Martyn’s Law: A New Era of Public Protection for UK Venues

It’s a chilling memory for many of us, isn’t it? The sheer horror that unfolded on that dreadful night in May 2017 at the Manchester Arena. A vibrant concert, a night of joyous music, abruptly shattered by an act of unspeakable terror. That attack, which tragically claimed 22 innocent lives, including that of 29-year-old Martyn Hett, left an indelible scar on the nation’s psyche. From that profound grief, however, emerged a resolute determination to ensure such a tragedy wouldn’t—couldn’t—happen again.

This commitment coalesced into a groundbreaking piece of legislation: the Terrorism (Protection of Premises) Act 2025, now widely known as Martyn’s Law. This isn’t just another piece of governmental red tape, let me tell you. It’s a fundamental shift, mandating that those responsible for certain public premises and events take proactive, tangible steps to mitigate the devastating risk of terrorism. The Act introduces a sensible, tiered approach, categorizing venues by capacity and usage, thereby tailoring security requirements to what’s genuinely appropriate. It’s about making our public spaces safer, giving everyone a better chance to go home at the end of the day.

Focus360 Energy: property compliance services – pre-planning to post-construction. Learn more.

The Genesis of Martyn’s Law: A Mother’s Tireless Campaign for Change

To truly understand Martyn’s Law, you’ve got to appreciate the human story behind it. This legislation isn’t some abstract policy dreamt up in Whitehall; it’s the direct result of a mother’s unwavering love and fierce determination. Figen Murray, Martyn Hett’s mum, turned her unimaginable grief into a powerful force for change. She embarked on a relentless campaign, tirelessly lobbying politicians, engaging with security experts, and sharing her painful story to ensure that no other family would suffer the same heartbreak she did.

Her mission was simple: make it a legal requirement for public venues to consider and implement measures that protect people from terrorist attacks. For years, there’s been a patchwork approach to security, often discretionary, leaving significant gaps. Figen argued, passionately and persuasively, that this simply wasn’t good enough. Public safety shouldn’t be optional; it’s a fundamental right. She travelled the country, spoke at countless events, and even gained an OBE for her efforts. It wasn’t always an easy path, as you can imagine; pushing for new laws is rarely straightforward, but her conviction never wavered. She truly galvanised public opinion and garnered cross-party political support, proving that even in the face of immense adversity, one person can indeed make an enormous difference.

Her campaign focused on three core principles: increasing awareness of terror threats, ensuring staff are trained to respond, and encouraging venues to implement practical preventative measures. Martyn’s Law, as it now stands, directly reflects these very principles. It really is a powerful testament to her resilience, and frankly, a truly fitting legacy for Martyn. I’m sure he’d be incredibly proud.

Unpacking the Scope: Which Premises and Events Are Covered?

So, who exactly does Martyn’s Law apply to? It’s a crucial question, and the Act lays out clear criteria, aiming for a comprehensive yet practical scope. You see, the intention isn’t to burden every corner shop or tiny village hall, but rather to focus on spaces where a significant number of people congregate.

First up, there’s the Building Requirement. Essentially, the premises must consist of a building or a group of buildings, including parts of buildings. This isn’t just about standalone structures; it can be an enclosed section of a larger complex, or even an outdoor area that functions as part of a building’s overall footprint for an event. It’s broader than you might initially think, capturing various configurations of public spaces.

Then we get to Primary Use. The premises must be wholly or mainly used for one or more specified activities. This list is quite extensive, covering a huge swathe of public life. Think about it: retail spaces, bustling hospitality venues like pubs, clubs, and restaurants, educational institutions from universities to large schools, healthcare settings such as hospitals, and, of course, entertainment and cultural venues like theatres, cinemas, museums, and galleries. Sports grounds, music venues, conference centres—they’re all in the mix. If people are gathering there, especially in large numbers, then it’s likely on the radar. The government’s logic here is clear: wherever large groups gather, the potential impact of an attack is amplified, making these spaces prime targets for protective measures.

