What is Martyn's Law, and does it apply to my venue?

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025. It is named for Martyn Hett, who was killed in the Manchester Arena attack in 2017, and it exists because his mother campaigned for a decade to make preparedness a legal duty rather than a matter of goodwill.

If you run a village hall, a church, a school, a leisure centre or a community venue, the practical question is short: does it apply to us, and if so, what do we actually have to do? This guide answers both.

The short answer

If 200 or more people could reasonably be present at your premises at the same time, Martyn's Law applies to you.

For most venues that means the standard tier, and the standard tier asks for two things:

1. Notify the Security Industry Authority that you are the responsible person for the premises.
2. Put in place written public protection procedures covering four situations, and make sure the people who work there know them.

That is the whole duty. There is no requirement to install equipment, hire security staff, or commission a risk assessment from a consultant. The statutory guidance is explicit that standard tier measures are expected to be simple and low cost.

When it starts

The Act received Royal Assent on 3 April 2025. Enforcement begins in spring 2027, following an implementation period of at least 24 months.

That sounds distant. Two things make it less so. The statutory guidance was published on 15 April 2026, so what is expected of you is already known and written down — there is nothing left to wait for. And the SIA notification portal opens in the same spring 2027 window, which means a large number of venues will be notifying at once.

Are you in scope?

Three questions decide it.

1. Is it a qualifying premises?

The Act covers premises used for specified purposes — shops, food and drink, entertainment venues, sports grounds, libraries and museums, hotels, conference and exhibition spaces, community halls, places of worship, schools and colleges, healthcare, visitor attractions and public authority buildings.

Some premises are excluded. Transport hubs already covered by existing security frameworks — airports, major rail and underground stations — sit outside the regime, as do parliamentary and devolved legislature buildings, and open land without a controlled boundary such as a public park.

2. How many people could be there at once?

People reasonably expected at once	Where you sit
Fewer than 200	Out of scope
200 to 799	Standard tier
800 or more	Enhanced tier

The number that matters is the greatest number of people who could reasonably be expected to be present at the same time, and it includes staff, volunteers and contractors — not just the public. Use your busiest realistic day, not a typical one. The Christmas fair counts. So does the annual general meeting.

You do not need to commission a survey to work this out. The Home Office accepts fire safety occupancy figures, historical attendance records, counts of fixed seating or standing positions, ticket or registration sales, and limits set by your licence — any reasonable method you can justify and evidence.

3. Is it a place of worship, a school or a childcare setting?

If so, you are always standard tier, whatever your capacity. A cathedral that seats 1,200 is standard tier. A secondary school with 1,500 pupils is standard tier. This is a deliberate carve-out recognising that these premises are open, community-facing, and often run by volunteers or by staff whose job is not security.

The four procedures

Section 5 of the Act requires written procedures to be followed by people working at the premises if there is reason to suspect an act of terrorism is occurring or is about to occur. There are four, and the Act describes them by what they achieve rather than by name:

Evacuation — getting people out of the premises safely. You almost certainly have a fire evacuation plan already. It is not the same thing: a fire plan sends everyone to a single assembly point, which is exactly the wrong instinct if the threat is outside that door.

Invacuation — moving people to a place on the premises where there is less risk of harm. This is the one most venues have never thought about, and it is often the right answer when the danger is outside.

Lockdown — preventing people entering or leaving. Securing doors, stopping new arrivals, holding people where they are.

Communication — giving people information. How you tell staff something is happening, how you tell the public, and who speaks to the emergency services when they arrive.

The procedures must be proportionate to your premises. A village hall with one main door and a kitchen fire exit does not need what an arena needs, and the guidance does not ask for it.

Who is the responsible person?

The Act places its duties on a responsible person for each premises — in most cases whoever has control of the premises. For a village hall that is usually the trustee body. For a church it is often the incumbent or the parochial church council. For a school it is the governing body or trust.

That person notifies the SIA and is accountable for the procedures being in place. It is worth naming them in writing now, because "we assumed the other lot were doing it" is the most common way a shared building ends up with nobody responsible.

What happens if you do nothing

The Security Industry Authority regulates the regime. For a standard duty breach the maximum penalty is £10,000, with a daily penalty of up to £500 while the breach continues.

The more realistic risk for most venues is not the fine. It is being asked by an insurer, a licensing officer, or a hirer's own risk assessment whether you have your procedures — and having nothing to show.

What to do next

1. Work out your capacity using evidence you already hold, and write down which method you used.
2. Name your responsible person in writing, minuted if you have a committee.
3. Write your four procedures, specific to your building.
4. Brief your staff and volunteers, and keep a record of who has been briefed and when.
5. Notify the SIA when the portal opens in spring 2027.

The procedures are a one-time piece of work. Keeping your people aware of them is the part that continues.

If you are not sure whether any of this applies to you, the scope checker will tell you in about two minutes, and it is free.