The Terrorism (Protection of Premises) Act 2025, widely known as Martyn’s Law, received Royal Assent on 3 April 2025. With an implementation period of at least 24 months, enforcement is expected to begin around April 2027. For the thousands of organisations now assessing their obligations, the most pressing question is often a straightforward one: Does this law apply to us?
The answer is wider-reaching than many assume. Martyn’s Law does not target only concert arenas or stadiums. It applies across a broad range of sectors, and the Home Office estimates that up to 178,900 premises across the UK will fall within its scope. Understanding which sectors are covered, and what each tier demands, is the first step toward compliance.
The Act establishes a tiered approach, with obligations linked directly to the number of individuals reasonably expected to be present at a premises at any one time.
The standard tier covers premises where 200 to 799 individuals may be present. Requirements at this level are designed to be proportionate and low-cost. There is no mandate to introduce physical security infrastructure. Instead, duty holders must register with the Security Industry Authority (SIA), designate a responsible person, and ensure that staff can carry out four core public protection procedures: evacuation, invacuation, lockdown, and communication.
The enhanced tier applies where 800 or more individuals may be present. This tier carries all of the standard tier obligations plus additional requirements. Enhanced duty premises must appoint a designated senior individual, conduct a documented terrorism risk assessment, implement reasonably practicable physical protection measures, and submit compliance documentation to the SIA. Enhanced duty premises and qualifying events must also take steps to reduce their vulnerability to attack, moving the focus from reactive procedures to proactive risk reduction.
Qualifying events sit within the enhanced tier where they expect 800 or more attendees, are open to the public, and operate controlled entry such as ticketing or payment.
To fall within scope, a premises must include at least one building, be accessible to the public, meet the capacity threshold, and be used wholly or mainly for one of the activities listed in Schedule 1 of the Act. Schedule 1 is deliberately broad. The sectors it covers include the following.
Shopping centres, large stores, and retail parks that meet the capacity threshold are within scope. For multi-tenanted environments, responsibility for compliance typically rests with the party in control of the shared premises, such as a landlord or managing agent, rather than individual occupiers alone.
Hotels, restaurants, bars, nightclubs, and food-and-drink venues are all captured under the Act. Any premises within this sector that could reasonably expect 200 or more people at one time will need to assess which tier it falls into. For hospitality groups operating multiple sites, compliance is a portfolio-level challenge rather than a site-by-site exercise.
This is one of the largest categories within Schedule 1. Statutory guidance identifies a wide range of qualifying uses, including theatres, cinemas, concert halls, arenas, theme parks, zoos, aquariums, amusement arcades, casinos, gyms, leisure centres, swimming pools, and bowling alleys. The majority of larger entertainment venues will fall into the enhanced tier.
Hospitals, community health facilities, and other publicly accessible healthcare settings are in scope. For NHS trusts and private healthcare providers, this raises significant operational considerations, particularly given the nature of their staff, visitor, and patient populations. Healthcare organisations in Scotland are also subject to the Act, as counter-terrorism falls within UK government jurisdiction even in devolved areas.
Childcare settings, primary, secondary, and further education institutions are all in scope but remain in the standard tier even where they expect 800 or more individuals. This is an important distinction. Higher education establishments, including universities, are subject to the general tiering framework and may fall into the enhanced tier depending on their capacity. Free resources from the National Counter Terrorism Security Office (NaCTSO) are available specifically for education settings.
Bus and railway stations that meet the capacity threshold are included within scope. However, Schedule 2 of the Act excludes certain transport premises already subject to existing security legislation, including airports, national rail infrastructure, and underground premises, so operators in those sub-sectors should review the exclusions carefully.
Publicly accessible cultural and heritage venues are captured under the Act. Statutory guidance notes that visitor attractions could include heritage railway lines, illustrating the breadth of what qualifies. Local authorities and charitable trusts responsible for these venues should not assume their non-commercial status places them outside scope.
Places of worship that qualify are treated as standard duty premises under the Act, even if they would otherwise meet the enhanced tier threshold. This provides proportionate protection for faith communities while recognising the open and often unpredictable nature of attendance at religious settings.
Public sector buildings used for qualifying activities, alongside community halls, libraries, and civic venues with sufficient capacity, may all fall within scope. Even premises not traditionally considered high-risk, such as a community hall used regularly for large events, should conduct a capacity assessment.
Unlike earlier drafts of the legislation, office premises are no longer explicitly excluded from the Act. Whether an office building falls within scope depends on whether it meets the definition of qualifying premises. Large commercial estates, particularly those with publicly accessible ground-floor retail or hospitality uses, or those that stage public-facing events, will need to assess their position carefully.
The implementation period gives organisations time to prepare, but it should not be treated as an invitation to delay. Enforcement by the SIA is expected from April 2027, with potential penalties for enhanced tier non-compliance reaching up to £18 million or 5% of worldwide turnover. There are also criminal offences under the Act.
Organisations across every sector in scope should use the available time to:
Statutory guidance from the Home Office and the SIA is available via ProtectUK and GOV.UK. The government has made clear that organisations do not need to purchase specialist third-party compliance services to meet their obligations, but specialist training in terrorism awareness and protective security procedures remains a practical and credible way to build organisational readiness.
Martyn’s Law places clear responsibilities on organisations across every sector. Whether your premises fall into the standard or enhanced tier, your staff need to know how to respond when it matters most. Ubique delivers accredited counter-terrorism and protective security training designed for the demands of the Terrorism (Protection of Premises) Act 2025.