Crucially, there’s the Capacity Threshold. This is where the tiered approach really kicks in. The Act applies where it’s reasonable to expect that from time to time, 200 or more individuals may be present on the premises simultaneously. That phrase, ‘reasonable to expect,’ is important. It doesn’t mean a venue has to always have 200 people, but if its design, purpose, or typical events mean it can and does host that many at once, then the law applies. It’s about potential, not just constant occupation.

Notable Exclusions and Why They Matter

While the Act is sweeping, it doesn’t cover absolutely everything. Certain premises are explicitly excluded. For example, those occupied for parliamentary purposes or by devolved administrations. This makes sense when you consider the unique security arrangements and constitutional roles of such sites. They’re often already under extremely stringent security protocols, often managed by specialist parliamentary security forces or dedicated police units, operating under different legal frameworks.

The legislation also typically won’t apply to private dwellings, even if they sometimes host large gatherings, like a house party. The focus is on public or commercial premises where people have an expectation of safety from the operator. It’s a pragmatic approach, striking a balance between widespread protection and avoiding unnecessary, impractical burdens. But don’t misunderstand, the vast majority of places you frequent regularly will, in some capacity, fall under the protective umbrella of Martyn’s Law.

The Tiered Security Obligations: A Closer Look at Responsibilities

The beauty, or perhaps the practicality, of Martyn’s Law lies in its tiered approach. It acknowledges that a small community hall hosting a bingo night simply can’t, and shouldn’t, be expected to implement the same level of security as a massive sports stadium. It’s about proportionality, and it’s a smart way to ensure effectiveness without crushing smaller operators under an impossible burden. Let’s really dig into what these tiers mean for venue operators.

Standard Duty Premises: The Foundation of Protection (Capacity 200-799)

This tier covers venues where you’d reasonably expect between 200 and 799 individuals to be present at any given time. Think of your medium-sized retail stores, popular restaurants during peak hours, bustling leisure centres, or perhaps a decent-sized local theatre. These are the places many of us visit regularly, and frankly, we’ve often taken their security for granted. Operators of these venues now face some critical obligations, and they’re more involved than just locking the doors at night.

First, they’re required to Notify the Security Industry Authority (SIA) upon assuming responsibility for the premises. This isn’t just a tick-box exercise; it’s about putting themselves on the regulatory radar, ensuring the SIA knows who’s in charge and where these venues are. This notification will likely involve providing key details about the premises, its capacity, and the nature of its operations. It’s the first step in establishing a transparent and accountable security framework.

More importantly, these operators must Implement Public Protection Procedures. This is where the rubber really meets the road, isn’t it? It means having well-thought-out, practical plans for what to do when the unthinkable happens. These procedures aren’t just for show; they need to be robust, understood, and practiced by staff.

• Evacuation: This isn’t just about fire alarms. It’s about clear, well-signed escape routes, designated assembly points, and procedures for assisting vulnerable individuals, those with disabilities, or young children. Have staff been trained on calmly directing large crowds? Do they know where everyone should go? What about communicating with emergency services during an evacuation?
• Lockdown: What if the threat is external, or contained within a specific part of the building? Lockdown procedures involve securing people within the premises, often in pre-designated safe zones, limiting access and movement. This demands secure doors, a clear communication system, and staff trained to identify and use safe areas effectively. Imagine being in a mall during an active threat; knowing there’s a protocol, and trained staff, could make all the difference.
• Invacuation: This term might be newer to some, but it’s becoming increasingly vital. Invacuation means moving people into a building, or a safer internal area, when there’s an external threat. Think about a terror attack on a nearby street; you wouldn’t want people fleeing out into danger. Instead, you’d bring them indoors, away from windows, to a more secure location. It’s a nuanced but absolutely critical distinction.
• Communication Protocols: During a crisis, information is power, but misinformation can be deadly. Venues need clear, rapid, and effective ways to communicate with those present, staff, and emergency services. This could involve public address systems, digital displays, text alerts, or even designated runners. Who says what, when, and how? This needs to be worked out in advance, not improvised in a moment of panic. And let’s not forget the importance of gathering accurate information from the scene to relay to responders. It’s a complex tapestry of immediate response and sustained communication.

