The security landscape for UK venues has fundamentally changed. Whether you operate a corporate events space, a leisure facility, a sports ground, or a large public venue, the Terrorism (Protection of Premises) Act 2025, widely known as Martyn’s Law, now sets a clear legal framework for how you must prepare for and respond to the threat of terrorism. For leaders who take their duty of care seriously, this is not simply a compliance exercise. It is a call to embed genuine operational preparedness into everything you do.
At Who Dares Group, we understand that true security begins long before an incident occurs. It is built into culture, leadership, and process. In this article, we break down what Martyn’s Law requires, who it affects, and what steps responsible venue operators need to take to meet their obligations.
The Origin of Martyn’s Law
Martyn’s Law takes its name from Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena bombing. His mother, Figen Murray, campaigned tirelessly for stronger legislative protections at public venues in the years that followed. Her determination resulted in one of the most significant pieces of counter-terrorism legislation the UK has seen in a generation.
The Act received Royal Assent on 3 April 2025, marking a pivotal moment for public safety in the United Kingdom. As the Home Office factsheet confirms, the legislation is designed to improve protective security and organisational preparedness across the UK by requiring those responsible for certain premises and events to consider how they would respond to a terrorist attack.
What Does Martyn’s Law Do?
The Act places legal obligations on those responsible for qualifying premises and events to take proactive steps to protect the public from harm in the event of a terrorist attack. It does not ask organisations to eliminate risk entirely. Rather, it demands that they think ahead, plan intelligently, and ensure their people know what to do when it matters most.
This is precisely the mindset we advocate across all of our work: situational awareness, decisive leadership, and the ability to perform under pressure are not optional extras. They are the foundations of operational readiness.
Who Falls Within Scope?
The Act applies to premises in England, Wales, Scotland, and Northern Ireland that appear in Schedule 1 of the Act. This covers a broad range of publicly accessible locations, including retail spaces, entertainment venues, hotels, sports grounds, places of worship, hospitals, and transport hubs, among others.
The threshold for qualifying premises is an anticipated occupancy of 200 or more individuals at the same time. Venues are then divided into two tiers depending on their expected capacity. To understand the full scope of premises covered, you can refer to the official statutory guidance on GOV.UK.
Standard Tier: The Baseline Requirement
Premises where 200 to 799 individuals may be present at the same time will fall within the standard tier. The requirements at this level are designed to be achievable, focusing on simple, low-cost activities that primarily require time and attention rather than significant capital expenditure.
If your premises fall within the standard tier, you must implement appropriate public protection procedures for staff to follow in the event of a terrorist attack at or near your premises. Specifically, these procedures must cover:
- Evacuation: Moving individuals away from danger and out of the premises or affected area.
- Invacuation: Moving individuals to a safer location within the premises.
- Lockdown: Securing the premises to prevent individuals from entering or leaving.
- Communication: Ensuring that information is effectively provided to individuals present.
The key principle is that these procedures should be reasonably practicable given the nature of your premises. There is no expectation for organisations at the standard tier to install expensive physical infrastructure. However, there is an expectation that your people are informed, trained, and ready to act.
This is where genuine preparedness separates high-performing organisations from those who simply tick boxes. Building resilience within your team is not a reactive measure. It is an investment in your people’s capacity to make sound decisions when the pressure is on.
Enhanced Tier: A Greater Duty of Care
Premises where 800 or more individuals may be present at the same time will fall within the enhanced tier. Qualifying events, regardless of the venue’s standard operational capacity, are also subject to enhanced tier requirements if they are expected to attract 800 or more attendees.
The enhanced tier carries significantly greater obligations. In addition to everything required at the standard tier, responsible persons for enhanced tier premises and qualifying events must also:
- Implement appropriate public protection measures to reduce the vulnerability of the premises or event to a terrorist attack.
- Document all public protection procedures and measures in place, assess how they reduce risk and vulnerability, and submit this documentation to the Security Industry Authority (SIA).
