What is Martyn’s Law?
Martyn’s Law is the Terrorism (Protection of Premises) Act 2025. It puts a legal duty on the people responsible for certain UK premises and events to plan for a terrorist attack and to have procedures ready that would keep the public safer if one happened. The threshold is 200 people. If 200 or more could reasonably be expected on your site at the same time, you are almost certainly in scope.
Martyn’s Law has already passed. It received Royal Assent on 3 April 2025 and the Home Office published its final statutory guidance on 15 April 2026. The duties do not start until spring 2027.
Martyn’s Law at a glance
200+ People
Applies to qualifying premises and events in the UK where 200 or more people may be present at the same time.
Two Tiers
Set by capacity. The standard tier is 200 to 799. The enhanced tier is 800 or more.
Standard Tier
Notify the SIA, and hold public protection procedures for evacuation, invacuation, lockdown and communication.
Enhanced tier
Also put physical security measures in place and give the SIA a documented assessment.
SIA regulates
Fines reach £10,000 in the standard tier and the greater of £18 million or 5% of qualifying worldwide revenue in the enhanced tier.
Spring 2027
Duties are expected to come into force in spring 2027.
Where Martyn’s Law Stands Right Now
Last reviewed: October 2026
Law Since 3 April 2024
When the Act received Royal Assent.
Not Enforceable Yet
The government set a minimum 24-month implementation period, and the SIA cannot enforce anything until commencement regulations take effect. Expected spring 2027.
Notification opens in 2027
Through an online portal.
Who does Martyn’s Law apply to?
Martyn’s law applies to you, if all 3 of these are true:
- Your premises are used for one of the purposes listed in Schedule 1 of the act
- 200 or more people could reasonably be expected in your venue at the same time
- The premises are not excluded under schedule 2
The 200 Person thereshold, and what counts towards it
The test is whether it is reasonable to expect 200 or more people present at the same time. Fire capacity and ticket sales are not the measure. Three things catch people out:
Staff count. The number is everyone on site, not just the public.
It covers the whole premises, not the busiest room. A school hall that holds 150 is irrelevant if 900 pupils and staff are on the site.
Occasional peaks count. A village hall that is empty most weeks and holds 300 for a wedding is in scope.
With no fixed count to work from, use the evidence you have: sign-in records, ticketing data, historic attendance, staff rotas.
Qualifying premises
Schedule 1 brings these uses into scope:
- Shops, shopping centres and retail parks
- Food and drink venues, from restaurants to nightclubs
- Entertainment and leisure venues, including theatres, cinemas, stadiums and sports grounds
- Museums, galleries, libraries and visitor attractions
- Hotels and visitor accommodation
- Schools, colleges, universities and childcare settings
- Hospitals and healthcare premises
- Places of worship
- Public authority offices, including council buildings
- Public transport hubs
- Village halls and community centres
Schedule 2 excludes some premises, including most workplaces the public cannot access, transport premises already covered by other security regimes, and Parliament.
Qualifying events
Events are treated separately from the premises they run on. An event is in scope if the public can access it, there are entry checks such as ticket inspection or a bag search, and 800 or more attendees are expected. A one-off festival in a park can qualify even though the park itself never would.
Standard Tier and Advanced Tier
| Standard tier | Enhanced tier | |
|---|---|---|
| Capacity | 200 to 799 | 800 or more |
| Notify the SIA | Yes | Yes |
| Public protection procedures | Yes: evacuation, invacuation, lockdown, communication | Yes |
| Public protection measures | No | Yes: monitoring, movement of people, physical safety and security, security of information |
| Documented assessment to the SIA | No | Yes |
| Named senior individual | No | Yes |
| Maximum fine | £10,000 | Greater of £18m or 5% of qualifying worldwide revenue |
Schools, childcare settings and places of worship stay in the standard tier, whatever their capacity. A 1,400-pupil secondary school is standard tier, not enhanced. Most people get this exemption wrong, and it means the duties on most educational settings are lighter than the headlines suggest.
What it means for your sector
Schools, colleges and trusts
Likely tier: Standard, at any size
What changes: Notify the SIA and hold credible procedures. No physical security measures required
Venues, stadiums and theatres
Likely tier: Enhanced if you hold 800+
What changes: Documented measures plus an assessment to the SIA
Events and festivals
Likely tier: Enhanced
What changes: Judged per event. Organiser and landowner must agree who holds the duty
Healthcare
Likely tier: Enhanced for most acute hospitals
What changes: Full enhanced-tier duties
Places of worship
Likely tier: Standard, at any size
What changes: Procedures and notification only
Offices and manufacturing
Likely tier: Usually out of scope
What changes: Excluded where the public has no access. A public reception or shop changes that
Councils and public buildings
Likely tier: Depends on the building
What changes: Assess libraries, leisure centres and halls individually
Who is exempt from Martyn’s Law?
- Premises expecting fewer than 200 people at the same time
- Premises excluded by Schedule 2: private workplaces the public cannot access, transport premises already regulated under aviation and rail security regimes, and Parliament
Exemption from Martyn’s Law does not remove any duty you already have under health and safety or fire safety law.
