Martyn's Law Explained for Venues: Tiers, Duties and the 2027 Deadline

Martyn's Law is the name everyone uses for the Terrorism (Protection of Premises) Act 2025, passed after the campaign by Figen Murray, whose son Martyn Hett was one of the 22 people killed at Manchester Arena in 2017. It received Royal Assent on 3 April 2025. For the first time it puts a legal duty on the people who run public places to think about what they would do in an attack, and to be ready to do it. This is a plain-English guide for the people who will carry that duty: venue managers, bursars, estates and facilities teams, hospital security leads, church wardens and event organisers.

Who is in scope

Two tests. The premises must be used for one of the purposes in Schedule 1 of the Act, which the Home Office scope infographic lists as shops, food and drink, entertainment and leisure, sports grounds, libraries, museums and galleries, halls, visitor attractions, hotels, places of worship, healthcare, bus and railway stations, aerodromes, childcare, primary and secondary education, further education, higher education and public authorities. And it must be reasonable to expect 200 or more people to be present at the same time. Below 200, the premises are outside the Act, though the Home Office FAQs suggest checking the figure rather than assuming it. Qualifying events of 800 or more, where access is controlled by tickets or payment, are in scope wherever they are held.

The standard tier: 200 to 799

The responsible person must notify the Security Industry Authority, the regulator, that they are responsible for the premises, and must have public protection procedures in place, so far as is reasonably practicable, covering four things: evacuation (getting people out), invacuation (getting people in, or to a safer part of the building), lockdown (securing the premises or parts of it) and communication (telling people what to do). There is no requirement to send documents to the SIA at this tier, and no requirement to buy equipment. Places of worship, nurseries, schools and colleges stay in the standard tier however many people they hold. Does Martyn's Law apply to schools, churches and village halls? goes through those cases.

The enhanced tier: 800 or more

Everything above, plus public protection measures covering monitoring (knowing what is happening in and around the premises), movement control (how people get in and out), physical security and security of information. The procedures and measures must be set out in a written document that assesses how they are expected to reduce harm, and that document goes to the SIA. Where the responsible person is a company or a trust, it must designate a senior individual. Everything must be kept under review. The April 2026 guidance stresses that the measures are to be reasonably practicable and proportionate, and that much of the weight falls on people: training, awareness, communication and having a plan.

Penalties

The SIA can issue compliance notices, restriction notices and monetary penalties, and there are criminal offences for the worst cases. Per Mishcon de Reya's summary, the maximum penalty is £10,000 at the standard tier, with daily penalties of up to £500 for continuing breaches, and £18 million or 5% of worldwide revenue, whichever is greater, at the enhanced tier, with daily penalties of up to £50,000.

What to do before spring 2027

Work out your number honestly, for the busiest day. Decide who the responsible person is and, if it is an organisation, who the senior individual will be. Walk the building with the four procedures in mind and write down, for each part of it, which way out, where to shelter, what locks and how you will tell people. Then make sure everyone with a role knows it: the Act does not prescribe training, but the guidance is explicit that staff with responsibilities must be made aware of them and given the understanding and tools to carry them out. Evacuation, invacuation and lockdown on your floor plan is the practical half of this article, and a Martyn's Law readiness tour is the way we help: the building photographed in 360, every exit, shelter and lockable room marked, each procedure shown as a route your staff can walk through before they ever need to.

General information, not legal advice. The Act and the Home Office statutory guidance on ProtectUK are the documents to quote.

Questions people ask

Is Martyn's Law in force yet?

No. The Act received Royal Assent on 3 April 2025 and the Home Office has said the implementation period will be at least 24 months. The statutory guidance was published on 15 April 2026 and the SIA notification portal is expected in spring 2027.

How do we count the 200 people?

The test is the number of people reasonably expected to be present at the same time, including staff. The Act does not prescribe a method; the Home Office guidance describes reasonable ones, such as safe occupancy figures, ticket sales and historic attendance. Use the busiest realistic day, not the average.

Who is the responsible person?

The person or organisation in control of the premises for the qualifying use, usually the operator or the owner. Where it is an organisation, the enhanced tier requires a designated senior individual with overall responsibility, which can be supported but not delegated.