What is Martyn's Law? A plain-English guide to the 2025 Act
Last reviewed:
Martyn's Law is the Terrorism (Protection of Premises) Act 2025, a UK law that requires places where the public gathers to take proportionate steps to be ready in the event of a terrorist attack. It received Royal Assent on 3 April 2025 and applies to England, Wales, Scotland and Northern Ireland (guidance para 1.3). It creates two tiers of duty based on how many people a premises can hold, and the duties are expected to commence in spring 2027.
The important thing to know up front: for most venues the legal bar is deliberately low and proportionate. You do not need a consultant, a risk assessment document, physical security equipment, or to buy any product to comply. This page explains the whole Act in plain English, then points you to the deeper guides for your situation.
Where the name comes from
The Act is named after Martyn Hett, one of 22 people killed in the Manchester Arena attack in 2017. His mother, Figen Murray, campaigned for years for a law requiring venues to plan properly for such events. We mention this because it matters, not to frighten anyone. The whole point of the law is that reasonable, well-understood preparation saves lives, and for most premises that preparation is genuinely manageable.
The two tiers
Which tier you fall into depends on the number of people who can reasonably be expected at the premises at the same time, from time to time, including staff and volunteers. It is not average attendance and not simply your licensed capacity.
| Standard tier | Enhanced tier | |
|---|---|---|
| Capacity | 200–799 people | 800+ people |
| Core duty | Public protection procedures (how you'd respond) | Procedures plus public protection measures that reduce vulnerability |
| Documentation | No document legally required (para 7.32) | Compliance document required, submitted to the regulator |
| Maximum penalty | £10,000 civil penalty (+£500/day) | Up to £18m or 5% of worldwide revenue |
The overwhelming majority of pubs, village halls, churches, gyms and restaurants are standard tier, and that's the tier this whole service is built around. See the standard tier explained for the full detail, and note the £18m headline figure you may have seen belongs only to the enhanced tier.
Who is in scope?
A premises is caught if it meets four conditions: it is a building (or a group of buildings, or a defined part of one); it is used for one of the 17 types of activity in Schedule 1 (shops, food and drink, entertainment and leisure, sports grounds, halls, places of worship, education and more); it is open to the public; and 200 or more people can reasonably be expected there at the same time from time to time.
"Members only" is not an escape route: limiting entry to members or guests of a club doesn't stop premises being publicly accessible (para 4.7), so golf clubs, gyms and members' clubs are still in scope if the numbers are met. A one-off surge can also pull a venue in; see the annual festival trap. Certain premises are excluded by Schedule 2 (see the FAQs below).
What standard-tier venues must actually do
Two things. First, notify the regulator (the Security Industry Authority) that the premises exists, a one-time notification; the online portal is not yet live. Second, have public protection procedures in place so far as is reasonably practicable. There are four types:
- Evacuation: getting people out and away from danger.
- Invacuation: moving people to a safer place inside the building.
- Lockdown: securing the premises to keep danger out.
- Communication: alerting people quickly and telling them what to do.
The procedures have to be appropriate to your venue, and the people with a role in carrying them out must know that role (para 7.51). That's it for the standard tier. The checklist turns this into concrete steps.
What is NOT required at the standard tier
This is where most of the fear online is simply wrong. At the standard tier you do not need: a terrorism risk assessment, physical security measures (CCTV, barriers, bag searches), accredited or paid staff training, a designated senior individual, or to buy any product or service. The guidance states plainly: "it is not mandatory to use third-party products or services to comply with the Act's requirements" (para 6.7). There is also no statutory annual review; reviewing periodically is recommended good practice, not law (para 7.29).
Do you need a written plan?
No, not legally, at the standard tier. The guidance is explicit: "there is no legal requirement to prepare a document stating the procedures in place… However, the responsible person should prepare a document like this" because it is otherwise very hard to demonstrate compliance at an inspection (para 7.32). So a written plan is strongly recommended and sensible, just never mandatory. Anyone telling you a written plan is a legal requirement at the standard tier is overstating the law.
What are the penalties?
At the standard tier, enforcement is civil, not criminal. The regulator can issue compliance notices and then monetary penalty notices up to a maximum of £10,000, plus daily penalties of up to £500 a day for continuing to ignore a notice (paras 9.14, 9.16). Failing to comply with a compliance notice at the standard tier is not a criminal offence (guidance figure 16).
The £18 million / 5%-of-revenue figure in the headlines applies only to the enhanced tier (800+) and qualifying events, so never quote it at a standard-tier venue. A few criminal offences do attach to conduct regardless of tier, such as knowingly giving the regulator false or misleading information (section 25). The lesson is simply: whatever you document, make it true.
When does it start, and what should you do now?
The duties are expected to commence in spring 2027, after an implementation period to give venues time to prepare. Nothing is required of you before then, but the sensible steps are straightforward:
- Check which tier you're in, free, about two minutes, no email required. Include staff, and use realistic peaks, not fire capacity.
- Keep a dated note of how you worked out your numbers. The method has to be evidenced (para 4.25).
- Walk your building and think through the four procedures. Read the free official material on ProtectUK.
- When you're ready to turn that thinking into a documented, staff-briefed, inspection-ready plan, that's what we're building the service for.
From here, dig into the standard tier, or read the guide for your kind of venue: pubs & bars, village halls, churches, golf & sports clubs or gyms.
Frequently asked questions
Is Martyn’s Law in force yet?
Not yet. The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, but the duties are expected to commence in spring 2027 after an implementation period. There is no obligation on venues until commencement; the time before then is for getting ready.
What is the statutory guidance?
It is the official Home Office guidance published under the Act that explains how the duties work in practice, with worked examples. It is the source we cite throughout: paragraph references in our guides point to it. It is guidance on the law, not the law itself, but the regulator will expect you to have regard to it.
Which premises are exempt from Martyn’s Law?
Premises below 200 capacity are outside both tiers, and Schedule 2 excludes certain premises, for example freely accessible parks and gardens while access is uncontrolled, some transport premises already covered by other security regimes, and Parliament. There must also be a building for premises to qualify (para 4.7).
Are universities covered by Martyn’s Law?
Higher education premises can fall into either tier depending on capacity. Places of worship and childcare, primary, secondary and further education premises are always standard tier regardless of how many people they hold; only higher education can be enhanced tier.
Does Martyn’s Law apply across the whole UK?
Yes. The Act applies to England, Wales, Scotland and Northern Ireland (guidance para 1.3). The tiers, thresholds and duties are the same across all four nations.
Sources: Terrorism (Protection of Premises) Act 2025; Home Office statutory guidance (April 2026, updated May 2026) and supplementary documents. Paragraph references are to the statutory guidance. General information, not legal advice. Contains public sector information licensed under the Open Government Licence v3.0.