Martyn’s Law: a plain-English guide for UK venues

Martyn’s Law is the everyday name for the Terrorism (Protection of Premises) Act 2025— named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena attack. It is sometimes searched as “Martin’s Law” or “Martins Law”; the correct spelling is Martyn’s Law. This guide explains, in plain English, who needs to prepare, what the two tiers require, and what to do now. It is preparation and readiness information, not professional advice — the responsible person makes the final call.

Want the short version for your own venue? Run the free readiness checker — about five minutes, no account.

When does it come into force?

Not yet. The Act received Royal Assent on 3 April 2025 with an implementation period of at least 24 months, so the duties are expected to commence in spring 2027. There is no legal requirement to act before commencement — but the Home Office published statutory guidance in April 2026 so venues can prepare early, and the work is far easier done calmly now than in a rush later. The Security Industry Authority (SIA) will be the regulator, and its notification portal is not yet live.

Who is in scope?

Two things bring a venue into scope: it’s used for a qualifying activity, and enough people can reasonably be expected there at once.

• Qualifying premises (section 2): a building (or building and land) wholly or mainly used for one or more uses in Schedule 1 of the Act — which covers hospitality, entertainment, retail, leisure, places of worship, healthcare, education and more — where it is reasonable to expect 200 or more individuals to be present at the same time, from time to time. Staff count toward that number.
• Qualifying events (section 3): an event at premises that are not already enhanced, where the public has access, entry is controlled (by ticket, pass, membership or payment), and 800 or more individuals may be present at some point.

“From time to time” means your predictable peaks — match days, a music night, a busy service — not a quiet Tuesday average. Working out that realistic peak, and being able to show how you got there, is the single most important step.

The two tiers: standard and enhanced

The Act sets two tiers by the number of people reasonably expected at the same time:

A few Schedule 1 uses (for example schools and places of worship) are treated as standard even above 800. Higher education is not. If you are near a threshold, that is exactly what the readiness checker is for.

The four public protection procedures (section 5)

Every in-scope venue, standard or enhanced, needs simple procedures for staff to follow if an attack is happening or about to happen on or near the premises:

• Evacuation: getting people out safely.
• Invacuation: bringing people in, or moving them to a safer place inside.
• Lockdown: preventing people entering or leaving — without ever blocking a fire exit.
• Communication: alerting and instructing people on the premises.

At the standard tier these can be no-cost, common-sense procedures written down and known by staff. ProtectUK publishes free guidance and training to help.

Enhanced duty: measures and documentation (sections 6–7, 10)

Enhanced premises and qualifying events must, so far as reasonably practicable, also have public protection measures in place across four areas: monitoring the premises and immediate vicinity; the movement of people in, out and around; physical safety and security; and the security of information. They must keep a document setting out their procedures and measures and provide it to the SIA, and — where the responsible person is an organisation — designate a senior individual responsible for it.

Who holds the duty, and how it’s enforced

The duty falls on the person who has control of the premises or event (section 4) — which is not always the owner. The SIA oversees the requirements and can issue compliance and restriction notices and, for serious or persistent failures, financial penalties. The penalty ceilings are much higher at the enhanced tier than the standard tier, which is another reason to be clear which tier you are in.

What to do now

1. 1Work out your realistic peak headcount, staff included, and note how you got there.
2. 2Confirm which tier that puts you in — standard, enhanced, or a qualifying event.
3. 3Draft the four procedures for your actual layout, and make sure staff know them.
4. 4Keep a dated record — the evidence trail is what shows you were prepared.