I remember once, I was at a fairly busy independent cinema, and during a particularly intense scene, a smoke alarm went off – false alarm, thankfully. But the chaos, even for a non-threatening incident, was palpable. People didn’t know where to go, staff looked uncertain. This law, for premises like that cinema, will prevent such confusion in a real crisis. It’s about preparedness, not panic.

Enhanced Duty Premises: The Pinnacle of Protection (Capacity 800+)

This is where things get really serious. Enhanced Duty Premises are those venues or events where it’s reasonable to expect 800 or more individuals simultaneously. We’re talking about your major arenas, sprawling music festivals, large conference centres, packed nightclubs, or iconic sporting venues. These places, by their very nature, present a higher-value target and a greater potential for mass casualties. Therefore, their obligations go significantly beyond the Standard Duty requirements.

They must, of course, adhere to all the requirements for Standard Duty Premises. But then, they layer on much more rigorous Risk Reduction Measures. This isn’t just about procedures; it’s about implementing physical security and advanced operational strategies.

• CCTV Surveillance: Not just a few cameras, but a comprehensive, strategically placed system that provides wide coverage, high-resolution imagery, and is actively monitored. It means having trained personnel watching those screens, capable of identifying suspicious behaviour, and able to quickly relay information to security teams on the ground and, crucially, to emergency services. Data retention policies, system resilience, and integration with wider security networks are all key components.
• Access Control Systems: This goes beyond simply scanning a ticket. It involves robust perimeter security, sophisticated entry points like turnstiles and gates that can manage high volumes while preventing unauthorised access, and perhaps even biometric or advanced ticketing verification systems. It’s about creating layers of defence at the entry points, controlling the flow of people, and identifying potential threats before they even step foot inside. Think about a major football match; you’ve probably seen the intricate dance of security at the gates.
• Bag Searches: A common sight at large events, but now a legal requirement where appropriate. This means having clear protocols for searches, properly trained staff who understand how to conduct them respectfully yet thoroughly, and a plan for dealing with prohibited items or suspicious packages. There’s always that balance, isn’t there, between convenience and security? But for venues of this size, it’s a non-negotiable.
• Hostile Vehicle Mitigation (HVM) Strategies: This is a vital component, particularly for venues with external perimeters or public access points susceptible to vehicle-borne threats. This includes physical barriers like bollards (fixed or retractable), reinforced planters, strategically placed street furniture, and even vehicle-borne threat assessments to identify vulnerable areas. We’ve seen far too many instances of vehicles being weaponized, so proactively addressing this threat is paramount.
• Trained Security Personnel: For Enhanced Duty venues, this isn’t just about having bouncers. It’s about a highly trained, coordinated security force. These personnel need specialist counter-terrorism awareness training (like the ‘ACT Awareness’ module from NaCTSO), advanced first aid skills, conflict resolution expertise, and clear roles within a larger incident response plan. They’re often the first line of defence and their effectiveness can be critical in the initial moments of an incident.
• Emergency Planning and Exercises: It’s not enough to just write a plan; you must test it. Enhanced Duty venues are expected to conduct regular, realistic exercises with staff and, crucially, with local emergency services. This could involve multi-agency drills simulating various terror scenarios, ensuring seamless coordination between venue security, police, ambulance, and fire services. It’s the kind of meticulous preparation that, while costly, genuinely saves lives.
• Security Culture: Beyond the technical and procedural elements, there’s a need to foster a pervasive security culture among all staff, from cleaners to senior management. Everyone needs to understand their role in vigilance, reporting suspicious activity (‘see something, say something’), and contributing to the overall safety of the environment. It’s a collective responsibility, really, and it can’t be understated.

For major venues, these measures represent a significant investment in both capital and ongoing operational costs. But frankly, when you consider the potential cost of inaction, can you really put a price on human lives? I don’t think you can. These requirements will fundamentally transform how large-scale events are run in the UK, making them considerably safer spaces for everyone.

