Martyn's Law in plain English
The Terrorism (Protection of Premises) Act 2025 is short, and most of what is written about it is longer than it needs to be. This page is the version you can read in five minutes and then get on with something else.
If somewhere you control might have 200 or more people in it at the same time, you have to write down what your staff would do in an attack, make sure they know it, and be able to show that you did. That is standard tier. Everything else is detail.
Where the law came from
The Act is named after Martyn Hett, who was killed in the Manchester Arena attack in May 2017. His mother, Figen Murray, campaigned for eight years for a legal duty on venues to prepare. The Act received Royal Assent on 3 April 2025.
It is worth holding on to that, because it explains the shape of the law. It is not a security procurement regulation. It asks whether the people working in a building on an ordinary evening would know what to do, and it makes somebody accountable for the answer.
The two tiers
Which tier you are in depends on how many people it is reasonable to expect at the premises at the same time. The number is about occupancy on a busy occasion, not floor area and not your average week.
| Tier | Applies from | What it asks for |
|---|---|---|
| Standard | 200 people | Documented public protection procedures and staff who are aware of them. No physical security measures required. |
| Enhanced | 800 people | Everything in standard tier, plus public protection measures, a documented assessment, and a named senior individual. |
The gap between the two is much wider than the numbers suggest. Standard tier is a writing and training job you can do yourself. Enhanced tier involves assessing your premises and putting measures in place, and the penalties are on a different scale entirely.
Work out which tier you are in, per site.
What standard tier actually requires
Four procedures, covering what people should do if an attack happens at or near the premises. In the Act's language these are public protection procedures.
- Evacuation. Getting people out of the building safely.
- Invacuation. Bringing people in, or moving them to a safer part of the building, when outside is the more dangerous place to be.
- Lockdown. Securing the premises to stop somebody getting in. Locking doors, closing shutters, stopping entry.
- Communication. How you alert the people in the building, and how staff pass information to each other and to the emergency services.
Then the second half, which is the part that gets forgotten: the people working there have to be made aware of the procedures. Not certified, not examined. Aware. That is a lower bar than most suppliers imply, and it is still a real one when your staff turn over three times a year.
CCTV, bag search, bollards, barriers, security staff, physical alterations to the building, or a risk assessment in the formal sense. If somebody is selling you equipment on the basis that standard tier requires it, they are selling you something the law does not ask for.
Who has to do it
The duty falls on the responsible person, which the Act defines as whoever has control of the premises in connection with their use. That is a practical test about who runs the place, not a property test about who owns it. In a managed pub it is the operating company. In a tenanted pub it is usually the licensee.
For an organisation running many premises, this is the question to settle before any other, because it decides which sites are your problem at all. The longer answer is here.
Who enforces it, and what it costs to get wrong
The regulator is the Security Industry Authority, the same body that licences door supervisors. The SIA has said its approach will start from advice and guidance rather than immediate penalties, which is what you would expect from a regulator taking on 279,000 new premises at once.
The maximum penalty at standard tier is £10,000. That is per premises, and for a group running forty sites in scope the arithmetic is worth doing before somebody else does it for you. The estate view models it.
Enhanced tier penalties are far higher and are calculated against turnover. If you are in enhanced tier, this page is not the guidance you need.
When it starts
Enforcement is expected in spring 2027, with April 2027 the earliest possible date. The Government committed to an implementation period of at least 24 months from Royal Assent, and both the Home Office and the SIA have said no enforcement action will be taken during that period. The full timeline is here.
What to actually do about it
In order, and most of it is free.
- List every premises you control and record the busiest reasonable occupancy of each. That tells you which are in scope.
- Establish, in writing, which of those you are the responsible person for.
- Write the four procedures. The ProtectUK templates are free, official and good. Do not pay a consultant for this.
- Put your staff through ACT Awareness eLearning, which is also free and official.
- Keep a record of who was trained, when, and what version of the procedures was in place at the time.
Steps one to four are a job. Step five is a job that never finishes, and it is the only one we sell anything for.
This is a plain-English summary, not legal advice. Where a premises is genuinely borderline, or where you think you may be in enhanced tier, the statutory guidance and a solicitor will settle it better than a web page.
Primary sources: the Terrorism (Protection of Premises) Act 2025, the Home Office statutory guidance published April 2026, the SIA's role as regulator, and ProtectUK.