The Home Office is pleased to share additional material about the Act including a one page leaflet and a myth buster.

The Terrorism (Protection of Premises) Act 2025 received Royal Assent in April. The Act is more commonly known as ‘Martyn’s Law’ after Martyn Hett, who alongside 21 other victims, was tragically killed in the horrific Manchester Arena attack in 2017.

The Act will ensure the public are better protected from terrorism by requiring certain public premises and events to be prepared and ready to keep people safe in the event of an attack.

Myth 1

“Businesses and organisations need to comply with the Act immediately.”

When will I need to comply?

The Act received Royal Assent on 3 April 2025, and it is expected that the implementation period will be at least 24 months. This period will enable those responsible for premises and events to have sufficient time to understand their new obligations, and to plan and prepare accordingly. This also allows time for the new regulator function of the Security Industry Authority (SIA) to be established.

While there is no legal requirement to comply until the Act comes into force, you may wish to start considering what you need to do.

The Home Office will publish guidance before the Act comes into force and will build on materials already available on ProtectUK to raise awareness. These include:

• An animation giving an overview of the Act: https://www.protectuk.police.uk/martyns-law/martyns-law-overview-and-what-you-need-know

• factsheets setting out key aspects of the Act: www.gov.uk/
  government/publications/terrorism-protection-of-premises-act2025-factsheets

There will also be engagement activities, such as webinars, during the implementation period to help you understand the requirements.

Does that mean I do not need to consider protective security before the act comes into force?

The Act will establish a minimum legal standard of protective security at larger premises and events for the first time. Many businesses and organisations already have excellent protective security measures in place. The government encourages those responsible to put in place appropriate measures for their circumstances.

There are helpful resources on ProtectUK (www.protectuk.police.uk) including guidance, advice and free e-learning including:

• Action Counters Terrorism (ACT) which can be found at ProtectUK
• See, Check and Notify (SCaN) which can be found at the NPSA website.

Myth 2

“As I’m not in scope, protective security shouldn’t matter to me.”

I’m not in scope of the Act, but what could I be doing to improve my organisation’s security culture?

There is no legal obligation on organisation and businesses that are out of scope. However, you should make informed decisions about how to better protect people in the venues and public spaces you are responsible for.

If you are not in scope, you can still develop a good security culture which identifies threats, minimises risk to the public and effectively responds to incident. You can find more information on the ProtectUK website: www.protectuk.police.uk

Myth 3

“The Act puts expensive requirements on businesses and organisations.”

Will compliance cost a lot of money/

The government’s impact assessment estimated that over a 10-year period, the cost is £330 per year to standard tier premises (between 200 and 799 people), which relates to management and staff time spent rather than cash expenditure, and £5,210 per year to enhanced tier premises (800 people or more).

Standard Tier Premises

In the standard tier, the focus is on ensuring that premises have simple and low-cost public protection procedures in place, such as evacuation. Costs relate primarily to staff time, and there is no requirement to put in place or purchase physical measures.

Organisations in the standard tier may already have security measures in place, such as locks and alarms, which may support public protection procedures. Further information on good security practice can be found at ProtectUK: www.protectuk.police.uk/guidance

Enhanced Tier Premises And Qualifying Events

In addition to the above procedures, those responsible for enhanced tier premises or events must also put in place measures to reduce their vulnerability to terrorism. These may be implemented through people (such as training), processes (such as a bag search policy) or physical measures (such as CCTV).

You will need to determine which measures are appropriate and proportionate to your circumstances, taking into account the nature of the premises or event, your activities and resources. Therefore, measures will vary between different premises and events.

Myth 4

“Inspections and notifying the SIA will cost businesses and organisations money.”

No, the SIA will not charge fees for inspections, post-inspection advice, or notifications.

You will not need to notify the SIA of your premises or event until the relevant provisions of the Act commence. The Home Office and the SIA will publish the timeline and how to submit notifications well in advance.

Myth 5

“The regulators will close down businesses.”

The SIA will have powers to restrict events and the use of premises but will only be able to use these in exceptional circumstances where there is a clear and specific risk of harm to the public. Premises and events will have a right of appeal to the tribunal if they disagree with the use of these powers.

