Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025. It asks venues where 200 or more people can gather to be ready to keep people safe if there's an attack: to have simple plans, and for the people who run events to know them.
For most community venues, that means four plans and telling the regulator who is responsible. No security staff, no bag searches and no new equipment.
This guide covers the whole law in plain words: what it is, who it covers, what it asks, what it doesn't, who checks, and when it starts. Each section links to a fuller guide if you want more.
Want it on paper? The Martyn's Law quick guide puts the whole law on two pages, with a step-by-step list to tick off. Free PDF, no email needed.
The short version
- It's law already, but nothing is required yet. The duties are expected to start in spring 2027.
- It covers buildings where 200 or more people can be at once, used for things like worship, entertainment, food and drink, sport or community events.
- Most community venues in scope are standard tier (200 to 799 people). Places of worship, schools and childcare premises stay standard tier at any size, where that's the building's main use.
- The standard tier asks for three things: tell the regulator who is responsible, have four simple plans, and make sure the people with a part to play know them.
- It doesn't ask for security staff, bag searches, CCTV, building work or a training course.
- The regulator is the Security Industry Authority (SIA). It will advise and support venues, and can issue penalties if needed.
What the law is
The Terrorism (Protection of Premises) Act 2025 received Royal Assent, the point at which a bill becomes law, on 3 April 2025 (the Act). The Home Office says its aim is to improve protective security "across the UK" (overarching factsheet).
It's known as Martyn's Law after Martyn Hett, who was killed in the Manchester Arena attack in 2017. His mother, Figen Murray, set up the Martyn's Law campaign for venues to be better prepared (GOV.UK, 26 February 2021). Before the law had his name, the government's proposals were called the Protect Duty. The government consulted on them in 2021, and in December 2022 announced that the Protect Duty would be known as Martyn's Law (GOV.UK, 19 December 2022).
The idea is simple. If something happens, people who already know which doors to use, where to go and what to say can help everyone else get to safety quickly.
Who it covers
The Act calls a building in scope "qualifying premises". A venue is in scope if all four of these are true (the Act, section 2):
- It's a building, or a building with land around it. A field or a park on its own isn't.
- It's used wholly or mainly for one of the uses the Act lists in Schedule 1. These include shops, food and drink, entertainment and leisure, sports grounds, halls, libraries and museums, visitor attractions, hotels, places of worship, health care, childcare, education and public authorities (Schedule 1).
- 200 or more people can reasonably be expected there at the same time, "from time to time". So it's your busiest occasions that count, not an ordinary day. The count includes staff and volunteers.
- It isn't one of the places the Act leaves out in Schedule 2 (more on these below).
The third test is the one most venues need to think about. Think of Eid prayers, Diwali or Christmas, the quiz night, the big match or the summer fete. Our guide to how to count to 200 goes through it step by step, and the free busiest day calculator does the sums with you.
Not sure? Check your venue in two minutes, free, with no email needed.
What's left out
Schedule 2 of the Act leaves some places out (Schedule 2). The ones a community venue might meet are open-air spaces: a park, a garden, a recreation ground, a sports ground that isn't a designated sports ground, or other open-air places used for recreation or leisure. They're left out as long as nothing is in place to check that people coming in have paid, have a ticket or pass, or are members or guests of a club (paragraph 3).
Two things to watch:
- A gate on the day doesn't change this. Checks for one event, or for one facility, don't count if the ground is open to the public the rest of the time (paragraph 3(4)). A big ticketed event there could still be a qualifying event (below).
- The building on the site still counts. A clubhouse, pavilion or hall next to the pitch can be qualifying premises in its own right (paragraph 3(5)).
The Act also leaves out buildings used by Parliament and the devolved parliaments and governments, and some transport sites that already have their own security plans, such as airports and ports.
