Clear answers to common questions.

Martyn’s Law is the commonly used name for the Terrorism (Protection of Premises) Act 2025. It is intended to improve preparedness and protective security by requiring those responsible for certain publicly accessible premises and events to consider how they would respond to a terrorist attack. Larger premises and qualifying events must also consider proportionate measures to reduce vulnerability and the risk of physical harm.

Premises are generally in scope when they meet all four statutory tests: they include at least one building, are wholly or mainly used for an activity listed in Schedule 1, can reasonably expect at least 200 people—including staff—to be present at the same time from time to time, and are not excluded by the Act. Qualifying events have separate tests, including an expected attendance of at least 800 people at the same time and checks on a condition of entry.

The Act received Royal Assent on 3 April 2025. The Government stated that there would be an implementation period of at least 24 months before the main requirements commence. The statutory guidance confirms that further details will be provided on substantive commencement. Organisations can use the implementation period to assess scope, ownership and preparedness.

Qualifying premises that can reasonably expect 200–799 people, including staff, to be present at the same time from time to time are generally standard tier. Qualifying premises expecting 800 or more are generally enhanced tier. Qualifying events are subject to enhanced requirements. Places of worship and premises principally used for childcare, primary, secondary or further education remain standard tier when in scope, even if 800 or more people are expected. Higher education can fall within the enhanced tier.

When the requirements commence, the responsible person must notify the Security Industry Authority and ensure that appropriate public protection procedures are in place, so far as reasonably practicable. These procedures concern evacuation, invacuation, lockdown and communication if an act of terrorism occurs, or is suspected to be occurring, at the premises or in the immediate vicinity.

Enhanced-tier premises and qualifying events must meet the core requirements and also put in place appropriate and reasonably practicable public protection measures. These can relate to monitoring, movement, physical safety and security, and information security. The responsible person must prepare a compliance document for the SIA and, where the responsible person is an organisation, designate a senior individual to ensure compliance.

The SIA will have enforcement powers including compliance, restriction and penalty notices. The maximum non-compliance penalty for most standard-tier contraventions is £10,000. For enhanced-tier premises and qualifying events, it is £18 million or 5% of qualifying worldwide revenue—whichever is higher. Daily penalties may also apply. The Act creates criminal offences for certain serious conduct, including specified failures involving enhanced-tier premises or qualifying events.

Possibly. The key questions include how the premises are used, whether the statutory premises criteria are met and how many people—including staff—can reasonably be expected at the same time from time to time. A pub or nightclub meeting the 200-person threshold may be standard tier; one reasonably expecting 800 or more may be enhanced tier. Occasional but reasonably foreseeable busy nights can affect the assessment.

Qualifying premises used for primary, secondary or further education are treated as standard tier when 200 or more people are reasonably expected, even where attendance reaches 800 or more. The same special treatment applies to childcare premises. Higher-education premises, including universities, are treated like other qualifying premises and can be enhanced tier when the criteria are met.

For qualifying premises, the responsible person is generally the individual or organisation with control of the premises for its relevant Schedule 1 use. For a qualifying event, it is the person or organisation controlling the premises for the purposes of that event. Legal responsibility cannot be transferred to a contractor, although tasks can be delegated and parties may need to co-operate or co-ordinate.

No. Government guidance makes clear that premises and events do not have to spend money on consultants to comply. Independent support can nevertheless be useful where an organisation needs help interpreting its operating context, reviewing gaps, developing workable procedures, training staff or exercising its plans. Neither the Home Office nor the SIA endorses private-sector compliance products.

Support can include an indicative scope and readiness review, threat and vulnerability assessment, review of existing security arrangements, public protection procedures, staff training, lockdown and emergency planning, tabletop exercises and scheduled assurance reviews. Recommendations are tailored to the premises, people, operating environment and likely tier.

The Security Industry Authority will carry out the Act’s regulatory functions. Its approach is intended to include support, advice and guidance for responsible persons, alongside inspection and enforcement powers for serious or persistent non-compliance. The Home Office has also published statutory guidance and supplementary documents to help organisations determine scope and prepare.

The latest statutory guidance, scope examples and supplementary documents are available on GOV.UK. Practical protective-security resources are also available from ProtectUK.

For an initial conversation, call 07521 627 374 or email info@martyns-law.org.uk. You can also use the website enquiry-preparation form to organise the information needed for a consultation.