The Terrorism (Protection of Premises) Bill, commonly called Martyn’s Law, became law on 3 April 2025.
The law requires those responsible for certain premises and events to consider the terrorist risk and how they would respond to an attack. Certain larger premises and events must also take steps to reduce the vulnerability of premises to terrorist attacks.
Premises affected
Publicly accessible buildings or land (not private premises or private parts of premises) are affected. A building will often have land associated with it, for example a pub with a beer garden, or a hotel with outside grounds used for dining and events. These are included as part of the premises.
The premises or land must fall within one of the Schedule 1 uses. Schedule 1 lists a variety of uses, including:
- the retail sale of goods
- the sale of food and drink for consumption on the premises
- entertainment and leisure activities
- sports grounds
- hotels
- holiday parks
- visitor attractions
Uses outside the hospitality sector include:
- healthcare
- places of worship
- childcare and educational establishments
Premises sizes
Premises with 199 or fewer people expected on the premises at any one time, or those whose business uses are not listed on Schedule 1, are not required to comply with Martyn’s Law.
Premises that expect 200 or more people to be on site at any one time must comply with the obligations. The ‘capacity’ of each premises matters:
1. Standard tier: Premises that reasonably expected to occasionally host 200 to 799 people are required to carry out Public Protection Procedures.
2. Enhanced tier: Premises that reasonably expect to occasionally host 800 people are required to carry out Public Protection Procedures and Public Protection Measures.
3. Qualifying events: Events that are reasonably expected to host 800 or more people in attendance at the same time at some point during the event are required to carry out Public Protection Procedures and Public Protection Measures.
The tiers are based on the Government’s current Terrorism Threat Level.
The Secretary of State can reduce these Tier number thresholds to 100 people for the standard tier and 500 people for the enhanced tier and qualifying events.
How to asses your premises
Any reasonable method of assessing the capacity can be used, for example:
- Safe occupancy for fire safety purposes
- Historic attendance data
- Fixed seating and/or standing numbers
- Tickets and pre-registration limit
- Restrictions imposed by a premises licence or other authorisation
- Other means of assessing, for example using records of transactions.
Premises requirements
Standard tier requirements
Standard tier premises are required to put in place simple procedures to reduce the risk of physical harm to individuals who may be present. These would normally include
- evacuation
- invacuation
- lock down
- communication procedures.
You are not required to make physical alterations or purchase equipment. People working at the premises must be made aware of the procedures so that they can be ready to put them into practice. These procedures will require review.
Enhanced tier requirements
Enhanced tier premises are required to meet the standard tier requirements, plus operators are required to ensure that public protection measures are put in place to reduce the vulnerability of the premises or qualifying event to acts of terrorism. These may be implemented through:
- people (for example, extra training)
- processes (for example, a bag search policy)
- physical measures (for example, CCTV).
Measures also include monitoring of the premises, controlling the movement of people in and out of the premises, physical safety and security measures (e.g. safety glass or Hostile Vehicle Mitigation) and understanding the sensitivities of information relating to a premises and who should have access to that information, such as floor plans.
Martyn’s Law Compliance
Understanding the importance of being compliant with Martyn’s Law.
Who is responsible for compliance
The person responsible in both tiers is the person (an individual or a corporate entity) who has control of the premises in connection with their relevant Schedule 1 use. In other words, the shop owner is responsible for a shop, or the pub landlord for a pub.
The freehold owner is not responsible if they have no involvement in the running of the premises for its relevant use. Likewise, for qualifying events, the owner of a field where a festival is held once a year would not be the responsible person, rather the festival organiser for the duration of that festival would be. If another festival is held at the same site later on in the year then that festival organiser would be the responsible person for that later event.
Reasonably practicable
The Act is intended to be proportionate and the concept of “reasonable practicability” runs throughout. Therefore, those responsible for premises and events are allowed to take into account the nature of their activities, operating environment, and available resources when fulfilling their obligations under the legislation.
Immediate vicinity
Whilst the immediate vicinity of the premises or event is not a factor in deciding whether the premises or event falls within scope (i.e. within the 200 – 799 tier, or 800 and above), the immediate vicinity must be included in the relevant procedures and/or measures undertaken to reduce the risk of harm from or vulnerability to terrorist attack. So a large stadium would have to consider Zone Ex (the external zone which lies immediately beyond the outer perimeter of a sports ground), and a pub might have to take into account the pavement immediately outside.
The regulator
The regulator is the Security Industry Authority (SIA).
And the ‘Responsible Person’ for all affected Tiers must notify the Security Institute Authority (SIA) when relevant premises are Standard or Enhanced Tier. It is the same for Qualifying Events.
Premises are outside scope
Premises or land which are not used for a Schedule 1 use, or whose reasonable expectation of individuals present could never be more than 199 fall outside the scope of the Act. There are also certain excluded premises, for example the Houses of Parliament.
Compliance
The regulator can issue compliance notices, and in the case of Enhanced Duty premises and Qualifying Events, restriction notices. These notices can limit the:
- numbers at premises or events
- times a premises or event can take place
Both types of notice can be appealed to a tribunal. There are obligations on non-parties, for example freeholders, to co-operate to ensure a premises complies with its requirements under the Act.
Penalties
Maximum penalties for Standard Tier premises are £10,000 for a fixed penalty and a daily penalty of £500. For Enhanced Tier premises or Qualifying Events these maximums are £18 million or 5% of worldwide turnover, and a maximum daily penalty of £50,000 .
Licensing plans
The Act also contains provisions for the exclusion of sensitive information in licensing plans from licensing authorities’ public registers. These provisions would apply to licensing plans from the date the law came into effect. Plans already on licensing registers can have applications made for their removal or amendment to ensure no sensitive information is publicly available for terrorists to use .
How long you have to become compliant
Operators are likely to have 18 to 24 months to prepare before the provisions take effect. Sector based guidance is expected to be issued to help operators understand their obligations.
Further information and guidance
For further information, guidance and fact sheets on Martyn’s Law visit the GOV.UK website