The two tiers
The Act splits venues in scope into two tiers, by how many people can be there at once (the Act, section 2(3)):
| Tier | People reasonably expected at once | Who it's likely to be |
|---|---|---|
| Standard tier | 200 to 799 | Most village halls, places of worship, pubs, clubhouses and community centres |
| Enhanced tier | 800 or more | Larger venues, unless their main use keeps them standard (below) |
Places of worship, schools and childcare stay standard
Where a building's main use is worship, it's standard tier "regardless of how they would otherwise be treated", however many people come. The same goes for childcare premises and schools (Schedule 1, paragraphs 9(2), 13(3) and 14(3)(b)). So a large mosque, gurdwara, temple, synagogue or church whose main use is worship stays standard tier, even if well over 800 people come for a festival.
It turns on the main use. A hall that hosts a weekly service or a playgroup is still mainly a hall, so it follows the normal tiers. The Home Office explains more in its note on the principal use of premises.
What the enhanced tier adds
Enhanced tier venues have the standard tier's duties, plus more: security measures to make the venue less vulnerable to an attack and reduce the risk of harm (section 6), a written record of what they've done (section 7), and, where the responsible person isn't a single person, a named senior individual (section 10). This guide is about the standard tier, which is where most community venues sit.
Qualifying events
A big one-off event can have its own duties, as a "qualifying event". That's an event open to the public, where 800 or more people may be there at once, with checks that people have paid, have a ticket or pass, or are members or guests (the Act, section 3). It can't be at a venue that's already enhanced tier, and events at places of worship, schools and childcare premises are left out (Schedule 2, paragraph 6).
Most community venues will never host one. If you hire out your building, a hirer planning something this size should tell you when they book. Our page for hirers explains their side, and the glossary has the tests in one place.
What the standard tier asks
The duties fall on the responsible person: whoever has control of the building for the use that puts it in scope. For most community venues that's the committee, trustees, club or company that runs it, not one volunteer. Our guide to the responsible person explains who it is in common situations.
At the standard tier, the responsible person needs to do three things.
1. Tell the regulator
Tell the SIA about the venue and who is responsible for it, and tell it again when those details change (the Act, section 9). The SIA is building an online service for this on GOV.UK, and the time and format will be set out before the duties start.
2. Have four simple plans
The Act asks for "public protection procedures", so far as is reasonably practicable (the Act, section 5). In plain words, there are four:
- Get everyone out (evacuation): how you move people out of the building, or part of it, quickly and safely.
- Bring everyone in (invacuation): how you bring people inside, or to a safer room, when the danger is outside. Our guide explains what invacuation is, with an example.
- Lock down (lockdown): how you stop people getting in or out, for example by locking doors.
- Keep people informed (communication): how you tell people what's happening and what to do.
"Reasonably practicable" means doing what makes sense for your venue, weighing how much a step helps against its cost, time and difficulty. A small hall's plans will be simpler than a theatre's, and that's expected.
Two guides help here. Your fire risk assessment already covers part of the first plan, and helping everyone out covers making the plans work for disabled and older people, children, and anyone who can't hear or see a warning.
3. Make sure people know their part
Anyone with a role in the plans, such as keyholders, stewards, bar staff or the person in charge on the night, needs to know the procedures and their part in them (standard duty factsheet). That includes your hirers, who are often the ones in charge when the building is busy.
For the whole list in order, use the Martyn's Law checklist.
What it doesn't ask
The standard tier doesn't ask for:
- security staff or door staff
- bag searches
- CCTV or new equipment
- building work: the Home Office says the Act "does not require physical alterations" for these procedures (standard duty factsheet)
- a training course: there's "no statutory requirement" for specific training (statutory guidance, para 7.51)
It doesn't even require written plans. The guidance says there's "no legal requirement" at the standard tier to prepare a document setting out your procedures (para 7.32). But it calls writing them down good practice, because it helps people understand them and helps you show the SIA what you've done (paras 7.8 and 7.32). Most venues will want something on paper.