The Implementation Journey: What Lies Ahead for Venue Operators

The good news? Martyn’s Law received Royal Assent on April 3, 2025, a significant milestone. The not-so-good news, if you can call it that, is that its provisions aren’t yet fully in force. The government has wisely indicated a minimum 24-month implementation period, meaning we’re looking at a rollout that will stretch into 2027, possibly beyond for certain aspects. Why the delay? Well, this isn’t something you rush, is it?

This extended period is absolutely crucial for several reasons. Firstly, the government needs to publish detailed statutory guidance. The Act itself provides the framework, but the guidance will flesh out the specifics, offering practical advice and clarity on what operators need to do to comply. This will cover everything from how to conduct a risk assessment to the exact requirements for staff training and communication protocols. Expect this guidance to be developed in close consultation with industry stakeholders, security experts, and, of course, organisations like the National Counter Terrorism Security Office (NaCTSO) which offers invaluable advice.

Secondly, a new regulatory function within the Security Industry Authority (SIA) needs to be established and properly staffed. This isn’t just about rebranding an existing department. It means recruiting and training a dedicated team of inspectors and enforcement officers, developing robust inspection regimes, and establishing clear lines of communication and support for venue operators. The SIA will be the central pillar for oversight, ensuring compliance, offering advice, and, when necessary, imposing penalties.

This implementation phase offers venue operators a vital window of opportunity. It’s not a time for complacency, though. Instead, it’s a chance to familiarise yourself with the spirit of the forthcoming requirements, to begin assessing your current security posture against what you anticipate will be expected, and to start budgeting for necessary enhancements. Proactive engagement with industry associations, attending webinars, and keeping a very keen eye on government and SIA publications will be absolutely essential. Don’t wait for the final whistle; start training now.

Enforcement and Penalties: The Teeth of Martyn’s Law

No law is truly effective without proper enforcement, and Martyn’s Law comes with some serious teeth. The SIA, as the primary regulatory body, won’t just be offering guidance; they’ll also be actively monitoring compliance and have a range of powers at their disposal to ensure venues meet their obligations. This isn’t just about financial penalties, although those can be hefty; it’s about ensuring a universal standard of safety.

The SIA will be able to issue several types of notices:

• Compliance Notices: These will be issued when a venue isn’t meeting its obligations. They’ll outline specific areas where improvements are needed and provide a clear timeframe for those issues to be rectified. It’s an opportunity to correct course without immediate punitive measures, but ignoring them would be a serious mistake.
• Monetary Penalties: Failure to comply with a Compliance Notice, or significant breaches of the Act, can result in substantial fines. We’re talking about potential fines reaching up to £18 million, or even 5% of a business’s annual global turnover, whichever is higher. For smaller businesses, this could be capped at £10,000 for Standard Duty premises, which still packs a punch. These aren’t just slaps on the wrist; they’re designed to be a significant deterrent and a clear signal that public safety isn’t something you can cut corners on.
• Restriction Notices: In severe cases, where non-compliance poses a significant risk to the public, the SIA could issue a Restriction Notice. This could mean prohibiting a venue from operating at certain capacities, or even temporarily closing it down entirely until the necessary safety measures are in place. Imagine the reputational and financial hit of having your premises forcibly closed; it’s a very real consequence.

Beyond these direct penalties, there’s the broader issue of reputational damage. In today’s hyper-connected world, news of a venue failing to meet safety standards would spread like wildfire. Public trust, once lost, is incredibly difficult to regain. Customers vote with their feet, and no business wants to be associated with negligence when it comes to people’s lives. We’ve seen how quickly public sentiment can turn, and for operators, that’s a risk they simply can’t afford to take.

Furthermore, individual directors and managers could face personal liability for serious breaches, particularly if they are found to have neglected their duties. This means it’s not just the company that’s on the hook. It elevates the responsibility right to the top, ensuring that security considerations are embedded in strategic decision-making, not just delegated away.

Preparing for Martyn’s Law: A Proactive Roadmap for Venue Operators

So, with the full force of Martyn’s Law still some months, or even a couple of years, away, what should venue operators be doing right now? Waiting until the final guidance is published would be a grave error. This is a moment for proactive, strategic planning, and it’s something every responsible operator should already be thinking about.

