Benita Hajdas
Martyn’s Law is set to make preparedness for terrorist incidents a clearer operational responsibility for many UK premises and events. Yet the most useful question for organisations is not simply, “Does the law apply to us?”
It is this: if an incident happened tomorrow, would your people know what to do?
Would they know when to evacuate, when to move to a safer place inside, when to secure the premises and how to communicate clear instructions?
For organisations that welcome the public or operate larger workplaces, these are practical questions about leadership, procedures and people. The statutory guidance for the Terrorism (Protection of Premises) Act 2025, commonly known as Martyn’s Law, has now been published. While the substantive requirements are not yet in force, the guidance gives organisations an important opportunity to prepare properly.
What is Martyn’s Law?
Martyn’s Law is the commonly used name for the Terrorism (Protection of Premises) Act 2025. It received Royal Assent on 3 April 2025 and is designed to improve protective security and organisational preparedness across the UK.
The Act is intended to help people responsible for qualifying premises and events prepare for the possibility of a terrorist attack and reduce the risk of physical harm if one occurs. It applies across England, Wales, Scotland and Northern Ireland.
The government has allowed an implementation period of at least 24 months from Royal Assent before the substantive requirements come into force. That means there is currently no legal requirement to comply with the new duties. However, the Home Office is clear that organisations in scope should begin considering the requirements and preparing in advance.
This should not be approached as a paperwork exercise. Strong preparedness is built into everyday operations, from how staff report concerns to how decisions are made during a fast-moving incident.
Who may be responsible at your premises?
One of the most important parts of Martyn’s Law is identifying the responsible person.
For a qualifying premises, this will generally be the individual, organisation or company that has control of the premises for the relevant use. It is not necessarily the building owner. For example, a tenant with control over the day-to-day operation of a venue may be the responsible person, even where another organisation owns the building.
This can become more complex where a building has multiple occupiers, where premises sit within a larger site, or where events are delivered by several organisations. In these cases, co-ordination and co-operation are essential. Responsibilities should be clear before an incident, not debated during one.
For enhanced-tier premises and qualifying events, organisations must also designate a senior individual. This person should be involved in managing or controlling the responsible organisation and helps ensure that the required duties are met.
Which premises and events may be in scope?
Whether a premises falls within scope depends on specific legal criteria, including its principal use and the number of people who can reasonably be expected to be present at the same time.
The statutory guidance refers to two tiers:
- Standard tier: qualifying premises where 200 to 799 people can reasonably be expected to be present at the same time, from time to time.
- Enhanced tier: qualifying premises where 800 or more people can reasonably be expected to be present at the same time, from time to time.
Qualifying events are subject to enhanced-tier requirements.
The legal detail matters, and organisations should assess their individual circumstances against the statutory guidance. However, businesses should not wait for a final answer on scope before improving their basic preparedness. Clear procedures, trained staff and good communication are sensible controls for many public-facing and larger workplaces.
The four procedures every team should understand
The guidance identifies four types of public protection procedure. Staff should be familiar with each one and understand that the correct response will depend on the nature and location of the threat.
Evacuation
Evacuation means moving people away from danger by taking them out of the premises or event, or out of the affected part of it.
Invacuation
Invacuation means moving people to a safer place within the premises. It may involve bringing people inside from an outdoor area or moving them away from an exposed part of the building.
Lockdown
Lockdown means securing the premises to prevent people entering or leaving where this is the safest course of action.
Communication
Communication means providing people with information, alerts and instructions when it is safe to do so. The most effective instructions are simple, timely and understood by the people receiving them.
These procedures need to work for real people in a real workplace. That includes employees, contractors, visitors, agency staff, volunteers and anyone who may not be familiar with the building or its emergency arrangements.
Preparedness is more than a security plan
For enhanced-tier premises and qualifying events, the Act also requires responsible persons to consider proportionate public protection measures relating to monitoring, movement, physical safety and security, and security of information.
The phrase used throughout the guidance is reasonably practicable. In practice, this means measures should be suitable and proportionate to the organisation’s circumstances, taking account of what can be done, the level of risk, and the time, cost and difficulty of implementation.
There is no single template that will suit every organisation. A hospital, distribution centre, school, event venue and retail destination face different operational realities. Yet each needs to understand its environment, identify vulnerabilities and ensure the people on site can act safely.
Effective preparedness commonly brings together:
- clear ownership and escalation routes;
- practical procedures for evacuation, invacuation, lockdown and communication;
- staff briefing and role-specific training;
- access control, visitor management and reporting arrangements;
- appropriate security technology and monitoring;
- plans that consider people who may need additional assistance;
- regular reviews as the premises, operations or threat environment changes.
Five actions to take now
1. Identify who has operational control
Map the organisations, tenants, contractors and event partners involved at your premises. Identify who controls the relevant activity and who needs to make decisions in an emergency.
2. Review your current procedures
Do your existing emergency arrangements distinguish clearly between evacuation, invacuation and lockdown? Are instructions accessible, current and practical for the people using the premises?
3. Test how communication would work
Consider how messages would reach staff, visitors and contractors. A procedure is only useful if the right people receive and understand it in time.
4. Assess the physical environment
Review entrances, exits, public areas, access arrangements, critical infrastructure and places where people might gather. Identify weaknesses that could increase harm or delay a response.
5. Build a security culture
Preparedness is not solely the responsibility of a security manager. Everyone should know how to report concerns, follow instructions and raise issues safely. Leadership commitment is what turns procedures into consistent practice.
How Circle UK Group can help
Circle UK Group supports organisations with integrated security, safety, compliance and operational risk management. We help clients understand their exposure, review protective security arrangements and introduce practical measures that support safer, more resilient operations.
Our support can include security and risk assessments, emergency and lockdown planning, access-control and monitoring solutions, trained security personnel, staff awareness and ongoing operational support. The aim is not to create unnecessary complexity. It is to give your organisation clear ownership, proportionate controls and confidence that people know what to do.
Start preparing before the requirements take effect
Martyn’s Law gives organisations time to prepare. Use it well. Start by asking whether responsibility is clear, whether procedures are workable and whether your people could respond calmly and safely if an incident occurred.
Call 020 3988 2444
Sources and further reading
Explore More
Stay Ahead of Security, Compliance & Risk
Join over 5,000 professionals receiving practical insights, industry updates and expert guidance on security, compliance, health & safety and business continuity.