Compliance update – UK Martyn’s Law

The Terrorism (Protection of Premises) Act 2025 received royal assent on 3 April 2025.

It applies across the UK and is commonly known as ‘Martyn’s Law’ in tribute to Martyn Hett who was one of the victims of the 2017 Manchester Arena terror attack.

The aim of Martyn’s Law is to enhance public safety by ensuring better preparedness for, and protection from, terrorist attacks.

In this article, we explain the steps that organisations must take to comply with the 2025 Act.

Application of Martyn’s Law

The 2025 Act applies to (1) “qualifying premises” and (2) “qualifying events”.

The term “qualifying premises” is explained in section 2 of, and Schedule 1 to, the 2025 Act. It includes buildings or a building and other land, wholly or mainly used for certain purposes such as retail, sale of food or drink, sports grounds, museums or galleries, venues for hire, hotels, education organisations and hospitals.

There is a tiered system within “qualifying premises”. “Standard duty premises” are premises where it is reasonable to expect 200 to 799 individuals to be present at the same time. “Enhanced duty premises” are premises where it is reasonable to expect 800 or more individuals to be present at the same time.

The term “qualifying events” is explained in section 3 of the 2025 Act. It applies to events attended by members of the public that are not “enhanced duty premises” but where it is reasonable to expect that at some point during the event, 800 or more individuals may be present on the premises at the same time. Examples include music and sporting events. Certain premises are excluded by virtue of Schedule 2 to the 2025 Act such as some parks or gardens.

Essentially therefore, we have a three-tier system:

1. Under 200 members of the public – not caught by the 2025 Act.
2. Between 200 – 799 individuals in connection with certain uses – “standard duty premises”.
3. Over 800 individuals in connection with certain uses – either “enhanced duty premises” or “qualifying events”

Compliance measures

The 2025 Act creates obligations for individuals / organisations in control of the relevant premises / event. The Home Office Factsheet gives an example: “if a concert is to be held in a park and the company putting on the event takes control of an area of the park for the purposes of that concert, the company putting on the event will be the responsible person. Conversely, if a stately home puts on a concert in its grounds and maintains control of the site for the purposes of that concert, the stately home will be the responsible person.”

Individuals / organisations meeting the control test are responsible persons for the purposes of the 2025 Act and must ensure so far as is reasonably practicable (1) “public protection procedures” for “qualifying premises” (i.e. both “standard duty premises” and “enhanced duty premises”) or “qualifying events” such as evacuation, invacuation, lockdown and communication procedures, and (2) “public protection measures” for “enhanced duty premises” and “qualifying events” designed to reduce the vulnerability of the premises or event to acts of terrorism, and to reduce the risk of physical harm being caused to individuals if an act of terrorism were to occur on the premises. The measures taken require to be documented and provided to the Security Industry Authority (“SIA”), the 2025 Act regulator.

Non-compliance

The SIA has extensive investigation powers under Schedule 3 to the 2025 Act including requiring individuals to answer questions at interview, entering premises and seizing evidence.

Where non-compliance is identified, the SIA can issue compliance notices (requiring certain action) or restriction notices (restricting certain events from taking place). There is a right of appeal against both kinds of notice. It is a criminal offence to fail to comply with a notice issued by the SIA.

The SIA also has the power to issue monetary penalties where non-compliance is identified. The sums are significant – the maximum amount is the greater of (1) £18 million and (2) 5% of worldwide revenue.

Given the subject matter, any non-compliance will likely attract significant media and stakeholder attention and accordingly there is significant risk of damage to reputation associated with a breach.

Next steps

There is set to be a two-year implementation period before the 2025 Act comes into force. In that period, we can expect further guidance both from the Home Office and the SIA.

Organisations should use the implementation period to identify if premises / events under their control are caught by the 2025 Act and, if so, to map out the required compliance procedures / measures.

If you require support in relation to the 2025 Act, please get in touch with Ramsay Hall.