The Complete Guide to Martyn's Law Compliance for UK Venues

What Is Martyn's Law?

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025. It received Royal Assent on 3 April 2025 and applies across the entire United Kingdom. The Act is named after Martyn Hett, one of 22 people killed in the Manchester Arena terrorist attack on 22 May 2017.

The Act creates a two-tier system based on venue capacity: standard duty for 200–799, enhanced duty for 800+. Venues should have plans for keeping people safe if something happens, and the staff/volunteers who work there, including anyone hiring the building for one-off events, should know what those plans are. For a shorter overview, see our 'What is Martyn's Law?' explainer.

Who Does Martyn's Law Apply To?

Your venue is in scope if four things are true: it's a building, it's used for one of 17 specified purposes, it regularly has 200+ people on site at once, and it isn't specifically excluded.

The 17 specified uses are:

What's excluded?

Under 200 capacity, you're out. Open-access parks and gardens with no tickets or payment are also out. Parliamentary premises and transport sites already covered by existing security legislation are out too.

How Is Venue Capacity Calculated?

Capacity means 'the greatest number of individuals reasonably expected to be present at the same time'. Staff, volunteers, contractors, building hirers; they all count. Not just paying customers.

Six approved methods for calculating capacity:

• Fire safety occupancy: floor space factors or exit capacity, whichever is lower
• Historic attendance data: actual records like door counts, CCTV review, or manual counts, plus staff and volunteers
• Fixed seating/standing: count seats or standing positions, plus staff and volunteers
• Ticket sales: maximum tickets or registrations for any session, plus staff and volunteers
• Attendance restrictions: caps set by licences or operational decisions, plus staff and volunteers
• Other reasonable methods: EPOS data, staff rotas, customer flow assessments, or any other reasonable evidence

You don't need a consultant for this. Use our free capacity calculator to work out your figure using floor space factors and exit widths, or see the Home Office's capacity factsheet for the full guidance.

Standard Duty vs Enhanced Duty

Two tiers: standard duty and enhanced duty. Which one you fall under depends on capacity.

Places of worship, childcare, and schools are always standard tier regardless of size, but universities can be enhanced if they're 800+. (Charging for entry doesn't change this. A place of worship only takes on enhanced-style duties if it hosts a separate ticketed event of 800 or more.)

This guide focuses on standard tier (which covers venues with 200-799 capacity). For a detailed breakdown of both tiers, see our standard tier vs enhanced tier comparison. If you're 800+, the enhanced duty factsheet is what you need.

What Does Standard Duty Actually Require?

Two things. That's all the Act requires of standard tier venues.

1. Notify the SIA (Section 9)

Tell the Security Industry Authority when you become responsible for qualifying premises (or stop being responsible, or your details change). It's free. The SIA is still building the online system for this.

2. Have public protection procedures (Section 5)

You must, 'so far as is reasonably practicable', have appropriate public protection procedures covering four areas:

Evacuation

Know every exit route and set assembly points. Decide who starts the evacuation and how people are guided out of danger, including anyone with reduced mobility. But remember: a terrorism evacuation is not a fire evacuation. People might need to avoid exits near the threat, so staff/volunteers need to give real-time directions based on where the threat actually is.

Invacuation

When the threat is outside, you bring people deeper into the building instead of sending them out. Find interior rooms with no external windows, solid walls, decent locks. Upper floors are better if you've got them. An incident could last hours, so think about water, toilets, and lighting too.

Lockdown

Every door, gate, window, shutter. How does each one lock? Who locks it? How fast? Nominate specific people for specific points. Lights off, blinds shut. One thing: the lockdown has to be reversible. If a fire breaks out during an incident, you still need to get people out.

Communication

Who raises the alarm, and how? Radios, PA, code words, a WhatsApp group; they all work. The point is that you've got a way to reach staff, volunteers, and customers that isn't the fire alarm. Think about non-English speakers and anyone with hearing or visual impairments.

'Reasonably practicable'

This phrase comes from health and safety law, and it basically means 'proportionate to your situation'. A single-room shop with one front door and a lock? That satisfies the lockdown requirement. What counts is that you've thought it through and your staff and volunteers know the plan.

