The Terrorism (Protection of Premises) Act 2025 is UK legislation designed to ensure the public is better protected from terrorism. It does this by requiring certain public premises and events to be prepared and ready to keep people safe in the event of an attack. The Act is commonly called ‘Martyn’s Law’ in tribute to Martyn Hett, one of the 22 people killed in the Manchester Arena attack.

The Act establishes the SIA as the regulator of Martyn’s Law. It is expected that the Act will come into force in spring 2027. We will confirm the exact date ahead of when this happens.

The law covers both venues that are mainly used for gatherings of people, and venues that are used for events (such as those for festivals, where the main use is not as a venue). 
 

What does Standard Tier mean?  

This Act breaks events and premises down into 2 tiers:

• Standard Tier: 200-799 people
• Enhanced Tier: 800+ people

Standard and enhanced tiers must:

1. Notify the Security Industry Authority (SIA) who is responsible for a location or event.
2. Implement a reasonable Public Protection Procedure to reduce the risk of harm to anyone attending an event or venue, if there was a terrorist attack at the location or nearby.

This Public Protection Procedure will need to be appropriately scaled in accordance with the size of the event space, the number of attendees, its location and the threat level.

Standard Tier: refers to smaller premises and events. The Act requires those responsible to take reasonable action to protect their staff and members of the public in the event of an attack. These precautions could be as simple as planning a safe route, fitting secure doors, providing clear information and training staff. However, dependant on the space, location and event type, further precautions such as CCTV and bag check policies may need to be implemented.

Enhanced Tier refers to much larger events or spaces that have a much higher level of attendance. This tier often encompasses everything from train stations and shopping centres, to sports stadiums and concert venues. These locations not only have higher numbers of visitors, but are often perceived to have a higher level of threat.

Not all venues are in the scope of the bill, with some, such as diplomatic Missions as Embassies and Consulates, Places of Governance, Highly Regulated Transport Hubs, Open-Access Spaces are excluded from the regulations.
 

What will Standard Tier premises have to do?  

The main change for premises is that they will need to have a named responsible person, who must notify the Security Insdustry Authority of their details as well as details about the premises. The SIA are the regulator for compliance with Martyn’s Law. 

The responsible person is required to ensure that appropriate security measures are in place for the venue in order to reduce harm to the public in the event of an attack. 

This involves four key areas: 

• Evacuation – the process of getting people safely out of the premises. 
• Invacuating – the process of bringing people safely into, or to safe parts within, the premises. 
• Lockdown – the process of securing the premises to ensure that the entry of any attacker is restricted or prevented, eg locking doors, closing shutters or using barriers. 
• Communication – the process of alerting people on the premises to move them away from any danger. 

What will Standard Tier venues need to consider when setting procedures? 

Martyn’s Law compliance is principles based. Each venue, and their responsible person, will need to set new procedures after considering their venue, the areas outside of the venue, routes of access, and other policies and procedures such as health and safety. Venue capacity, type of venue, and other factors will also inform what security measures can and should be put in place to reduce risk of harm. 

In addition, the law specifies that these procedures are put in place as far as is reasonably practicable. In this regard it follows other responsibilities, such as fire and safety, or data protection. This means that the responsible person will need to consider all the factors above and what resources are available to them, in order to put in place security measures. 

What may be reasonably practicable for a venue of up to 799 capacity, with multiple entry and exit routes and members of staff, would not, for example, be reasonably practicable for a smaller venue of 200 capacity with volunteer staff. 

What staff need mandatory training?  

Every Standard Tier premise will need to have a named responsible person for the standard duty premise. This person will need to notify the SIA when they become responsible. This person will have mandatory training needs. 

Training for other staff or volunteers will need to be considered in order to ensure procedures can be carried out effectively. The procedures will need to be communicated to all those needed to deliver the response to a potential security incident. 

This may require the premises to update or provide new training in light of the changes in the law, or any updated security procedures, policies or measures, to ensure staff are capable of carrying out their job roles effectively.