1. Start Your Homework Early: Don’t wait for the definitive guidance to land. Begin by thoroughly understanding the core principles of Martyn’s Law, its tiered structure, and what it generally aims to achieve. Consult the existing government factsheets, engage with industry bodies, and attend any awareness sessions that pop up. The more informed you are now, the smoother your transition will be.

2. Conduct a Baseline Security Assessment: Look at your premises with a critical eye. What are your current security measures? Do you have CCTV? Are your access control points robust? How do you manage bag searches? More importantly, how would you respond to an evacuation, a lockdown, or an invacuation scenario today? Many existing counter-terrorism frameworks, such as NaCTSO’s ACT Awareness resources, can provide a great starting point for assessing vulnerabilities and current capabilities. You can’t fix what you don’t know is broken, right?

3. Identify Your ‘Responsible Person’ (or Team): Within your organisation, designate a senior individual or a small team to take ownership of Martyn’s Law compliance. This person will be responsible for staying updated, coordinating efforts, overseeing training, and ensuring the necessary plans are developed and implemented. This isn’t a task to be casually added to someone’s already overflowing plate; it needs dedicated focus.

4. Budget for Compliance: Let’s be realistic, security enhancements cost money. Whether it’s upgrading CCTV, installing HVM barriers, investing in new access control technology, or providing comprehensive staff training, these are expenses that need to be factored into future financial planning. Start allocating resources now to avoid a sudden, unmanageable financial shock when the law officially comes into force. It’s an investment in safety, plain and simple.

5. Engage with Industry Associations: Groups like UKHospitality, the Association of Event Organisers, and others, will be vital conduits for information and support. They’re likely to be involved in consultations, sharing best practices, and developing sector-specific guidance. Being part of these networks can provide invaluable insights and peer support as everyone navigates these new requirements.

6. Prioritise Staff Training: Even before the official guidance, you can begin to educate your staff. Encourage them to complete the free online ACT Awareness training (available via NaCTSO). This fundamental awareness can instil a ‘see something, say something’ culture and equip them with basic knowledge of how to react in a crisis. Empowering your frontline staff is always a good idea.

7. Review Incident Response Plans (and Practice Them): Don’t just have a plan; test it. Conduct tabletop exercises or even small-scale drills to identify weaknesses in your current procedures for evacuation, lockdown, and communication. Involve local emergency services if possible. The more you practice, the more intuitive and effective your response will be under pressure. It’s like a fire drill, but for a different kind of threat.

8. Re-evaluate Your Insurance Policies: Martyn’s Law will undoubtedly impact liability and insurance. Speak with your brokers and insurers early to understand how these new obligations might affect your existing coverage. Will your policies adequately cover the new risks and liabilities? Better to find out now than when you need to make a claim, wouldn’t you agree?

9. Foster a Security-Conscious Culture: Beyond the hardware and procedures, cultivate an environment where security is everyone’s responsibility. Encourage open reporting of concerns, educate staff on vigilance, and make it clear that safety is a top priority, not an afterthought. It’s about embedding security into the DNA of your operation.

By taking these steps, operators won’t just be preparing for compliance; they’ll be proactively enhancing the safety of their venues, protecting their patrons, and ultimately building greater resilience against potential threats. It’s a significant undertaking, yes, but it’s a necessary one.

The Challenges and Criticisms: A Balanced Perspective

While the intent behind Martyn’s Law is universally lauded—who wouldn’t want safer public spaces?—it’s not without its challenges and potential criticisms. And we should acknowledge them, shouldn’t we, for a truly balanced view?

One of the most frequently cited concerns is the cost burden, particularly for smaller businesses or independent operators falling into the Standard Duty category. While the tiered approach aims for proportionality, even basic compliance, such as staff training, developing comprehensive plans, and implementing improved communication systems, can represent a significant expense for organisations already operating on thin margins. Will there be adequate financial support or grants available, particularly for those non-profit or community-run venues? That’s a question many are asking.

