Martyn's Law: Public Protection Procedures for Managers

Martyn's Law is coming, and for many UK and Irish-linked businesses that manage premises open to the public, it introduces a legal duty that did not exist before: a formal requirement to plan and prepare for a terrorist attack. For HR professionals, facilities managers and business owners, understanding what this means in practice — and when it takes effect — is now a compliance priority, not a future concern.

This guide explains what Martyn's Law actually requires, who it applies to, and the practical first steps a manager should be taking now, ahead of the Act coming fully into force.

What is Martyn's Law?

Martyn's Law is the popular name for the Terrorism (Protection of Premises) Act 2025. It is named after Martyn Hett, one of the 22 people killed in the terrorist attack at Manchester Arena on 22 May 2017. Martyn's mother, Figen Murray, campaigned for nearly a decade afterwards for a change in the law that would require venues and premises to plan and train for a terrorist attack, rather than treating public safety measures as optional or ad hoc.

Her campaign led directly to legislation. The Act received Royal Assent on 3 April 2025, placing new statutory duties on the people and organisations responsible for a wide range of publicly accessible premises — from retail units, hospitality venues and visitor attractions to offices, places of worship, sports grounds and event spaces.

Current status and implementation timeline

It is important for managers to be precise about where things stand, because the duties under Martyn's Law are not yet legally in force. Since Royal Assent, the UK government has been working through a structured implementation period, which includes:

• Publication of statutory guidance for duty holders (published in accessible form in August 2026)
• Formal designation of the Security Industry Authority (SIA) as the regulator responsible for advising on, and enforcing, compliance
• A public-facing online notification portal for responsible persons to register their premises

The government has set an implementation period of around 24 months from Royal Assent, and the duties are expected to come fully into force in spring 2027, with the notification portal opening to responsible persons in early 2027 ahead of enforcement. This gives organisations a working window to prepare — but that window is finite, and the guidance and regulator are already active. Businesses should treat spring 2027 as the operational deadline to be compliant by, not the date to start planning.

Because exact dates can be adjusted by secondary legislation, managers should check the official Terrorism (Protection of Premises) Act 2025 collection on GOV.UK periodically for the confirmed commencement date, rather than relying on any single article — this one included.

The two-tier system: standard and enhanced

Martyn's Law does not apply the same obligations to every premises. It uses a tiered system based on the maximum number of people it is reasonable to expect could be present at the same time:

Premises with a maximum capacity below 200 fall outside the scope of the Act altogether. Capacity is based on the premises' own reasonable assessment of maximum simultaneous occupancy, not just its licensed limit, so this is the first calculation every manager needs to get right.

What standard tier duties mean in practice

For a standard-tier premises, Martyn's Law does not require an elaborate security operation. What it requires is that the responsible person puts in place, and can evidence, reasonably practicable public protection procedures covering three core elements:

• Evacuation — how staff and the public get out of the premises quickly and safely if there is an attack
• Invacuation and lockdown — how people are moved to safety within the premises and how access points are secured when leaving is not the safer option
• Communication — how a warning is raised, how staff and visitors are informed, and how the emergency services are contacted and briefed

Crucially, staff need to actually know these procedures, not just have them filed away. That means induction and refresher training, clearly designated responsibilities (who raises the alarm, who directs evacuation, who liaises with emergency services), and periodic review as the premises or its use changes.

What enhanced tier duties add

Enhanced-tier premises — those with a capacity of 800 or more — carry everything required at standard tier, plus a materially higher bar. The key addition is a documented public protection plan, which must be kept up to date and made available to the SIA on request. This plan needs to set out:

• The physical security measures in place (such as access control, screening arrangements, and monitoring)
• The procedural measures staff follow, including training records
• How the premises would respond to, and recover from, an attack

Enhanced-tier organisations are also expected to consider more extensive physical measures — things like reinforced access points, CCTV coverage, and coordination with local police and counter-terrorism advisors — proportionate to their risk profile. Good documentation and version-controlled recordkeeping become essential here, and the same records-management discipline that applies to other compliance obligations is worth applying to this plan; our guide to records and information management for the workplace covers the retention and version-control principles that translate directly to a public protection plan.

The regulator: the Security Industry Authority

The Security Industry Authority (SIA), which already regulates the private security industry, has been designated as the regulator for Martyn's Law. Its role includes providing guidance to duty holders, running a notification system for premises, and carrying out compliance assessments — both desk-based reviews and on-site inspections — using a risk-based, intelligence-led approach. The SIA has said it will generally give at least 72 hours' notice before an inspection, though a court warrant can permit entry without notice in certain circumstances. The regulator's approach is intended to be supportive in the first instance, with enforcement powers, including notices and financial penalties, reserved for premises that fail to engage or fail to comply after being given the opportunity to do so.

Practical first steps for managers now

With enforcement expected from spring 2027, managers and business owners do not need to panic — but they should not wait either. Sensible first steps include:

• Carry out a capacity assessment. Establish, on a reasonable and documented basis, the maximum number of people who could be present in your premises at once. This determines whether you fall outside the Act, into the standard tier, or into the enhanced tier.
• Conduct or refresh your risk assessment. Identify vulnerabilities specific to your premises — entry and exit points, areas of high footfall, and where a lockdown or evacuation would be most difficult to manage.
• Review existing security and evacuation procedures. Many organisations already have fire evacuation plans; these need to be extended and adapted to cover a deliberate attack scenario, which behaves differently from a fire.
• Train staff properly. Procedures on paper are not enough — staff need practical training in recognising a threat, raising the alarm, and executing evacuation, invacuation and communication procedures under pressure. Structured, recognised training is a useful way to build this capability and demonstrate due diligence; Learnsignal's CPD training courses can support HR and operations teams building this kind of workplace preparedness and compliance capability into their wider training programme.
• Assign clear ownership. Decide now who within the organisation is the “responsible person” under the Act, and make sure that role has the authority and budget to act.

Frequently asked questions

When does Martyn's Law come into force?

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, but the operative duties are not yet in force. The government has set an implementation period of around 24 months, with duties expected to take effect in spring 2027. Always check the official GOV.UK collection page for the confirmed date, as secondary legislation can adjust it.

Does Martyn's Law apply to my business?

It applies to premises where it is reasonable to expect 200 or more people could be present at the same time, and to certain qualifying public events. Premises below that threshold fall outside the Act, though good practice around evacuation and lockdown planning is sensible regardless of size.

What is the difference between the standard and enhanced tier?

Standard tier (200–799 capacity) requires reasonably practicable procedures for evacuation, invacuation/lockdown and communication, along with staff awareness. Enhanced tier (800+ capacity) adds a documented public protection plan and more extensive physical and procedural security measures, which must be available to the SIA on request.

Who enforces Martyn's Law?

The Security Industry Authority (SIA) has been designated as the regulator. It provides guidance, operates a notification system, and carries out risk-based compliance assessments, with enforcement action reserved for premises that fail to comply after being given the opportunity to do so.

What should we do before the Act comes into force?

Start now with a capacity assessment, a risk assessment specific to your premises, a review of existing evacuation and security procedures, and staff training. Waiting until enforcement begins leaves too little time to build procedures and embed them with staff.

Martyn's Law represents a genuine shift in how UK premises are expected to plan for the threat of terrorism, turning what was previously good practice for some organisations into a legal duty for many more. Getting ahead of the spring 2027 commencement date — rather than scrambling once enforcement begins — puts your organisation, and the people who work in and visit your premises, in a far stronger position. Learnsignal's CPD course hub has a growing range of workplace compliance and risk management training to help your team build the skills this new duty demands.