Martyn's Law explained

Martyn's Law is the commonly used name for the Terrorism (Protection of Premises) Act 2025. It was introduced to improve preparedness and public protection at certain premises and events in the UK, and is named in memory of Martyn Hett, who was killed in the Manchester Arena attack in 2017.

What the Act asks for

The law requires those responsible for qualifying premises and events to take appropriate steps to reduce the risk of physical harm if a terrorist attack occurs at their premises or nearby.

That last phrase matters. The duty is not only about an attack at your building. It also covers what happens if something occurs nearby and people need to be brought inside, kept away from glass, moved to a safer area, or told what is happening.

The aim is not to predict or prevent every possible incident. It is to make sure organisations have considered what they can reasonably do to protect people and respond effectively — and that the people working there know what to do.

Proportionality is built into the law

The requirements are proportionate to the size and circumstances of the premises. A 300-capacity village hall run by volunteers is not asked to do what a 15,000-capacity arena is asked to do. Qualifying premises are generally divided into two tiers, with additional requirements applying to larger premises and to qualifying events.

Numbers include staff, not just customers or visitors — a point that catches out a lot of organisations working from a fire-safety occupancy figure they half remember.

The exceptions that catch people out

Capacity alone does not determine whether Martyn's Law applies, or which tier you are in. Two exceptions in particular are worth knowing:

• Qualifying places of worship remain within the Standard Tier even where 800 or more people may be present.
• Premises used for childcare, primary or secondary education, or further education also remain within the Standard Tier at any size.

Beyond those, the type and use of the premises, the number of people reasonably expected to be present, exclusions and special provisions all need to be considered together. If you are close to a threshold, or your premises does more than one thing, this is worth working through carefully rather than assuming.

What Standard Tier is really about

Standard Tier is centred on public protection procedures: what people should do if something happens. In practice that means being able to answer, clearly and consistently:

• Evacuation — how do we get people out, where do they go, who decides, who checks?
• Invacuation — if outside is worse, where do we bring people, and how many fit?
• Lockdown — how do we secure the premises, who authorises it, how does it end?
• Communication — how do we tell staff, visitors, contractors and responders?

None of this requires a security consultant. It requires somebody to sit down, think it through for their particular building, write it down, and tell the staff. The hard part is usually not the thinking — it is doing it in a form that survives the next twelve months.

What Enhanced Tier adds

Enhanced Tier keeps everything in Standard Tier and adds a fuller consideration of public protection measures — the things you might put in place, rather than only what people do in the moment. Broadly:

• Monitoring — how the premises and its surroundings are watched, and how something noticed gets reported.
• Movement of people — how people arrive, queue, enter, move around and leave, and where crowds build.
• Physical protection — doors, glazing, barriers, vehicle access, and what is proportionate here.
• Information security — protecting the plans, layouts and staffing patterns that would help someone plan an attack.

Enhanced Tier also requires that, where an organisation is the Responsible Person, it designates an appropriate senior individual to ensure the organisation complies with its requirements.

Where organisations go wrong

Having read a lot of preparedness documentation, the same handful of problems recur — and none of them are about not caring:

• The plan exists but nobody has been told. A well-written evacuation plan in a folder protects nobody. Briefing, and a record of who was briefed, is the part that counts.
• The plan was true once. Staff change, a fire exit is reconfigured, the assembly point becomes a building site. Nothing prompts a review, so nothing gets reviewed.
• Findings never become actions. An assessment identifies six things to sort out. Without an owner, a date and something that chases it, most of them do not happen.
• The number is wrong. Occupancy is guessed, or taken from a fire figure that excludes staff, and the tier assessment is built on it.
• Everything is somewhere different. The assessment is in one drive, the plans in another, the photographs on someone's phone, the briefing record in an inbox.

A sensible order to do this in

1. Work out, honestly, the greatest number of people who could be present at once — including staff.
2. Establish who the Responsible Person is, and whether anyone else operates within the same location.
3. Identify your likely tier, and check the exceptions.
4. Assess the premises: how it is laid out, how people move through it, and what could realistically go wrong.
5. Write the four procedures, in terms a member of staff could follow under pressure.
6. Brief people, and record that you did.
7. Turn every gap into an action with an owner and a date.
8. Put a review date in the diary, and keep the evidence together.

Where the definitive answers are

This article is written to help you get oriented. It is not legal advice and it is not a substitute for the statutory guidance. For definitive information about whether your premises or event is within scope, and what is required of you, refer to the current statutory guidance issued under the Terrorism (Protection of Premises) Act 2025.