Martyn’s Law: What It Means for UK Security Providers

The introduction of Martyn’s Law will bring new legal requirements for certain publicly accessible premises and events across the UK. For the private security industry, the legislation represents an important development in protective security, with implications for venue operators, event organisers, security contractors and the organisations responsible for managing public spaces.

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. Commonly known as Martyn’s Law, the legislation is named in memory of Martyn Hett, one of the 22 people killed in the Manchester Arena terrorist attack in 2017.

The Act is intended to improve preparedness for terrorist attacks by requiring organisations responsible for qualifying premises and events to consider appropriate procedures and, in certain circumstances, measures to reduce vulnerability to an attack.

The legislation is expected to come into force in spring 2027. The exact commencement date has not yet been confirmed.

Which premises and events are covered?

Martyn’s Law applies to qualifying premises and events in England, Wales, Scotland and Northern Ireland. Whether a premises falls within scope depends on its use, the number of people reasonably expected to be present and whether it meets the other conditions set out in the legislation.

For premises, the legislation generally applies where a building, or part of a building, is wholly or mainly used for one of the specified purposes in Schedule 1 of the Act and it is reasonable to expect 200 or more people to be present at the same time, from time to time.

Qualifying premises are divided into two tiers.

The standard tier covers premises where between 200 and 799 people may reasonably be expected to be present at the same time. The enhanced tier applies where 800 or more people may reasonably be expected to be present.

There are specific exceptions for premises used for childcare, primary and secondary education, further education and places of worship. These remain within the standard tier even where the number of people present reaches 800 or more.

The Act also covers certain events. To qualify, an event must be accessible to the public, have entry conditions involving checks such as tickets or passes, and reasonably expect 800 or more people to be present at the same time. Events held at premises already covered by the enhanced tier are treated under the requirements applying to those premises rather than as separate qualifying events.

The precise scope can depend on the use and circumstances of individual premises or events. The Home Office has published statutory guidance to help organisations establish whether they fall within the legislation.

What are the requirements?

The obligations differ depending on whether premises fall within the standard or enhanced tier.

For standard-tier premises, the responsible person must notify the Security Industry Authority (SIA) and, so far as reasonably practicable, have appropriate public protection procedures in place.

These procedures cover four areas:

• Evacuation: moving people away from danger.
• Invacuation: moving people to a safer location within the premises.
• Lockdown: securing the premises to prevent individuals entering or leaving.
• Communication: providing information to people at the premises.

Enhanced-tier premises and qualifying events have additional requirements. Alongside the public protection procedures, those responsible must, so far as reasonably practicable, put appropriate public protection measures in place to reduce the vulnerability of the premises or event to a terrorist attack.

The four areas identified in the legislation are monitoring, movement, physical security and the security of information about the premises or event.

Enhanced-tier responsible persons must also document their procedures and measures, assess how these reduce the relevant risks and submit the required documentation to the SIA.

The legislation uses the term “reasonably practicable”. This means that the steps taken should be considered in the context of the premises or event, balancing the potential protective benefit against factors such as cost, time and difficulty of implementation.

Check which requirements may apply to your premises

Not sure whether your premises fall within the scope of Martyn’s Law, or which tier may apply? Use our Martyn’s Law Compliance Calculator for an initial indication based on your premises and expected occupancy.

The calculator is an introductory guide and does not replace a formal assessment or the official statutory guidance.

The SIA’s new regulatory role

The Security Industry Authority will be responsible for regulating and enforcing Martyn’s Law.

This represents an expansion of its existing responsibilities. The SIA already regulates the private security industry through individual licensing and its oversight of approved security businesses. Under Martyn’s Law, it will also assess whether qualifying premises and events are meeting their legal obligations.

The SIA has outlined an approach involving education and support, compliance assessments and enforcement where necessary.

Its published guidance explains that assessments may involve desk-based reviews and on-site inspections. These will follow a risk-based approach, taking account of intelligence and the circumstances of individual premises and events. The SIA states that it will typically provide at least 72 hours’ notice before an on-site inspection, although it can seek a court warrant to enter without notice in certain circumstances.

The regulator’s role is not simply to check whether paperwork exists. Its stated focus is whether those responsible have taken reasonable steps to comply with the legislation.

What does this mean for security providers?

Security companies may have an important role in helping clients prepare for and meet the practical requirements of Martyn’s Law. However, it is important to understand where the legal responsibility sits.

The Act places the duties on the person or organisation responsible for qualifying premises or events. That responsibility cannot simply be transferred to a contracted security company.

A security provider may be asked to support the development or implementation of procedures, provide appropriately trained personnel, review existing arrangements or assist with aspects of protective security. The precise role will depend on the contract, the client’s requirements and the services being provided.

For example, a security contractor operating at a qualifying venue may already be involved in access control, monitoring, incident reporting, emergency procedures and communication arrangements. These activities may form part of the venue’s wider protective security arrangements, but their existence does not automatically establish compliance with Martyn’s Law.

The responsible organisation must ensure that the arrangements are appropriate to its premises or event and that the required procedures and measures are in place.

Security providers should therefore be clear about the scope of their contractual responsibilities. Where clients request additional work relating to Martyn’s Law, the services being provided, responsibilities and reporting arrangements should be properly defined.

There is also an important distinction between providing security services and providing specialist advice on compliance with the legislation. The Government has made clear that organisations do not automatically need to purchase specialist services to meet the requirements. The Home Office guidance is intended to help those responsible understand their obligations.

Preparing before commencement

Although the main requirements are not expected to come into force until spring 2027, organisations that may fall within scope can begin preparing now.

The first step is to establish whether the premises or event meets the criteria set out in the legislation. This includes considering its principal use where premises have more than one qualifying use, the number of people reasonably expected to be present and who has control of the premises for the relevant purpose.

The Home Office published additional guidance on determining the principal use of premises in September 2026. The associated regulations came into force on 15 October 2026.

Organisations should also review existing security arrangements and consider whether their procedures cover evacuation, invacuation, lockdown and communication. Those responsible for enhanced-tier premises and qualifying events will need to consider the additional requirements relating to protective security measures and documentation.

The SIA is developing an online notification system for organisations within scope. Notifications will be required once the legislation comes into force, rather than during the current preparation period.

A change for the wider security industry

Martyn’s Law introduces a formal set of protective security requirements for qualifying premises and events. It also gives the SIA a new regulatory role, extending its responsibilities into the oversight of public-facing venues and events.

For security providers, the legislation creates a need for a clear understanding of the requirements and how contracted security services may support clients’ arrangements. It does not, however, make every security contractor responsible for ensuring a client’s compliance.

The distinction between the duties of the responsible person and the services supplied by a security contractor will be important as organisations prepare for implementation.

With commencement expected in spring 2027, the coming months provide an opportunity for those potentially affected to understand the legislation, review existing arrangements and establish what will be required when the Act takes effect.