threats and implement proportionate measures such as bag searches, CCTV, locked doors or safe routes.

- Response planning: Practical exercises to help you develop robust emergency response plans, including lockdown and evacuation procedures tailored to your site.

- Staff training: Lessons on spotting suspicious behaviour, recognising potential threats such as unattended bags or hostile reconnaissance, and following site‑specific procedures.

- Templates and checklists: Downloadable risk assessment forms, procedure templates and training schedules ready to adapt to your organisation.

Our e‑learning modules include real‑world case studies, video scenarios and interactive quizzes so that your team can practice decision‑making in a safe environment. The course is accessible on any device and can be completed at your own pace.

Get started today

Preparing for the Terrorism (Protection of Premises) Act is not just about compliance—it’s about caring for your community and building customer confidence. By investing in training now you can avoid last‑minute panic when the law comes into force and ensure your procedures are tested and ready.

To learn more and enrol, visit our course page.