What is Martyn's Law?

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025. It requires certain public premises and events in the UK to be prepared and ready to keep people safe if a terrorist attack happens. The name honours Martyn Hett, one of the 22 people killed in the Manchester Arena attack.

If you manage a university building, a student accommodation block or a busy office, there's a good chance the law will apply to you.

Martyn's Law in Numbers

• 3 April 2025: the date the Act received Royal Assent
• At least 24 months: the implementation period the government planned between Royal Assent and the law coming into force
• Spring 2027: when the Act is expected to come into force. The SIA will confirm the exact date in advance.
• About 180,000 sites: the SIA predicts around 155,000 standard tier premises and 25,000 enhanced tier premises will be in scope
• 200 and 800 people: the two thresholds that decide which duties apply
• £18 million or 5% of worldwide revenue: the maximum penalty for the most serious breaches at larger sites
• 4 nations: the law applies across England, Wales, Scotland and Northern Ireland

Defining Martyn's Law

According to the Home Office, the Act will improve protective security and organisational preparedness across the UK by requiring those responsible for certain premises and events to think through how they would respond to a terrorist attack. At certain larger premises and events, they must also consider appropriate steps to reduce vulnerability to attack.

The law is about readiness. When something goes wrong, on-site staff are best placed to act in the first few minutes. Martyn's Law makes sure those staff have a plan and know how to follow it.

Two bodies shape how the law works:

• The Home Office sets out what organisations must do. It published its statutory guidance under section 27 of the Act on 15 April 2026.
• The Security Industry Authority (SIA) is the regulator. It's a Home Office arm's-length body, set up under the Private Security Industry Act 2001 to regulate the private security industry.

Why Is It Called Martyn's Law?

The government has paid tribute to the 22 victims of the 2017 Manchester Arena attack, and to Figen Murray, mother of victim Martyn Hett. It credits her campaigning as crucial to driving the Act forward.

The government gives two main reasons for the law.

The threat is real and hard to predict. Since the start of 2020, MI5 and the police have disrupted 19 late-stage attack plots and intervened in many hundreds of developing threats. The Home Office says it can't predict where in the UK an attack might happen, or what type of premises or event could be affected. A site might be the direct target, or simply be located near one.

Preparedness has been patchy. Engagement with businesses suggests counter-terrorism preparedness often lags behind areas with long-established legal requirements, such as health and safety. Without a legal duty, there has been no consistency in what organisations consider or achieve.

When Does Martyn's Law Come Into Force?

Martyn's Law is already an Act of Parliament, but its main duties aren't switched on yet. Here's where things stand.

• 3 April 2025: Royal Assent.
• 15 April 2026: the Home Office published its statutory guidance.
• 15 April to 12 June 2026: the SIA consulted on a draft of its own guidance. It plans to publish the final version, with a consultation report, in autumn 2026.
• Early 2027: the SIA will invite volunteers to test its notification portal before launch.
• Spring 2027 (expected): the law comes into force.

No one has to comply until the Act comes into force. But the Home Office says those in scope may wish to start considering the requirements before then. Agreeing who's responsible, writing procedures, and briefing staff takes months, not weeks, so starting early makes sense.

Who Does Martyn's Law Apply to?

The law covers two things: qualifying premises and qualifying events. The Home Office's statutory guidance is the authoritative test. ProtectUK also has a useful premises flowchart.

Premises

According to the SIA, your premises are likely to be in scope if all of the following apply:

1. They include a building or part of a building.
2. They're wholly or mainly used for one of the purposes listed in Schedule 1 of the Act. A restaurant or a shop are two examples.
3. It's reasonable to expect 200 or more people to be present at the same time, from time to time. Staff count towards that number.
4. They aren't excluded under Schedule 2 of the Act.

Events

An event is likely to be in scope if it's open to the public, has entry checks (for example, checking that attendees have a ticket or pass, or are members or guests of a club or association), expects 800 or more people at once including staff, isn't held at premises already in the enhanced tier, and isn't held at excluded premises. For a university, that could include large graduation ceremonies or open days with ticketed entry.

How to Count People

The number that matters is your realistic peak, not an average day. The Home Office says organisations can use a range of methods, including familiar ones like safe occupancy calculations for fire safety, or historic data. It has also published a supplementary document outlining methods for assessing how many people you can reasonably expect.

Historic data is where good record-keeping pays off. Footfall counts, room bookings, ticket sales and front-desk logs all help you build an honest picture of your busiest days.

Who Is Responsible?

The responsible person is the individual, organisation or company with control of the premises for the purpose that brings them into scope. You have control if you occupy the premises and can decide how they're managed and used, particularly who can or can't stay on site.

That responsibility stays with you. You can't pass it on, though you can take advice from a suitably knowledgeable security adviser. The Home Office adds that you can't delegate legal responsibility to a contracted service provider, though you may delegate tasks.

