Receiving Royal Assent on Thursday 3 April 2025, Martyn’s Law introduces new legal requirements for owners and operators of certain premises and events to prevent the likelihood of a terrorist attack and protect the general public. Here, we explain what Martyn’s Law is, and how those within its scope can best use the next 24 months of its implementation to prepare their business and improve protective security.

Why was Martyn’s Law enacted?

Martyn Hett was singing and laughing in the foyer of Manchester Arena during an Ariana Grande concert when Salman Abedi detonated a shrapnel-filled bomb that killed 22 people, including Martyn, and injured hundreds of others.

The attack of May 2017 shocked the UK, as did a subsequent inquiry revealing numerous failings on the part of both Manchester Arena and the emergency services.

A report of a suspicious person with a large rucksack by a member of the public was not acted upon, largely because the two young security guards on duty had had “insufficient direction on how to respond [to] or report suspicious behaviour and encouragement to act upon it,” according to independent security experts.

Attempts to contact more senior members of staff for advice had proven fruitless, leaving Abedi free to walk and loiter around the venue for hours without being stopped or checked even once.

Officer presence had also been insufficient, with only four officers on patrol that night instead of the seven, including one sergeant, recommended by the British Transport Police. Two officers had even taken a two-hour meal break before the attack, driving five miles for a kebab whilst on duty.

Eighteen months after the attack, there was little to suggest that security had improved. Attending a concert in Salford, Martyn’s mother Figen Murray was horrified to realise that no security seemed to be in place, with no-one checking the small bag she was carrying at any point during her visit.

Ms Murray would go on to be instrumental in the creation and enaction of Martyn’s Law, walking more than 200 miles to petition Downing Street for a legal duty to protect members of the public and prevent the likelihood of a terrorist attack.

What is Martyn’s Law?

Officially known as The Terrorism (Protection of Premises) Act 2025 (‘the 2025 Act’), Martyn’s Law aims to “ensure the public are better protected from terrorism by requiring certain public premises and events to be prepared and ready to keep people safe in the event of an attack,” according to the Protect UK website.

Falling under the ‘Protect’ and ‘Prepare’ strands of the UK Government’s anti-terrorist framework CONTEST, Martyn’s Law creates a legal duty for certain premises or events to assess the risks of terrorism and implement proportionate security measures.

It establishes a tiered approach to this duty, which means that the requirements will depend on how many people can be reasonably expected to be present at the same time.

Martyn’s Law also creates a new function for the Security Industry Authority (SIA), the UK’s private security industry regulator. Under the 2025 Act, the SIA will be responsible for enforcing the new regulatory framework by providing guidance and support in the first instance. Under Schedule 3, however, the SIA will also have the power to enter premises after giving 72 hours’ notice to inspect and observe activities. Where necessary, they may also apply for a warrant to remove items, documents or equipment as evidence.

The SIA can also take enforcement action against serious or persistent non-compliance. Such action may include compliance notices, monetary penalties (up to a maximum of £10,000 for standard duty premises and £18m or 5% of worldwide revenue for enhanced duty premises or qualifying events), and restriction notices. 

The Act also introduces criminal offences, such as providing false or misleading information to the SIA, or intentionally obstructing or impersonating an authorised inspector.

Which premises and events are in scope?

To be in scope, premises must

  • include at least one building, or be a premises within a building;
  • be wholly or mainly used for one or more of the uses specified under Schedule 1 of the 2025 Act;
  • reasonably expect more than 200 individuals to be present at least occasionally;
  • not be listed as exempt under Schedule 2 of the 2025 Act.

To be in scope, events must:

  • be hosted at an area such as a park or a recreation ground;
  • have measures to check entry conditions, such as ticket checks;
  • reasonably expect at least 800 individuals to be present for the event at the same time at some point.

What is the tiered approach under Martyn’s Law?

Premises and events that are within the scope of Martyn’s Law will fall into one of two tiers: standard or enhanced.

The standard tier

This applies to premises that can reasonably expect 200 to 799 individuals, including staff, to be present at the same time, at least occasionally. This could include shops, cinemas, and hotels.

Under Martyn’s Law, a responsible person must:

  • notify the SIA of the premises;
  • have public protection procedures in place, so far as is reasonably practicable. This will include procedures for evacuation, invacuation (i.e. moving people to a safe place), locking down the premises, and communicating with individuals;
  • reduce the risk of physical harm being caused to individuals.

Whilst premises within the standard tier are not required to implement physical measures, such as barriers or gates, they must be able to demonstrate that relevant procedures are in place, and that all members of staff are aware of, and can follow, these procedures.

Who is a responsible person?

Under Section 4 of the 2025 Act, a responsible person is either someone who has “control of the premises in connection with their relevant Schedule 1 use”, or who has “control of the premises at which the event is to be held in connection with their use for the event”.

A responsible person can be a business, but premises and events in the enhanced tier must also designate a senior individual who can ensure compliance.

The enhanced tier

The enhanced tier applies to premises that can reasonably expect 800 or more individuals, including staff, to be present at the same time, at least occasionally. It also applies to any event that falls within the scope of Martyn’s Law.

In addition to the standard tier requirements, enhanced tier premises and events must:

  • have appropriate public protection measures in place to reduce vulnerability to an act of terrorism and the risk of harm to individuals;
  • implement measures to monitor the premises and the immediate vicinity (such as CCTV);
  • document public protection procedures and measures and provide these to the SIA.

How can businesses prepare for Martyn’s Law?

Businesses with premises and/ or events that fall within the scope of Martyn’s Law now have 24 months to implement the requirements.

At the time of writing, neither the UK Government nor the SIA have released any official guidance on best practice for compliance with Martyn’s Law. Nevertheless, businesses in both tiers can be proactive and take the following steps to ensure they are ready for the changes. These include:

  1. Ensuring estimates on event or building capacity are as accurate as possible. Existing assessments relating to fire prevention and health & safety may help with this.
  2. Training staff on Martyn’s Law and ensuring everyone is aware of relevant duties and procedures.
  3. Evaluating current emergency procedures such as evacuation plans and communications channels to ensure they are still fit for purpose and understood by members of staff.
  4. Assessing whether additional security measures, such as bag searches, body scanners, CCTV, or ticket barriers, are reasonably practicable and necessary.

Working with legal specialists with regulatory experience across health & safety, fire prevention, and counterterrorism will be one of the best and most comprehensive ways to ensure premises and events meet their new legal duty to protect.

More importantly, getting this right will also ensure that members of the public can continue to use the premises or attend events, secure in the knowledge that everything is being done to ensure they go home safely at the end.

Contact an expert

To discuss the issues raised in this article, please contact an expert below or a member of our specialist team.

Meet the team Read more about Contact an expert