Martyn's Law explained

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025. It is named after Martyn Hett, one of twenty-two people killed in the Manchester Arena attack in 2017. His mother, Figen Murray, campaigned for years for legislation requiring venues to be prepared for an attack.

The Act received Royal Assent in April 2025. The Home Office published its section 27 statutory guidance in April 2026, and enforcement is expected to begin in Spring 2027. Until commencement, the duties do not apply.

Who is in scope

Martyn's Law applies to qualifying premises where 200 or more individuals may reasonably be expected to be present at the same time. Two points matter here, and most venues get at least one of them wrong.

First, the count includes everyone: staff, volunteers, contractors and performers as well as members of the public. Second, it is judged on peak use rather than a typical day. A hall that holds forty people on a Tuesday evening and three hundred at the annual village show is assessed on the three hundred.

There are two tiers:

Places of worship sit in the standard tier regardless of their capacity, as do most education settings. If you are not sure which applies to you, the free scope check takes about a minute, and the capacity calculator works through the number itself.

The four procedures

Standard tier duties centre on procedures and awareness rather than physical security. The four procedures are set out in section 5 of the Act.

Evacuation

Getting people out of the premises. Named exits, the routes to them, who checks which areas, where everyone assembles, and how far that assembly point is from the building. Most venues already have most of this in their fire evacuation plan.

Invacuation

Bringing people into the premises, or moving them to a safer part of it, when the danger is outside. This is the procedure that has no fire safety equivalent, and it is the one most venues have never considered. The practical questions are which internal spaces hold your numbers, how people get there, and how the doors are held.

Lockdown

Securing the premises to prevent someone entering. Which doors lock from the inside, who holds keys, how long it takes one person to do it, and what lockdown means for your building if the honest answer is that very little locks. Many older halls are in that position, and saying so plainly in the procedure is better than claiming a capability you do not have.

Communication

Alerting people quickly and clearly. The words used, who is authorised to say them, and how it works with no PA system, which describes most community venues. A procedure that relies on equipment you do not own is not a procedure.

There is more detail on each in the guide to the four procedures.

Everyone who works there has to know them

Writing the procedures is only half the duty. The people at the premises need to be aware of them and know what to do. For a village hall that means trustees, the caretaker, the bookings secretary, weekend cover and regular hirers. For a church it means wardens, sidespeople and the volunteers who run the toddler group.

This is the part that quietly fails. A procedure written in March and a volunteer who joined in September are not connected unless somebody connects them. Whatever system you use, it needs to survive people joining and leaving.

The responsible person

The duty sits with a specific person: the person who has control of the premises in connection with their relevant use. In practice that is usually the owner, the operator, the trustee board or the manager. Where a building is shared, leased or run by a committee it can be genuinely unclear, and it is worth settling before anything else because every other duty hangs off it.

The guide to the responsible person works through the awkward cases.

Notifying the regulator

The Security Industry Authority is the regulator for Martyn's Law. Standard tier responsible persons must notify the SIA that they hold that role. The SIA is building an online portal for this and has said it will invite volunteers to test it from early 2027.

There is no requirement for standard tier premises to send a documented assessment to the SIA. That is an enhanced tier duty. But the standard tier duty is qualified by what is reasonably practicable, which in practice means being able to show what you decided and why if you are asked.

Penalties and enforcement

For a standard tier breach the maximum penalty is £10,000, with a daily penalty of up to £500. Enhanced tier penalties are substantially higher.

How actively the SIA will inspect premises in scope is not yet known. The Home Office impact assessment puts around 178,900 sites in scope, of which roughly 154,600 are standard tier. Anyone telling you confidently how enforcement will work in practice is guessing.

What it should cost

The Government's position is that standard tier compliance relates primarily to time spent rather than cash expenditure, and that it can be achieved without procuring specialist services. The guidance is deliberately written to be followed by someone without a security background.

No third-party product or service is endorsed or approved by the Home Office or the SIA, and the Government has advised against providers claiming they can make a venue compliant. Treat any such claim as a reason for caution.

Where to start

1. Work out your true peak capacity, including staff. Use the capacity calculator if you are not certain.
2. Confirm whether you are in scope and which tier applies. The scope check covers this.
3. Settle who the responsible person is, in writing.
4. Start from your existing fire evacuation plan rather than a blank page.
5. Work through the three procedures the fire plan does not cover.
6. Tell everyone who works at the premises, and keep that current as people join and leave.

Common questions