Standard Tier vs Enhanced Tier

Your duties depend on how many people you can reasonably expect at your busiest times.

• Standard tier: premises where between 200 and 799 people may be present at the same time at the busiest times
• Enhanced tier: larger premises where 800 or more people may be present at the same time, from time to time. Qualifying events carry the same requirements as enhanced tier premises.

There's one important exception. Premises used for childcare, primary, secondary, or further education, or as a place of worship qualify for the standard tier at 200 or more people and stay there even if numbers reach 800 or more. Universities aren't on that list, so large university buildings can fall into the enhanced tier.

What Does Martyn's Law Require?

Standard Tier: Two Duties

If you're responsible for standard-tier premises, you must notify the SIA of who the responsible person is once the law takes effect. You must also have appropriate public protection procedures in place, so far as reasonably practicable, to reduce the risk of physical harm if an attack happened on site or nearby.

The Act names four public protection procedures:

• Evacuation: getting people away from danger by moving them out of the premises or event, or part of it
• Invacuation: moving people away from danger to a place within the premises where they're less likely to be harmed
• Lockdown: securing the premises to prevent people entering or leaving
• Communication: making sure people at the premises are given information

The good news is that the Home Office says standard tier requirements centre on simple, low-cost activities, with costs mainly relating to time spent.

Enhanced Tier: Everything Above, Plus More

Enhanced tier premises and qualifying events must meet the standard tier duties. They must also put in place appropriate public protection measures, so far as reasonably practicable, to reduce their vulnerability to an attack. They must document their procedures and measures, assess how these reduce risk and vulnerability, and send that document to the SIA. The SIA will share templates before the law comes into effect.

The four public protection measures to consider are:

• Monitoring: monitoring the premises and their immediate surroundings, using tools like CCTV
• Movement: how people move into, out of and within the premises
• Physical security: the physical safety and security of the premises
• Security of information: making sure information about the premises' operation, design, use or internal workings isn't widely available to anyone who might use it to plan an attack

If the responsible person for enhanced tier premises is an organisation, it must also assign a member of staff involved in management or control to be responsible for compliance, known as the senior individual.

What "Reasonably Practicable" Means

This phrase runs through the whole law. It means weighing what can be done to achieve the goals of the procedures and measures against the cost, time and difficulty of putting them in place, taking into account the nature of your premises and the resources available to you. A 250-person office isn't expected to match an 80,000-seat stadium.

Notifying the SIA

You only need to notify the SIA if you fall within scope. When you do, you'll use an online portal the SIA is currently building. The timings are already set out in Home Office guidance:

• Three months: the window for premises already in scope to notify the SIA, starting from the day the requirement comes into force
• 28 days: after that first three-month period, anyone who becomes or stops being responsible for qualifying premises must notify the SIA within 28 days
• 14 days: the notification window for qualifying events

How Martyn's Law Will Be Enforced

The SIA's role is to help those in scope comply, assess compliance, spot non-compliance, and bring sites into line. It will use desk-based assessments and on-site inspections, taking a risk-based approach informed by intelligence. Its focus will be on whether organisations have taken reasonable steps to comply.

The SIA will typically give at least 72 hours' notice of an on-site inspection, though in some circumstances it can ask a court for a warrant to enter without notice.

The early tone is supportive. The SIA's chief executive has said its role will be "primarily advisory from the start", giving venues and events the chance to get compliance right first. The SIA is creating more than 100 new operational posts in its Martyn's Law team.

The Penalties

The fines are significant, especially for larger sites. Under section 18 and section 19 of the Act:

• Standard tier: a maximum non-compliance penalty of £10,000
• Enhanced tier and qualifying events: a maximum of £18 million or 5% of the organisation's qualifying worldwide revenue, whichever is greater
• Failing to attend and answer questions when required: up to £5,000
• Daily penalties: where someone breaches a compliance notice or restriction notice, the SIA can add daily penalties of up to £500 a day for standard tier premises, or up to £50,000 a day for enhanced tier premises and events

Penalties are meant to be fair. The SIA must set a penalty that's proportionate to the breach, taking into account any steps taken to fix it and the person's ability to pay. There's usually a chance to make representations, and a right of appeal to the Tribunal.

What It Won't Cost You

According to ProtectUK, There's no fee to notify the SIA, and no charge for inspections or advice. Inspected premises and events won't receive a public rating.

How to Start Preparing for Martyn's Law

You don't need to wait for spring 2027. These steps follow official advice, and most of them cost little more than time.

1. Read the official guidance. The SIA says the best first step is to review the Home Office section 27 guidance. Start here.
2. Confirm your responsible person. In shared or multi-tenant buildings, agree early who controls which space.
3. Estimate your peak numbers. Use real data, and remember staff counts.
4. Confirm your tier. Check whether any events could bring enhanced tier duties.
5. Draft your four procedures. Cover evacuation, invacuation, lockdown and communication.
6. Brief your teams. ProtectUK offers free advice and guidance on protective security.
7. Sign up for SIA updates. The SIA runs an email list and is recruiting volunteers to help test its notification portal.

