How to Prepare Your Business for Martyn’s Law: What Businesses and Event Organisers Need to Know

Martyn’s Law, formally the Terrorism (Protection of Premises) Act 2025, introduces new legal duties for certain public premises and events. The aim is simple: to make sure organisations are better prepared to protect the public if a terrorist attack happens at or near their premises or event.

For many businesses, venues and event organisers, the difficult part is understanding whether they are in scope, what level of duty applies, and what practical steps they should be taking now. This guide explains the key points in plain English.

Security measures at a public venue entrance

What is Martyn's Law?

Martyn’s Law is new UK legislation designed to improve protective security and public safety at qualifying premises and events.

It is named after Martyn Hett, one of the victims of the Manchester Arena attack in 2017. The law was introduced to help ensure that public venues and events are better prepared for terrorist threats and have suitable procedures in place to reduce the risk of harm.

The Act applies across the UK and creates a minimum legal standard for protective security at certain public premises and events.

Is every business covered by Martyn’s Law?

No. Martyn’s Law does not apply to every business. Whether you are in scope depends on the type of premises or event, how it is used, whether the public have access, and how many people may reasonably be expected to be present at the same time. There are two main tiers:

Standard Tier - This applies to qualifying premises where it is reasonable to expect 200 to 799 people to be present at the same time.

Enhanced Tier - This applies to qualifying premises and qualifying events where it is reasonable to expect 800 or more people to be present at the same time.

For events, the important point is that the figure is not based on total attendance across the whole day. It is based on the number of people who may be present at the same time, including attendees, staff, contractors, volunteers, performers and other operational personnel.

What types of premises may be in scope?

Premises may be in scope where they are publicly accessible and used for certain activities. This could include, depending on the circumstances:

• entertainment venues;

• theatres and cinemas;

• sports grounds;

• visitor attractions;

• shopping centres;

• large restaurants, bars or nightclubs;

• hotels with public event spaces;

• community buildings;

• education premises;

• places of worship;

• transport hubs;

• event venues.

The key question is not just “what type of business is it?” but whether the premises meets the conditions set out in the Act.

What about events?

Events may be in scope where they meet the qualifying event criteria. In practical terms, an event is likely to need closer review where:

• it is accessible to the public;

• it has controlled entry, such as tickets, passes, wristbands, accreditation, payment or checks;

• it is reasonable to expect 800 or more people to be present at the same time;

• it is not already covered as part of enhanced tier premises.

Examples could include festivals, concerts, outdoor events, ticketed public gatherings, large seasonal events, sporting events or temporary venues.

For event organisers, this means Martyn’s Law needs to be considered early during planning, not added at the last minute.

Event based security controls

Who is responsible?

The duty sits with the responsible person. For qualifying premises, this will usually be the person or organisation that has control of the premises for the relevant use. For example, this could be the operator of a venue, restaurant, theatre, attraction or similar premises.

For qualifying events, the responsible person is usually the person or organisation that has control of the premises for the purposes of that event. In many cases, this will be the event organiser, promoter or company running the event.

It is important to understand that the responsible person is not automatically the landowner, security company, safety advisor or local authority. These parties may support the arrangements, but legal responsibility sits with the person or organisation in control.

For enhanced tier premises and qualifying events, where the responsible person is an organisation, a senior individual must also be designated.

What will businesses need to do?

The exact requirements depend on whether the premises or event falls into the standard or enhanced tier. A basic level, organisations in scope will need to have appropriate public protection procedures in place. These are procedures that could reduce the risk of physical harm if a terrorist attack happens at or near the premises or event.

These procedures include:

• Evacuation – moving people away from danger;

• Invacuation – moving people into a safer place;

• Lockdown – securing people in place where leaving may be more dangerous;

• Communication – giving clear information to staff, visitors and others during an incident.
  

Enhanced tier premises and qualifying events will also need to consider additional public protection measures, including:

• monitoring;

• movement control;

• physical security;

• security of information;

• documented procedures and measures;

• submission of required information to the regulator;

• appointment of a senior individual where required.

Martyn’s Law Preparation: What Should Businesses Do Now?

Preparing for Martyn’s Law does not need to start with complicated paperwork or expensive equipment. A sensible approach is to follow a simple process.

1. Check whether you are in scope

Start by confirming whether your premises or event is covered by the Act.

You should consider:

• the type of premises or event;

• whether the public have access;

• the maximum number of people expected at the same time;

• whether entry is controlled;

• who has control of the premises or event;

• whether any exclusions apply.

For events, include everyone who may be present at the same time, not just ticket holders. This means staff, contractors, volunteers, performers, production teams, security, medical teams and others should be included in the calculation.

2. Identify the responsible person

Be clear about who is legally responsible. For fixed premises, this is usually the operator. For temporary events, this is usually the organiser or promoter who has control of the event space. Where several organisations are involved, responsibilities should be clearly agreed and documented. This is especially important for events, shared premises, shopping centres, venues with tenants, or sites where a promoter hires land or a building.

3. Assess the risks

The assessment should consider realistic threat scenarios and site-specific vulnerabilities.

This may include:

• marauding terrorist attack;

• vehicle as a weapon;

• improvised explosive device;

• suspicious item;

• fire as a weapon;

• hostile reconnaissance;

• attack during busy entry or exit periods;

• crowded areas outside the premises or event;

• vulnerabilities created by queues, search areas or dispersal routes.

