Martyn's Law in plain English
The Terrorism (Protection of Premises) Act 2025 is a short Act, and most of what's written about it is a lot longer than it needs to be. This is the five-minute version.
If somewhere you control might have 200 or more people in it at once, you need procedures for what your staff would do in an attack. Your staff need to know them, and you have to tell the SIA you're responsible. The law doesn't strictly require the procedures to be written down. The guidance recommends it, though, and it's the only way to show you did it. That's standard tier.
Where the law came from
The Act is named after Martyn Hett, who was killed in the Manchester Arena attack in May 2017. His mother, Figen Murray, campaigned for eight years for a legal duty on venues to prepare. The Act received Royal Assent on 3 April 2025.
That history explains a lot about how it's written. It isn't about buying security kit. It asks whether the people working in a building on an ordinary evening would know what to do, and it makes someone accountable for that.
The two tiers
Your tier depends on how many people it's reasonable to expect at the premises at the same time. That means occupancy on a busy occasion. Floor area and your average week don't come into it.
| Tier | Applies from | What it asks for |
|---|---|---|
| Standard | 200 people | Public protection procedures, staff who are aware of them, and notifying the SIA. Writing the procedures down is recommended but not required. No physical security measures required. |
| Enhanced | 800 people | Everything in standard tier, plus public protection measures, a documented assessment, and a named senior individual. |
The two are much further apart than the numbers suggest. Standard tier is mostly writing and training, and you can do it yourself. Enhanced tier means assessing your premises and putting measures in place, and the penalties are on another scale.
Work out which tier you are in, per site.
What standard tier requires
Four procedures covering what people should do if an attack happens at or near the premises. The Act calls these public protection procedures.
- Evacuation. Getting people out of the building safely.
- Invacuation. Bringing people in, or moving them to a safer part of the building, when it's more dangerous outside.
- Lockdown. Securing the premises to stop someone getting in: locking doors, closing shutters, stopping entry.
- Communication. How you alert people in the building, and how staff pass information to each other and to the emergency services.
Then there's the part people forget. The staff working there have to be made aware of the procedures. They don't need certificates or a test. That's a lower bar than most suppliers suggest, but it still takes work when your staff turn over three times a year.
There's also a notification duty. Whoever is responsible for qualifying premises must notify the SIA when they become responsible and when they stop. The Secretary of State still has to set the timeframes and what information is needed. For a group, it's one more thing to keep up to date per site.
CCTV, bag searches, bollards, barriers, security staff, physical changes to the building, or a formal risk assessment. If someone's selling you equipment because standard tier "requires" it, the law doesn't ask for it.
Who has to do it
The duty falls on the responsible person. The Act defines that as whoever has control of the premises in connection with their use. It's about who runs the place, not who owns it. In a managed pub that's the operating company. In a tenanted pub it's usually the licensee.
Be sure about that last one, because the guidance got it wrong at first. As published in April 2026, it used a leased pub as an example and named the brewery as the responsible person. A correction slip dated 6 August 2026 changed that to the tenant, who's the one in control. If you decided this in the spring, check it again.
If you run lots of premises, sort this out first. It decides which sites are yours to deal with at all. The longer answer is here.
Who enforces it, and the penalties
The regulator is the Security Industry Authority, the same body that licenses door supervisors. The SIA has said it'll start from advice and guidance rather than going straight to penalties. With around 155,000 standard tier premises arriving at once, that's what you'd expect.
The maximum penalty at standard tier is £10,000, plus up to £500 for each day a contravention continues after the deadline. That's per premises. If you run forty sites in scope, do the sums before someone else does. The estate view models it.
Enhanced tier penalties are much higher and are calculated against turnover. If you're in enhanced tier, you'll need more than this page.
When it starts
Enforcement is expected in spring 2027, with April 2027 the earliest possible date. The Government committed to an implementation period of at least 24 months from Royal Assent, and the Home Office has said there's no legal requirement to comply until the Act comes into force. The full timeline is here.
What to do now
Roughly in this order. Most of it's free.
- List every premises you control and note the busiest reasonable occupancy of each. That tells you which are in scope.
- Establish, in writing, which of those you're the responsible person for.
- Notify the SIA for each of them once the notification process is set out.
- Write down the four procedures. The ProtectUK templates are free, official and good. You don't need a consultant for this.
- Put your staff through ACT Awareness eLearning, which is also free and official. It's recommended, not a legal requirement.
- Keep a record of who was trained, when, and which version of the procedures was in place at the time.
The first five are one-off jobs. The sixth never finishes, and it's the only one we sell anything for.
This is a plain-English summary, not legal advice. If a premises is borderline, or you think you might be in enhanced tier, the statutory guidance and a solicitor will settle it better than a web page.
Primary sources: the Terrorism (Protection of Premises) Act 2025, the Home Office statutory guidance published April 2026 and corrected on 6 August 2026, the SIA's role as regulator, and ProtectUK.