Martyn's Law explained

What Martyn's Law is

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025. It is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017, following years of campaigning by his mother, Figen Murray OBE.

The law asks those responsible for public venues and events to think in advance about how they would respond to a terrorist attack, so that staff can act quickly and reduce harm. It applies across England, Wales, Scotland and Northern Ireland, and the Security Industry Authority (SIA) will regulate it.

When it starts

The Act received Royal Assent on 3 April 2025, with an implementation period of at least 24 months. The Home Office published its statutory guidance on 15 April 2026, and the duties are expected to start from spring 2027 at the earliest. The exact date will be confirmed by the government, and the SIA will open an online system for notifications nearer to that time.

There is no legal duty to comply yet, but the guidance encourages those in scope to start preparing now.

Who is in scope

Premises are in scope if all four of these apply:

1. There is at least one building on the site.
2. The premises are wholly or mainly used for a purpose listed in Schedule 1 of the Act. If they have more than one listed use, the Principal Use of Premises Regulations 2026 say the main use is the one that best fits what the premises are and were built or adapted for. If that is unclear, look at how much space and time each use takes up.
3. It is reasonable to expect 200 or more people, including staff, to be present at the same time, from time to time.
4. The premises are not excluded under Schedule 2.

Uses covered by Schedule 1

Shops; food and drink (pubs, bars, restaurants, cafés); entertainment and leisure (theatres, cinemas, music venues, nightclubs, gyms); sports grounds; libraries, museums and galleries; halls (including village and community halls); visitor attractions; hotels; places of worship; health care; bus and railway stations; aerodromes; childcare; schools; further and higher education; and public authority premises.

Counting people

Use the greatest number you would reasonably expect at the same time, staff included, at your normal busy periods. Regular planned peaks count; a one-off spike does not change your tier. Your fire risk assessment occupancy figure, door counts or ticket and booking records are good evidence. Keep a note of how you worked it out, because the SIA can ask.

The two tiers

The responsible person is the individual, company or organisation in control of the premises for its main use, for example the pub company rather than the landlord who owns the building. The responsibility cannot be handed to a contractor, although tasks can be.

The four public protection procedures

Every premises and event in scope must have appropriate procedures in place, so far as is reasonably practicable. These are actions staff can take if they suspect an attack is happening or about to happen, on the premises or in the immediate vicinity.

The guidance recommends one simple plan for each procedure, rather than separate plans for every type of attack. The key question for staff is where the threat is: inside usually means evacuate, outside usually means bring people in and lock down. Plans should also cover who decides, who calls 999, and how the procedures work together.

"Reasonably practicable" means proportionate: weighing what a procedure achieves against its cost, time and difficulty. There is no requirement to buy equipment or alter the building at standard tier, though small changes, such as knowing where the keys are, are worth considering.

Staff and training

There is no legal requirement to buy training. But staff with a role in the procedures must know what they are and what to do, or it will be hard to show the procedures are really in place. The guidance suggests inductions, team briefings, refreshers and a pocket-sized prompt card. Free counter-terrorism awareness resources, including ACT Awareness e-learning, are available from ProtectUK.

Events and festivals

An event is a qualifying event if it is open to the public, has entry checks (tickets, wristbands, payment or membership), and 800 or more people may be present at the same time. Qualifying events are always in the enhanced tier, and can be on open land with no building, such as a field or park.

The count includes everyone on site at the peak: ticket holders plus crew, security, stewards, bar staff, traders, artists and volunteers. A festival selling 650 tickets can easily pass 800 once its workforce is counted.

The responsible person for an event is whoever controls the site for the event, usually the organiser, not necessarily the landowner. See how we help large venues and events.

Inspections and penalties

The SIA can inspect premises and events, usually with at least 72 hours' written notice, and can ask to see documents and have them explained. Its approach is expected to focus on support and guidance first, with formal enforcement for serious or persistent failures.

What to do now

1. Check whether you are in scope and which tier, using our free scope checker. Keep a note of how you counted.
2. Walk your premises with your duty managers: exits, safer rooms away from glass, doors you can lock, and where the keys are.
3. Write your procedures down: who decides, who calls 999, and a simple plan for evacuation, invacuation, lockdown and communication.
4. Brief your staff, give them a prompt card, and ask them to sign to say they have been briefed.
5. Practise and review at least once a year, or whenever something changes.
6. Notify the SIA through its online portal, within three months of the duties starting.

Common questions

Sources: Home Office, Terrorism (Protection of Premises) Act 2025 statutory guidance (April 2026); ProtectUK. This guide is general information, not legal advice, and is not endorsed by the Home Office or the SIA. Last reviewed 23 October 2026.