The assessment should also consider what controls are already in place, where the gaps are, and what actions are reasonably practicable.

4. Review existing arrangements

Many businesses already have useful arrangements in place, such as fire evacuation plans, CCTV, access control, stewarding, incident reporting, first aid provision or emergency communication procedures.

However, a fire evacuation plan alone is not enough. A terrorist-related incident may require a different response. For example, evacuating people towards a normal assembly point may not be safe if the threat is outside the building. In some cases, lockdown or invacuation may be safer than evacuation. Existing plans should be reviewed against hostile threat scenarios.

5. Create practical procedures

Procedures should be clear, realistic and understood by the people expected to use them.

At minimum, organisations should consider:

• who makes decisions during an incident;

• how staff will be alerted;

• how visitors or attendees will be instructed;

• when evacuation, invacuation or lockdown may be used;

• how emergency services will be contacted;

• how staff will report suspicious activity;

• how vulnerable people will be supported;

• how contractors and temporary staff will be briefed;

• how the site will recover after an incident.

Procedures should be written in plain language. If staff cannot understand them quickly, they are unlikely to work during a real emergency.

6. Train and brief staff

Staff awareness is one of the most important parts of preparedness.

Training and briefings may include:

• recognising suspicious behaviour;

• reporting concerns;

• understanding evacuation, invacuation and lockdown procedures;

• knowing who is in charge during an incident;

• understanding communication methods;

• knowing how to respond to a suspicious item;

• understanding “Run, Hide, Tell” principles;

• knowing when not to put themselves at risk.

For events, briefings should include security, stewards, event control, bar staff, production teams, medical teams, contractors and volunteers where relevant.

7. Record your actions

Martyn’s Law preparation should be documented.

Records may include:

• scope assessment;

• capacity calculation;

• responsible person details;

• senior individual details, where required;

• risk assessment;

• public protection procedures;

• action plan;

• staff training records;

• security briefings;

• site plans;

• communication structure;

• review records.

Good records show that the organisation has considered the risks and taken proportionate action.

8. Review and update

Arrangements should be reviewed regularly and whenever something changes.

Examples of changes that should trigger a review include:

• increased capacity;

• layout changes;

• new entrances or exits;

• different event profile;

• changes to ticketing or access control;

• new contractors or security providers;

• changes to surrounding roads or public areas;

• changes in threat level;

• incidents, near misses or security concerns.

Martyn’s Law preparation should be treated as an ongoing process, not a one-off document.

Practical measures that may help

Martyn’s Law is not just about buying security equipment. In many cases, the most effective improvements are simple, practical and low cost.

Examples may include:

• clear staff roles and responsibilities;

• improved incident communication;

• better control of entrances and exits;

• queue management;

• search procedures where appropriate;

• suspicious item procedures;

• suspicious behaviour reporting;

• clear emergency announcements;

• event control or management decision structure;

• improved lighting;

• CCTV review;

• access control;

• lockdown options;

• invacuation areas;

• hostile vehicle risk review;

• protection of crowded areas during entry and exit;

• coordination with neighbouring premises;

• tabletop exercises or scenario testing.

The right controls will depend on the premises, event, crowd profile, location and risk assessment. Measures should be proportionate and should not create new safety risks, such as blocking escape routes or causing unsafe crowd build-up.

Common mistakes to avoid

Assuming it does not apply

Some businesses may wrongly assume Martyn’s Law only applies to major arenas or large stadiums. In reality, a wide range of public premises and events may fall within scope.

Looking only at ticket numbers

For events, the key figure is the number of people reasonably expected to be present at the same time. Staff, contractors, volunteers and operational teams should be included.

Treating it as a security-only issue

Security teams are important, but Martyn’s Law also affects operations, safety, management, communications, contractors and event planning.

Relying only on fire evacuation plans

Fire procedures are not the same as terrorist incident procedures. Evacuation may not always be the safest option.

Buying equipment before assessing the risk

CCTV, barriers, search equipment and access control can all have a place, but they should be based on a clear risk assessment and operational need.

Failing to brief staff

Procedures only work if people know what to do. Staff training and briefing are essential.

What should businesses do now?

Although there is an implementation period before the Act comes fully into force, businesses and event organisers should not wait until the last minute.

A sensible starting point is to:

1. check whether your premises or event may be in scope;

2. identify who the responsible person is;

3. review current emergency and security arrangements;

4. assess terrorism-related risks and vulnerabilities;

5. prepare an action plan;

6. brief staff and key contractors;

7. keep records of what has been done;

8. review arrangements as your operation changes.

Starting early gives you time to make practical improvements without panic buying equipment or producing rushed paperwork.

Need help getting Martyn’s Law ready?

Martyn’s Law is not about paperwork for the sake of it. It is about understanding whether your premises or event is in scope, identifying realistic security risks, and putting proportionate arrangements in place to protect people.

Orakul Safety can support businesses, venues and event organisers with:

• Martyn’s Law scope checks;

• responsible person and duty holder reviews;

• terrorism preparedness assessments;

• public protection procedures;

• evacuation, invacuation and lockdown planning;

• event security and safety planning;

• staff briefings;

• practical action plans;

• review of existing arrangements.

If you are unsure whether your premises or event is in scope, or you want to understand what you already have in place and where the gaps are, get in touch.

Please note: This article is for general guidance only and does not replace official statutory guidance or legal advice. Organisations should review the latest Home Office, SIA, ProtectUK and NPSA guidance when preparing for Martyn’s Law.