Where an inspection has taken place and the SIA has concerns that the premises or event is not in compliance, it will rely on advice and guidance to secure compliance where possible. Formal enforcement powers will only be used where it is necessary and proportionate to do so to ensure compliance. Where the SIA uses its formal enforcement powers it will usually issue a compliance and/or a penalty notice.

Further information on enforcement measures is in this factsheet: www.gov.uk/government/publications/terrorism-protection-ofpremises-act-2025-factsheets/terrorism-protection-of-premisesact-2025-the-regulator-sanctions-and-enforcement-factsheet

Myth 6

“Every qualifying premises and qualifying event must have an individual as the responsible person.”

Who is responsible for ensuring a premises or qualifying event complies with the Act?

The responsible person for qualifying premises is whoever has control of the premises for its relevant use under the Act. These uses are set out within Schedule 1 and include visitor attractions, hotels and leisure activities. For qualifying events, the responsible person is whoever has control of the premises for the purposes of the event.

The responsible person may be an individual, but it is anticipated, will typically be a company or other organisation. For example, a company operating 50 qualifying premises may be the responsible person for all of them.

For an enhanced tier premises or event, where the responsible person is not an individual, there is an additional requirement to designate a senior individual with responsibility for ensuring that the body complies with the requirements in the Act.

Myth 7

“People who hire qualifying premises are the responsible”

The responsible person is whoever has control of the premises for its relevant Schedule 1 use. If the premises is mainly used as a hall or event space that is hired out, the person in control will usually be the premises operator, not the hirer.

Contracts to hire qualifying premises may contain terms and conditions for the hirer relevant to the requirements under the Act, but responsibility under the Act does not pass to them.

Myth 8

“I need to notifying the regulator of every event at a qualifying premises”

Enhanced Premises Tier

Enhanced tier premises do not need to notify the SIA of individual events or activities that are taking place there. For example, a hotel within the enhanced tier hiring out its whole space for film premieres and other events would not need to notify the SIA of this activity because it will already be subject to enhanced tier requirements as qualifying premises.

Standard Tier Premises

In some circumstances a standard tier premises may host a one off or occasional event that meets the Act’s qualifying event criteria without being drawn into the enhanced tier. Where this is the case, the requirement to notify the regulator will fall to the responsible person for the qualifying event (often the event organiser). In such circumstances the event organiser will be the party in control of the premises for the duration of the event – this may be the person responsible for the premises day to day activities or the event organiser. Further information on what qualifies as a one off or occasional event will be provided in statutory guidance.

Out of Scope Premises

Events that meet the criteria set out in the Act and take place in premises that are not otherwise in scope must be notified to the SIA. For example, a private warehouse (not a qualifying premises) hosting a one-off, ticketed music event open to the public where 800+ individuals are expected to be present, would be drawn into scope. Where the event meets the qualifying event criteria, the requirement to notify the regulator will fall to the person who has control of the premises for the purposes of the event (i.e. the event organiser).

Myth 9

“I need to purchase Public access Trauma First Aid Kits to be compliant”

There is no specific requirement to provide medical treatment and associated equipment within the Act.

The government provides advice and encourages businesses to consider appropriate healthcare provisions, but this does not form a requirement under the Act.

Wider guidance on first aid awareness can be found at: www.protectuk.police.uk/advice-and-guidance/response/counter-terrorism-first-aid-awareness

Myth 10

“Businesses and organisations will need to buy services to comply with the Acts requirement’s”

The government’s intent is that those responsible for premises and events in scope can comply with the Act without needing to buy specialist services.

The Home Office will publish guidance during the implementation period, before the Act comes into force. This guidance will be self explanatory and easy to follow, requiring no particular expertise nor the use of third-party products or services offered by the private sector.

The Home Office, the Security Industry Authority and the National Counter Terrorism Security Office do not endorse any third-party products offered by the private sector in respect of compliance with this legislation. It is not necessary to obtain specialist products or services offered by the private sector to comply with the Act, statutory guidance will clearly explain the Act’s requirements. We encourage you to visit the ProtectUK website for guidance on protective security, including updates on compliance with the Act.