The four public protection measures that must be considered are:
- Monitoring: Overseeing the premises and their immediate vicinity, including the use of tools such as CCTV.
- Movement: Managing how individuals move into, out of, and within the premises.
- Physical security: Protecting the physical integrity and safety of the premises.
- Security of information: Ensuring that sensitive information about the premises, its design, usage, and internal workings is not accessible to those who could use it to plan an attack.
The documentation requirement for enhanced tier premises ensures that security planning is not just a thought exercise but a structured, evidenced process. For leaders in high-profile corporate environments, large event spaces, and specialised venues, this raises the bar considerably. Our consultancy services are designed to support exactly this kind of structured operational review, helping organisations translate compliance obligations into robust, practical action.
Who Is the Responsible Person?
Under Martyn’s Law, the responsible person is defined as the individual, company, or organisation with control of the qualifying premises for the purpose of its relevant use. For qualifying events, it is the individual, organisation, or company with control of the premises in connection with their use for the event.
Importantly, where the responsible person is not an individual, they must designate a senior individual who holds direct responsibility for ensuring compliance with the Act. This cannot be delegated informally or treated as a peripheral function. It must sit at a senior level, with clear accountability.
This is a leadership challenge as much as it is a legal one. The organisations that will navigate Martyn’s Law most effectively are those whose leaders already understand the value of clear command structures, personal accountability, and decision-making under pressure. For more on how these qualities can be developed, explore our thinking on how Special Forces training builds unshakeable confidence.
Enforcement and the Role of the SIA
Martyn’s Law is enforced by the Security Industry Authority, which takes on a new regulatory role under the Act. The SIA has the power to investigate, inspect, and issue sanctions where organisations fail to meet their obligations.
The financial penalties are significant. For standard tier premises, the SIA can issue monetary penalties of up to £10,000. For enhanced tier premises and qualifying events, penalties can reach up to £18 million or 5% of worldwide revenue, whichever is greater. These are not token fines. They reflect the seriousness with which the Government regards public protection.
For further detail on the SIA’s regulatory function, GOV.UK has published comprehensive guidance outlining exactly what responsible persons need to know.
When Does Martyn’s Law Come Into Force?
The Government has confirmed an implementation period of at least 24 months from the date of Royal Assent on 3 April 2025. This means the Act is not expected to come into force before April 2027. That period exists to allow organisations time to understand their obligations, access guidance, and put appropriate procedures in place.
However, this should not breed complacency. The organisations that will be best positioned when the Act comes into force are those that begin preparing now. Waiting until the deadline approaches is not a strategy. It is a risk.
Additional resources to support your preparation are available through ProtectUK, the official counter-terrorism resource for the UK, which provides practical guidance, tools, and supporting materials for venues and event organisers.
What Martyn’s Law Means for You as a Leader
Compliance with Martyn’s Law is a legal requirement, but the most forward-thinking organisations will treat it as something more: an opportunity to build a genuine culture of security, awareness, and preparedness. The Act does not simply ask you to have a plan. It asks you to ensure your people understand it, can execute it, and are supported by the structures needed to do so effectively.
At Who Dares Group, we design and deliver practical training that develops leaders and teams through real-world challenge. Our programmes are carefully tailored to your people, objectives, and operating environment. By understanding your business first, we design training that aligns directly with your goals and delivers lasting behavioural change. Every element is designed to replicate the decision-making challenges faced in operational environments, ensuring the experience is both authentic and highly relevant to business performance.
Whether you are a corporate venue operator, an events professional, or responsible for a specialist environment such as a superyacht or maritime setting, the principles of leadership, situational awareness, and resilience under pressure apply universally.
Martyn’s Law is a line in the sand. The question is not whether you will comply. The question is whether you will lead.
If you want to discuss how your organisation can build genuine operational readiness ahead of the Act coming into force, get in touch with our team today. We are here to help you not just meet the standard, but exceed it.