Does Martyn’s Law apply across the UK?
Yes. Counter-terrorism is reserved, so the same duties and regulator apply in England, Scotland, Wales and Northern Ireland.
Who is the responsible person?
For premises, whoever has control of the premises in connection with its Schedule 1 use. That can be an individual, a company or an organisation. For events, whoever controls the premises the event is held on.
Where control is shared, Martyn’s Law expects the parties to agree in writing who holds the duty and to co-ordinate where responsibilities overlap. Shopping centres, multi-tenant buildings and leased school premises all need that conversation on the record.
Enhanced tier organisations must also name a senior individual with oversight of compliance. Senior managers can be personally liable where they consented to an offence, were involved in it, or were negligent about it.
Martyn’s Law requirements: what you actually have to do
Martyn’s Law compliance rests on two things. Knowing who is on your site, and being able to show what you would do if the worst happened.
If you are standard tier
- Notify the SIA that you are in scope, and tell them who your responsible person is, through the portal opening in 2027.
- Put public protection procedures in place, so far as is reasonably practicable, covering:
Evacuation
Getting people out of the premises safely.
Invacuation
Bringing people in, or moving them to a safer part of the building, when outside is more dangerous than inside.
Lockdown
Securing the site to stop an attacker getting in.
Communication
Getting information to everyone on site, quickly and reliably.
Standard tier requires no equipment purchase and no physical changes to the building. These are procedures, and they need to be documented, understood by staff, and workable on the day.
Who enforces Martyn’s law?
The Security Industry Authority, which already licenses the private security industry, has been given a new function for Martyn’s Law. It is a duty of care, closer in spirit to fire safety regulation than to counter-terrorism policing, and the SIA has said it will regulate it that way:
- Risk-based, not blanket. Desk-based assessments, with site inspections where there is reason for one.
- Normally 72 hours’ notice of an inspection, though it can seek a court warrant to enter without notice.
- Three enforcement tools. Compliance notices, restriction notices, and monetary penalties.
The SIA’s stated position is that it will support organisations to comply first and penalise as a last resort. Easier to rely on if you can show you started early.
Penalties for non-compliance
| Breach | Standard Tier | Enhanced Tier |
|---|---|---|
| Maximum penalty | £10,000 | Greater of £18m or 5% of qualifying worldwide revenue |
| Daily penalty for continued breach | Up to £500 | Up to £50,000 |
Some breaches are criminal rather than civil, and the more serious can carry a custodial sentence: failing to comply with a restriction notice, obstructing the SIA, and providing false or misleading information to the regulator. Senior managers can be personally liable where they consented to, were involved in, or were negligent about an offence by their organisation.
Martyn’s Law compliance: how to get ready before spring 2027
Count properly.
Everyone who could reasonably be on site at once, staff included. Record your reasoning.
Confirm your tier
Under 200, out of scope. 200 to 799, standard. 800 or more, enhanced, unless you are a school, childcare setting or place of worship.
Check Schedule 1 and Schedule 2
Multi-use sites often have one part in scope and another out.
Name your responsible person,
in writing where control is shared.
Write your four procedures.
Evacuation, invacuation, lockdown, communication.
Train your people
ProtectUK’s free ACT awareness training is the usual starting point.
Keep the records
Compliance is judged on what you can evidence, not what you intended.
Diarise your review
Capacity, staff and buildings all change.
How sign-in and evacuation systems help you evidence your procedures
An accurate record of who is on site is what two of the four required procedures depend on. Evacuation needs a live list of everyone in the building. Communication needs a way to reach them. Software supports both. It cannot make you compliant on its own, because compliance is about procedures and people.
If the SIA asks how you know your procedures work, a dated drill report is a better answer than a policy document.
Sign In Solutions
Builds the list from sign-in data covering staff, pupils, visitors and contractors.
Learn more
InVentry RollCall
Puts that list on fire marshals’ phones at every muster point at once.
Roll Call App
Audit & Compliance
Keeps the timestamped records that evidence a drill actually happened.
Audit & ComplianceMartyn’s Law FAQs
No. The Act received Royal Assent on 3 April 2025, but the duties are expected to come into force in spring 2027 after a minimum 24-month implementation period. The SIA cannot enforce them until then.
Anyone responsible for premises used for a purpose listed in Schedule 1 where 200 or more people may reasonably be expected at the same time, and for qualifying events with 800 or more attendees and entry checks. Staff count towards the total.
Work out whether you are in scope, confirm your tier, notify the SIA of your responsible person, put public protection procedures in place for evacuation, invacuation, lockdown and communication, and keep records that evidence all of it. Enhanced tier premises add physical security measures and a documented assessment.
Premises expecting fewer than 200 people, and premises excluded by Schedule 2: private workplaces the public cannot access, transport premises already regulated under aviation and rail security regimes, and Parliament.
Yes. Most secondary schools and many primaries exceed 200 people once staff are counted. Education settings remain in the standard tier however large they are, so the duties are notification and the four public protection procedures rather than physical security measures.
It is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in May 2017. His mother, Figen Murray, campaigned for the legislation and walked 200 miles to Downing Street in 2024 to press for it.