Martyn's Law requirements: what venues must do
Martyn's Law is the short name for the Terrorism (Protection of Premises) Act 2025. It places a legal duty on the people who run qualifying premises to have basic procedures ready for a terrorist attack. Here is what actually applies, to whom, and from when.
Where the name comes from
The Act is named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena attack. His mother Figen Murray campaigned for years for a legal duty on venues to prepare for attacks, and that campaign became the Act. It received Royal Assent on 3 April 2025, which puts it on the statute book, but Royal Assent is not the same as being enforceable - more on that below.
Who is in scope
The duty applies to "qualifying premises": a building or event site where 200 or more individuals may reasonably be expected to be present at the same time. That count is not just paying customers - it includes staff, volunteers and anyone else reasonably expected on site. Premises expecting fewer than 200 at once fall outside the Act entirely.
Two tiers apply above that line, decided by expected occupancy — with one carve-out: education settings stay in the standard tier whatever their size (see our schools guide):
| Tier | Expected occupancy | Core duty |
|---|---|---|
| Standard duty | 200-799 | Notify the SIA; have procedures for evacuation, invacuation, lockdown and communication |
| Enhanced duty | 800+ | Everything standard duty requires, plus documented public protection measures given to the SIA |
Working out which tier you're in from your own numbers is what our free duty-tier calculator does in a few seconds.
What standard duty actually means
If you're standard duty, the Act expects you to have public protection procedures, so far as reasonably practicable, across four categories:
- Evacuation - getting people out of the premises safely.
- Invacuation - moving people to safety inside the premises when leaving would be more dangerous.
- Lockdown - restricting movement and access to protect people where they are.
- Communication - informing people on site about what is happening and what to do.
You also have to notify the SIA that you're a qualifying premises. There is no requirement to buy security equipment or hire a consultant for standard duty - the bar is procedures that staff understand and can carry out, written down and appropriate to your specific premises.
What enhanced duty adds
Enhanced duty premises carry everything standard duty requires, plus public protection measures: monitoring the premises, physical safety and security measures, security of information, and vehicle security where relevant. Enhanced-duty premises must document these measures and provide that document to the SIA - it is not enough to just have a plan in a drawer.
Notifying the SIA
The Security Industry Authority (SIA) is the regulator for Martyn's Law. Both tiers have to notify the SIA that they're a qualifying premises; enhanced-tier premises additionally submit their public protection measures document. The SIA is standing up its regulatory function through 2026 ahead of commencement, so the practical notification process is still being finalised.
Penalties for getting it wrong
The SIA can issue compliance notices and restriction notices before it reaches for financial penalties. Where it does fine, the numbers differ sharply by tier:
| Tier | Maximum civil penalty |
|---|---|
| Standard duty | Up to £10,000 |
| Enhanced duty | Up to the higher of £18 million or 5% of worldwide revenue |
Daily penalties are also possible for a breach that continues rather than gets fixed.
The timeline: nothing is enforceable yet
Royal Assent (3 April 2025) started the clock, not the duty itself. Government has signalled an implementation period of roughly 24 months, with commencement expected in Spring 2027. The SIA is using this window to build its regulatory function. That means no venue can be fined today for having no procedures - but it also means the sensible venues are the ones using this window to get their compliance checklist sorted before the deadline arrives rather than after.
Check your duty tier in 10 seconds. VenueDuty's free calculator tells you whether you're standard or enhanced duty. Pro (£29 one-time) then generates your Public Protection Procedures document - a 40-clause library across all four categories, printable, with a review log and staff sign-off table.
Check my duty tier — freeFrequently asked questions
What is required under Martyn's Law?
Standard-duty premises (200-799 expected people) must notify the SIA and have procedures, so far as reasonably practicable, covering evacuation, invacuation, lockdown and communication. Enhanced-duty premises (800+) also need documented public protection measures and must give that document to the SIA.
Is Martyn's Law mandatory?
Yes, once it commences. The Act received Royal Assent on 3 April 2025 and enforcement is expected from Spring 2027. Nothing is enforceable yet, which is exactly why early preparation matters.
Who counts as the responsible person?
The person with control of the premises - typically the operator, owner or occupier running the site day to day. That person carries the duty to have adequate procedures and to notify the SIA where required.
When does Martyn's Law come into force?
Commencement is expected in Spring 2027, after roughly a 24-month implementation period following Royal Assent, during which the SIA is standing up as regulator.