A word of caution: be wary of anyone selling a shortcut. The Home Office says premises and events "do not need to spend money on consultants" to comply. When the Security Minister laid the statutory guidance before Parliament, he said, "No third-party product is endorsed by the Home Office" or by the SIA.

Where Your Front Desk and Mailroom Fit In

Martyn's Law is mostly about people and plans. But every plan runs through the same few places in a building, and reception and the mailroom are among the busiest.

Consider the volume. UK parcel volumes rose 7.1% to 4.2 billion items in 2024–25. A large share of those parcels land at university front desks, student halls, and office buildings. That turns mailroom management into a daily job and shapes how prepared a building is when something goes wrong.

Here's where the two meet.

Front-desk teams are on the front line. Reception and mailroom staff see who and what comes through the door all day. They're often the ones who'll start an evacuation, guide people to a safe room, or lock the doors. Good parcel management frees them to do that, instead of being stuck behind a counter matching names to boxes.

Busy entry points make every procedure harder. Lockdown means stopping people entering or leaving, and evacuation needs clear routes. Both are harder when a queue of residents is waiting to collect parcels at the main entrance. Spreading collections out, or letting people collect their own parcels securely, keeps entry points calmer.

Communication is a skill teams can practise. Communication is one of the four procedures every in-scope site must consider. Teams that already message staff, students or residents quickly, every day, have a head start. With Parcel Tracker, recipients get updates by email, SMS, or other messaging platforms as soon as a parcel is ready. That habit of keeping contact details current and reaching people fast carries over well into an emergency plan.

Records help you understand your building. Parcel Tracker's digital parcel log records digital proof of pickup, time-stamps each record, captures photos, and collects recipient signatures. Its reports show parcel counts, delivery times, courier trends, and overdue items. That data won't calculate your Martyn's Law headcount on its own. But it can show when your front desk is under the most pressure, which helps you plan staffing for procedures.

To be clear, no product can make you Martyn's Law compliant, and Parcel Tracker doesn't claim to. What it does is keep one of your busiest entry points organised, logged and calm, so your team can focus on the procedures that matter. Learn more about Parcel Tracker's mailroom management software and parcel management software.

Martyn's Law in Your Sector

How the law applies depends on how you use your buildings.

• Universities: university buildings aren't on the list of premises that stay in the standard tier, so large teaching, sports or event spaces may reach the enhanced tier. Ticketed events with 800 or more attendees, such as some graduation ceremonies, may count as qualifying events.
• Student accommodation: whether a building is in scope depends on whether its main use falls under Schedule 1, and on how many people can be present at once. Check each building against the Home Office guidance rather than assuming.
• Offices: in shared buildings, the key questions are who controls which space and who counts as the responsible person. Agree this with your landlord or other tenants early.

Martyn's Law: Frequently Asked Questions

Is Martyn's Law in force yet?
Not yet. It became law on 3 April 2025 and is expected to come into force in spring 2027, with the exact date confirmed in advance. Until then, there's no legal duty to comply.

Who enforces Martyn's Law?
The Security Industry Authority (SIA), which will help organisations comply, assess compliance, and deal with non-compliance.

Does Martyn's Law apply in Scotland, Wales and Northern Ireland?
Yes. It applies across all four nations of the UK.

Do staff count towards the 200 and 800 thresholds?
Yes. The thresholds include members of staff.

Does Martyn's Law apply to schools?
Yes, where 200 or more people may be present at once. Childcare, primary, secondary and further education settings stay in the standard tier even at 800 or more.

Does Martyn's Law apply to events?
Yes, if the event is open to the public, has entry checks, expects 800 or more people at once, and isn't held at an enhanced tier or on excluded premises.

Can we hand responsibility to a security contractor?
No. You can delegate tasks, but not your legal responsibility, to a contracted service provider.

Do we need to buy security equipment or hire consultants?
Not necessarily. Standard tier duties focus on procedures and staff time, and neither the SIA nor the Home Office endorses or recommends specific companies or services for compliance.

How long will we have to notify the SIA?
Premises already in scope will have three months from the day the notification requirement comes into force. For qualifying events, the window is 14 days.

What are the penalties for not complying?
Up to £10,000 for standard tier premises. For enhanced tier premises and events, up to £18 million or 5% of qualifying worldwide revenue, whichever is greater. Daily penalties can be added if a compliance notice or restriction notice is breached.

Does it cost anything to register or be inspected?
No. There's no fee to notify the SIA and no charge for inspections or advice.

Get Ready for Martyn's Law

Spring 2027 is closer than it looks. The organisations that start now won't be rushing later.

Disclaimer: This article provides general information about the Terrorism (Protection of Premises) Act 2025. It isn't legal or security advice and doesn't replace official guidance from the Home Office and the SIA. Check the official guidance before making decisions.