If your shop, restaurant, hotel or venue could ever have 200 or more people on site at once, a new legal duty will soon apply to you, backed by fines of up to £18 million. The Terrorism (Protection of Premises) Act 2025 is widely known as Martyn’s Law, named in memory of Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena attack. It requires those responsible for qualifying premises to prepare for the possibility of a terrorist attack. The Act received Royal Assent on 3 April 2025 and is expected to come into force in April 2027. It is not yet in force, but several of the steps needed to comply take real time to put in place, so preparation needs to start now rather than closer to commencement.
What does the Act Require?
- Martyn’s Law puts counter-terrorism preparedness on the same legal footing as fire safety. If your premises are in scope, you will need procedures in place so staff know what to do if a terrorist attack happens on site or nearby, covering evacuation, lockdown and communication. Larger premises must go further and take active steps to reduce their vulnerability to an attack.
- The Security Industry Authority (SIA) regulates and enforces the Act. Its stated approach is to help businesses comply first, using its enforcement powers, including fines of up to £18 million or 5% of worldwide revenue, only for serious or persistent non-compliance.
Does it apply to your Property?
- Your premises are likely to be in scope if all of the following apply:
- The premises include a building or part of a building (or a group of buildings).
- They are wholly or mainly used for a purpose listed in Schedule 1 of the Act, which covers most commercial uses, including shops, restaurants and bars, hotels, entertainment and leisure venues, and visitor attractions.
- It is reasonable to expect 200 or more people (including staff) to be present at the same time, at least from time to time.
- The premises are not specifically excluded under Schedule 2 of the Act.
- Practical point: the 200-person threshold is about your busiest realistic moments, not average footfall. A shop that is quiet most of the time but packed during a January sale should count people at that peak.
- If you also run or host events, a related test applies. An event is likely in scope if it is open to the public, involves checking people in (tickets, passes, membership), and could reasonably have 800 or more people present at once. Events held at premises that are already enhanced tier are not treated as separate qualifying events.
What do the Two Tiers Mean in Practice?
Standard Tier (200 to 799 people)
- If your premises typically fall into this range, you will need, so far as is reasonably practicable, public protection procedures covering evacuation, invacuation, lockdown and communication. The Act does not require equipment purchases or physical alterations. For most shops and restaurants, this is a paperwork and training exercise, not a building works one.
Enhanced tier (800 or more people)
- If your premises can reasonably expect 800 or more people at once, you are in the enhanced tier. You will need the same four procedures as standard tier, plus measures to reduce vulnerability to an attack, such as monitoring, control of movement, physical security, and keeping sensitive site information secure. You must also document this and provide it to the SIA, initially once prepared and again within 30 days of any revision. This is a materially bigger exercise than standard tier and worth planning for early.
- One exception: childcare, education and worship premises are treated as standard tier regardless of numbers, even if 800 or more may be present. Do not assume a large venue in this category automatically means enhanced tier.
Who is Responsible?
- The duties fall on the “responsible person”, which is whoever has control of the premises for the relevant use, not necessarily whoever owns or occupies them. In a typical lease, a tenant or licence holder will usually be the responsible person for the area demised to them, since they control how that space is used. A landlord can still be the responsible person for areas they retain control over, such as communal areas, shared entrances, car parks or plant rooms. So there may be a need for some cooperation and agreements to be put in place to ensure compliance throughout the property.
- It gets more complex where premises overlap, for example a department store within a shopping centre. The expectation is that all responsible persons must coordinate, so far as is reasonably practicable, so evacuation, lockdown and communication plans do not conflict. If you operate within a larger complex, identify who else might hold responsible-person duties for the same space now, rather than waiting until the Act is in force.
- While there is an obligation to cooperate, it may still be necessary to put more formal arrangements in place to facilitate compliance. For example, if a tenant is the responsible person but needs something from their landlord to comply with their obligations, such as permission for a structural change to add an evacuation route, the landlord must cooperate so far as is reasonably practicable. That does not mean automatic agreement, but they cannot ignore the request. And such works may require changes to the Lease or a Licence for Alterations to be granted before the works are done.
- Landlords responsible for communal areas may also need cooperation from tenants in the building. If a lease is silent on these sorts of provisions or restricts alterations, it must be raised with the other party in sufficient time not only to do any necessary works, but to also get the paperwork and policy planning lined up too.
- If you are an organisation in the enhanced tier, you will need to name a senior individual responsible for compliance and there is substantially more work to do on which you are likely to need professional input.
What action should be taken now?
- Work out where you sit. Go through each site and realistically estimate peak occupancy, including staff. A multi-site operator may have some standard tier sites, some enhanced tier sites, and some out of scope entirely.
- Map your occupancy arrangements. Establish who controls each part of your premises in practice, including any areas shared with other occupiers or retained by a landlord, since co-ordination duties will apply to shared premises.
- Start drafting your four core procedures (Evacuation, Invacuation, Lockdown, Communication). These do not need to be sophisticated, especially for standard tier, but should be realistic for your site and well known by staff.
- Build in staff awareness, not just paperwork. Formal training is not mandated, but a plan nobody understands will not meet the requirement. Staff need to be clear on what happens should an incident occur and ready to act. A short briefing at induction is a reasonable approach.
- If you are likely to be enhanced tier, start earlier. The additional measures and SIA documentation are a bigger undertaking, so loop in facilities, security and legal teams well before commencement.
- Review your leases, particularly alteration rights, security installation terms and cost contributions, wherever cooperation from a landlord, tenant or other occupier may be needed to comply.
- Sign up for SIA updates (https://www.us15.list-manage.com/subscribe?u=4f02ccc5fcb79e244e219a709&id=cf3e9832c7 )
How can we help?
- Much of the preparation above can reasonably be handled internally or with existing security or facilities advisers. However, taking legal advice at an early stage can make sure that you are clear on the extent to which different parties are liable for a particular property and the extent of the obligations you are expected to meet, ensuring your planning is adequate and fit for purpose. We can help you:
- Determine who the responsible person is where control of a site is unclear or shared, particularly in letting, licensing or management agreement arrangements.
- Negotiate amendments to leases or licences for alterations needed to address cooperation obligations, alteration rights, or cost-sharing for security measures.
- Structure coordination arrangements with other responsible persons in a shared complex, particularly on liability or cost allocation.
- Assist you with any contact from the SIA about a compliance, restriction or penalty notice once the legislation comes into force. These carry a right of appeal to a tribunal, and early advice and action on any issue that arises will make a big difference to the outcome.
A Final Point on Timing
The Act is not yet in force, and there is no penalty for non-compliance until it is. But the 24-month implementation period exists because getting this right, particularly for larger or multi-occupier sites, takes time. Businesses that start preparing now will find commencement far less disruptive than those that wait.
