Terrorism (Protection of Premises) Act 2025 (“Martyn’s Law”) Receives Royal Assent

Key Take Aways for Retail and Public-Facing Premises

On 3 April 2025, the Terrorism (Protection of Premises) Act received Royal Assent, marking a significant change to the UK’s counter-terrorism framework. Known as Martyn’s Law – named after Martyn Hett, one of the victims of the 2017 Manchester Arena attack – the Act introduces new duties on those responsible for certain premises and events to take proportionate steps to reduce the risk of harm to the public in the event of a terrorist incident.

The legislation imposes different requirements based on the size and use of the premises, with larger venues subject to enhanced duties. While the exact date for implementation is not yet known, the government has indicated there will be a minimum 24-month implementation period, during which time guidance will be published and a new regulatory function within the Security Industry Authority (SIA) will be established.

Businesses are encouraged to begin familiarising themselves with the new framework now, while remaining alert for forthcoming statutory guidance.

What the Act Aims to Achieve

Martyn’s Law is designed to:

• Improve public safety by requiring basic preparedness measures for terrorist threats at qualifying premises.
• Promote organisational readiness, particularly at high-footfall or high-risk venues.
• Ensure consistency in protective security practices across the UK.

The Act applies across all four nations of the UK: England, Wales, Scotland, and Northern Ireland.

Tiered Approach to Premises

The Act introduces two primary tiers of duty depending on venue size and use:

Standard Duty Premises

Premises where it is reasonable to expect that at least 200 but fewer than 800 individuals may be present at the same time.

• Examples: Small-to-medium retail stores, busy restaurants, or leisure centres.
• Requirements:
   - Notify the SIA of the premises.
   - Have appropriate public protection procedures in place, covering evacuation, lockdown, invacuation (the act of moving people to a safe place inside a building or premises when there is a threat or danger outside or in another part of the building), and communication protocols in the event of a terrorist incident.
   - No physical security infrastructure is mandated – these are low-cost, procedural steps.

Enhanced Duty Premises and Qualifying Events

Premises or events where 800 or more individuals may be expected at any one time.

• Examples: Large supermarkets, department stores, shopping centres, stadiums, concert venues, major public events.
• Requirements:
   - As above, plus:
     ~ Conduct an assessment of vulnerabilities to terrorism.
     ~ Implement reasonably practicable physical and operational measures to reduce the risk of harm and vulnerability.
     ~ Document procedures and submit to the SIA.
     ~ Appoint a Senior Individual (if the responsible party is not an individual) to ensure ongoing compliance.
   

Q&A for Retailers and Public Premises Operators

Q1: Does this apply to my premises?
If your business operates from a building open to the public and it is reasonable to expect 200+ people might be present at one time – such as a supermarket, department store or a shopping mall – it will likely fall within scope. Specific exclusions exist (e.g. private dwellings, certain parks), but most public-facing retail premises are in scope.

Q2: When will the Act come into force?
A formal commencement date has not been set. However, the Government has stated that implementation will not begin before a minimum 24-month preparation period, allowing for the publication of guidance and set-up of regulatory oversight.

Q3: What should I be doing now?

• Review your premises’ capacity to determine whether you fall under the standard or enhanced tier.
• Map your current procedures (evacuation, lockdown etc.) and identify any gaps.
• Stay alert for government guidance, expected later in the implementation period.
• Begin considering designated roles for compliance (e.g. Senior Individual for enhanced duty premises).

Q4: Who is the “responsible person” under the Act?
Usually, the person or organisation in control of the premises for its relevant use. For supermarkets, this would likely be the operating company. Where there are mixed uses (e.g. shops with childcare facilities), the principal use determines responsibility.

Q5: How will this be enforced?
The Security Industry Authority (SIA) will regulate compliance. They will issue statutory guidance and be empowered to:

• Conduct assessments.
• Issue compliance or restriction notices.
• Impose civil monetary penalties.
• In serious or persistent cases, initiate criminal proceedings.

Q6: Will my whole site be in scope (e.g. for shopping centres)?
If your site contains multiple premises, individual operators may each have responsibilities, particularly if they control their units independently. Coordination obligations will also apply.

We will provide further alerts as government guidance is published and once the statutory commencement date is confirmed.

If you have questions about how Martyn’s Law may affect your business, please don’t hesitate to contact us.

Contact:

Hayley Riach - Partner & Technical Director

E: hriach@keoghs.co.uk

Natalie Larnder - Head of Market Affairs

E: nlarnder@keoghs.co.uk