Then there’s the practical implementation challenge. For some older buildings, retrofitting certain security measures, like advanced access control or HVM, might be incredibly complex, disruptive, and astronomically expensive. Developers and operators will need clear, pragmatic guidance that accounts for the nuances of diverse architectural styles and site constraints.

Another point of discussion often revolves around staffing and training. Finding enough security-trained personnel, especially for large, sporadic events, can be tough. The security industry itself faces recruitment challenges, and the new demands of Martyn’s Law could exacerbate this. Ensuring all relevant staff receive appropriate, ongoing training is a significant logistical undertaking.

Some might also raise concerns about the potential for ‘security theatre’ – measures that look impressive but don’t significantly enhance real security, or impact negatively on the customer experience. No one wants to turn public venues into fortresses that deter visitors, do they? There’s a delicate balance to strike between robust security and maintaining a welcoming, accessible environment. Overly intrusive bag searches, for instance, could lead to long queues and frustration, potentially detracting from the very experience people came for.

Finally, there’s a philosophical debate: will these measures truly deter sophisticated attacks, or merely displace them to softer targets? While Martyn’s Law makes specific venues harder targets, the threat adapts. It’s a complex, ever-evolving landscape. However, the prevailing view, and one I tend to agree with, is that making any target harder is a worthwhile endeavour, reducing the overall probability of success for terrorists and, crucially, saving lives where attacks do occur. These aren’t easy questions, but they are important ones to consider as the law fully rolls out.

The Human Element: Beyond the Legislation

Ultimately, behind all the legal jargon, the tiered requirements, and the talk of enforcement, there lies a profound human purpose. Martyn’s Law isn’t just about regulatory compliance; it’s about honouring the memory of those lost, providing solace to survivors, and fundamentally changing our collective approach to public safety. It’s about protecting ordinary people going about their ordinary lives.

The ongoing trauma for the survivors of the Manchester Arena bombing, and the tireless advocacy of individuals like Figen Murray, serve as a constant reminder of the devastating human cost of terrorism. This law is their legacy. It’s a tangible commitment that we, as a society, will not stand idly by. We recognise the evolving threat, and we are determined to build greater resilience into the fabric of our public spaces. It’s about instilling confidence, fostering vigilance, and creating environments where people feel, and truly are, safer.

What this legislation asks of venue operators is significant, I won’t pretend otherwise. But the return on that investment – the potential to prevent future tragedies and protect lives – is immeasurable. It’s a shift in mindset, really, from reactive to proactive, from optional to mandatory. It reminds us that security isn’t just the job of the police or intelligence services; it’s a shared responsibility, extending to every individual and organisation that hosts the public.

Conclusion: A Safer Future, Built on Vigilance and Collaboration

Martyn’s Law represents a pivotal moment in the UK’s approach to counter-terrorism. It moves us decisively from a voluntary, often inconsistent, security landscape to one defined by mandatory, robust protective measures. It’s a testament to the power of human spirit in the face of tragedy and a clear commitment to learning from the past to safeguard our future.

For venue operators, the message is clear: the time for proactive engagement and preparation is now. Don’t wait for the official regulations to drop; begin your assessments, educate your teams, and start budgeting for the necessary changes. The SIA will be a partner in this journey, but ultimately, the responsibility for securing your premises and protecting your patrons rests squarely with you.

This isn’t just about avoiding penalties; it’s about embracing a moral imperative. It’s about ensuring that when people gather in our vibrant public spaces, whether for a concert, a meal, or a sporting event, they can do so with a greater sense of security. It’s about creating a safer nation, one venue at a time, through vigilance, collaboration, and an unwavering commitment to never forget those we lost.

References

• Terrorism (Protection of Premises) Act 2025: Scope (Premises) – GOV.UK (gov.uk)
• Terrorism (Protection of Premises) Act 2025 – GOV.UK (legislation.gov.uk)
• Terrorism (Protection of Premises) Act 2025 – WTW (wtwco.com)
• Terrorism (Protection of Premises) Act 2025 – Keoghs (keoghs.co.uk)
• Terrorism (Protection of Premises) Act 2025 – Ashfords (ashfords.co.uk)