You don't have to start from a blank page. Our free Martyn's Law templates give you the four plans to fill in, and the sample pack shows what a finished set looks like for a made-up cricket club.
Who checks: the SIA
The Security Industry Authority is the regulator for Martyn's Law (the Act, section 12). Part of its role, in its own words, is "helping those responsible" for venues follow the law (SIA: its role as regulator). It says it will take a risk-based approach, look at whether venues have taken reasonable steps, and consider each venue's circumstances.
It will check through desk-based assessments and visits, and says it will typically give at least 72 hours' notice before an on-site inspection.
If something isn't right, the SIA can give a compliance notice, setting out the steps to take and the time to take them in (section 13). It can also issue penalties. For standard tier venues, the maximum penalty is £10,000 (section 18), and up to £500 a day if a venue still doesn't put things right after a notice (section 19). These are maximums, set by the Act. Neither applies until the duties start.
So the way to be ready is simple: plans that fit your building, a note to the SIA, and people who know their part.
When it starts
| When | What |
|---|---|
| 3 April 2025 | The Act becomes law (Royal Assent). |
| 15 April 2026 | The Home Office publishes its statutory guidance. |
| Early 2027 (expected) | The SIA's scope tool, due "in the new year", and its optional templates, due "over the coming months". |
| Spring 2027 (expected) | The duties are expected to start. |
The guidance says the implementation period is "at least 24 months" from Royal Assent, and that there's no legal requirement to comply until the law comes into force (para 2.10). The SIA says the law is expected to come into force in spring 2027 and that it will confirm the exact date (SIA: its role as regulator). It's also building a scope tool and templates for the procedures, and says using the templates will be optional (SIA, 11 September 2026).
So nothing is required by law yet, and there's time to get ready calmly. The Home Office encourages venues to start thinking about the requirements now.
Add the Martyn's Law key dates to your calendar, and see what's changed for each new publication as it comes out.
Across the UK
Martyn's Law isn't just for England. The part of the Act that sets out the duties for venues extends to England and Wales, Scotland and Northern Ireland (the Act, section 36). The same tiers, the same four plans and the same regulator apply in all four nations.
What to do now
- Check whether your venue is in scope, and which tier. If you're not sure about numbers, use the busiest day calculator.
- Agree who the responsible person is, and who will lead the work. The committee pack has the decisions to make and draft wording for your minutes.
- Walk round the building. Note your exits, a room where people could shelter away from the street, and which doors lock.
- Write your four plans, using the templates or your own words.
- Brief the people who run events, hirers included.
- See where you stand with the free readiness check.
hailo does steps 4 and 5 with you: it drafts your plans from your answers, briefs your team and your hirers by link, and keeps the record of who has read what. See how it works.
Guides to read next
- Martyn's Law checklist: every step, in order.
- Who is the responsible person?
- What is invacuation?
- Martyn's Law and your fire risk assessment
- Helping everyone out: plans that work for people who can't move quickly.
- Martyn's Law quick guide: the law on two pages.
- Martyn's Law templates: the four plans to fill in.
- Committee pack: for your committee or trustees.
- Martyn's Law glossary: every term in plain English.
Sources
- Terrorism (Protection of Premises) Act 2025, legislation.gov.uk: sections 2, 3, 5, 9, 12, 13, 18, 19 and 36, and Schedules 1 and 2
- Overarching factsheet, Home Office
- Standard duty requirements factsheet, Home Office
- Statutory guidance, Home Office: paras 2.10, 7.8, 7.32 and 7.51
- Principal use of premises, Home Office
- Understanding Martyn's Law and the SIA's role as regulator, SIA
- Martyn's Law: scope, support and what's next, SIA (11 September 2026)
- Government sets out plans to protect public places from terrorist attacks, GOV.UK (26 February 2021)
- Martyn's Law to ensure stronger protections against terrorism in public places, GOV.UK (19 December 2022)
General information, not legal advice.