What Standard Tier Does NOT Require

There's a lot of nonsense circulating about what the law demands. The government even published a myth buster (PDF). Here's what standard tier does not require:

• No physical alterations to your premises
• No equipment purchases (no CCTV, barriers, bollards, or metal detectors)
• No mandatory training course or qualification
• No written PPP document submitted to the SIA
• No bag searches, vehicle checks, or monitoring
• No designated senior responsible individual
• No need to hire security consultants

In the government's own words: compliance needs 'neither particular expertise nor the use of third-party products or services'.

That said, while you don't legally need a written document, having one is the easiest way to prove your procedures exist when an inspector turns up. That's what Standard Tier generates for you (free of charge).

Who Is the Responsible Person?

It's whoever actually runs the venue, not whoever owns the building. Operational control is what matters.

• For a pub: the pub landlord or operator
• For a shop: the shop owner or operator
• For a school: the governing body or proprietor
• For an NHS hospital: the NHS trust

If a landlord owns the freehold but doesn't run the pub, they're not the responsible person. Where more than one person has control (a shop inside a shopping centre, for instance), each one is individually accountable and must coordinate.

How Should You Prepare Your Staff and Volunteers?

Everyone who might need to act on your procedures needs to know them. Staff, volunteers, contractors, anyone hiring the venue. The format is up to you, as the government scrapped mandatory training requirements after the 2024 consultation.

Shift briefings, induction sessions, posters in the staff room, tabletop exercises. Whatever actually works. Duty managers need to know the procedures inside out since they're the ones running the response. Everyone else just needs the basics. New starters get briefed before their first shift.

The real test: if an SIA inspector asked a random staff member or volunteer to explain the procedures, could they?

The government's free ACT Awareness e-learning (about 45 minutes) is a decent baseline covering threat recognition, suspicious items, and attack responses.

When Does Martyn's Law Come Into Force?

It's law, but not yet enforceable. The government promised at least 24 months of preparation time.

Nobody has to comply yet. But now is the perfect time to get things sorted.

One thing to watch: the Secretary of State can amend capacity thresholds and venue categories without new legislation. The goalposts could shift. Join our free mailing list if you want to know when they do.

What Are the Penalties for Non-Compliance?

The SIA will regulate compliance, and say they'll take a 'support first' approach, meaning they'll advise and guide before reaching for penalties. But here's what happens if you don't sort it out:

Standard tier non-compliance is handled through fines, not criminal charges. Enhanced tier is another world: up to £18 million and prison time. See our full guide to penalties and enforcement.

When inspectors visit (72 hours' notice, usually), the SIA's stated approach and its draft Section 12 guidance point to three checks: do procedures exist, do they make sense for your building, and can your staff and volunteers explain them? On the same basis, don't expect a hunt for security equipment or consultancy reports.

How to Prepare

Strip it back and there are five things you need to do:

1. Work out your capacity using one of the six approved methods. If you're under 200, you don't need to do anything else.
2. Put procedures in place for evacuation, invacuation, lockdown, and communication, tailored to your specific premises.
3. Make sure all your staff and volunteers know those procedures. Duty managers need to know them inside out.
4. Keep records of what you've done: the procedures themselves, who's been briefed, when, and any reviews.
5. Notify the SIA when their online system opens (expected Spring 2027).

Our free Martyn's Law compliance checklist breaks these five steps into individual tick-box items, each marked as required or recommended, with a PDF version you can print for the venue.

You can do all of this yourself. But if you'd rather get it done in 10 minutes, Standard Tier walks you through it and generates a tailored PPP, a staff training portal, and a digital audit trail.

Frequently Asked Questions

Official Sources and Further Reading

Everything above is drawn from these. Worth bookmarking, because guidance updates will land here first.

The Act

• Full text of the Terrorism (Protection of Premises) Act 2025

Statutory Guidance

• Home Office statutory guidance (Section 27, published 15 April 2026)

Home Office Factsheets

• Overarching factsheet
• Standard duty requirements
• Scope (premises)
• Responsible person
• Capacity assessment
• Myth buster (PDF)

ProtectUK and Counter Terrorism Policing

• ProtectUK Martyn's Law hub
• Standard tier guidance
• Free ACT e-learning catalogue
• Evacuation, invacuation, lockdown, and protected spaces