Martyn’s Law explained simply: if your business, venue, or event welcomes the public, you may have legal duties once the Act comes into force, expected in Spring 2027.
The law is not about turning every venue into an airport. It is about understanding your risks, training staff, planning ahead, and making sure people know what to do during a serious incident.
For UK businesses, the key questions are simple: does Martyn’s Law apply, which tier are you in, what procedures do you need, and how do security measures like CCTV, access control, guards, lockdown plans, and evacuation routes fit in?
Note: This article is for general guidance only and should not be treated as legal advice. Businesses should refer to official GOV.UK, ProtectUK, and SIA guidance for detailed requirements.
Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025. It was created to improve public safety and protective security across UK premises and events that are open to the public.
The law is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017. Its purpose is to make sure publicly accessible locations are better prepared to respond if a terrorist attack happens.
GOV.UK confirms that the Act received Royal Assent on 3 April 2025, but the main legal duties are not yet in force. The implementation period is expected to last at least 24 months from Royal Assent, with the law expected to come into force in Spring 2027.
Businesses do not need to panic, but they should use this time to:
● Check whether their premises or event is in scope
● Confirm which tier may apply
● Review evacuation, invacuation, lockdown, and communication procedures
● Identify who is responsible for staff roles and emergency decisions
● Prepare staff before the legal duties begin
In our view, that preparation window matters. The businesses that start early will not just be “more compliant.” They will be calmer, clearer, and more organised when reviewing staff roles, emergency procedures, and site security.
Martyn’s Law for businesses is not just a legal topic. It is a risk management topic.
Poor security planning can affect:
● Staff safety
● Visitor confidence
● Public safety
● Business continuity
● Insurance exposure
● Emergency response time
● Reputation
● Legal and compliance readiness
● Day-to-day site control
The Home Office has stated that since March 2017, security services and law enforcement have disrupted 43 late-stage plots, and there have been 15 domestic terror attacks. That does not mean businesses should operate in fear. It means public-facing organisations need realistic plans, not assumptions.
One thing we see often in security planning is this: businesses usually have more security than they realise, but it is not always joined up. They may have cameras, alarms, staff radios, access control, and guards, but no clear procedure connecting them during a serious incident.
That is where Martyn’s Law compliance becomes practical.
Martyn’s Law may apply if your premises or event is open to the public and it is reasonable to expect 200 or more people to be present at the same time. Premises with 200 to 799 people fall into the standard tier, while larger premises and qualifying events with 800 or more people fall into the enhanced tier.
The law is not based only on business type. It depends on public access, expected occupancy, site use, and whether the premises or event falls within the scope of the act.
Not every business will fall under Martyn’s Law. The Act focuses on qualifying premises and qualifying events where public access and expected occupancy meet the relevant thresholds. Smaller premises below the threshold may not be in scope, but they can still use the guidance as good security practice.
Martyn’s Law applies to certain qualifying premises and qualifying events where members of the public may be present.
This may include:
● Retail stores and shopping centres
● Hotels, restaurants, bars and hospitality venues
● Theatres, cinemas and entertainment venues
● Sports grounds and leisure facilities
● Event spaces and exhibition venues
● Places of worship
● Education settings
● Healthcare premises
● Public buildings
● Visitor attractions
● Transport-related sites
● Large outdoor events
The important point is that Martyn’s Law requirements are not based only on the type of business. They depend on whether the premises or event is in scope and how many people may reasonably be expected to be present at the same time.
That number matters because it determines whether standard tier Martyn’s Law or enhanced tier Martyn’s Law applies.
Businesses should consider how many people may reasonably be expected to be present at the same time, including visitors, customers, staff, contractors, and event attendees, where relevant.
The exact assessment should follow official guidance, but businesses should start by reviewing normal peak times, event layouts, venue capacity, and public access areas.
Martyn’s Law uses a tiered approach. The higher the expected number of people, the more detailed the responsibilities become.
Tier | Who It Applies To | Main Requirements | Practical Security Focus |
Standard tier Martyn’s Law | Qualifying premises where 200 to 799 people may reasonably be present | Notify the SIA and put appropriate public protection procedures in place | Staff awareness, evacuation, invacuation, lockdown, and communication procedures |
Enhanced tier Martyn’s Law | Larger qualifying premises and qualifying events where 800 or more people may reasonably be present | Standard tier duties, plus public protection measures, documentation, and senior responsibility | CCTV, access control, search policies, patrols, physical security, incident response, and formal planning |
In simple terms, the standard tier is mostly about knowing what staff should do. Enhanced tier is about procedures plus proportionate security measures, documentation, and clearer senior accountability.
Focuses on proportionate, low-cost preparation, including clear public protection procedures, assigned responsibility, and basic staff training.
Goes further, with documented public protection measures, stronger venue security planning, and information sharing with the Security Industry Authority.
Start with risk, not equipment. Once the risk is clear, the right mix of CCTV, access control, guards, procedures, and communication becomes much easier to plan.
Some actions may be legal duties once the Act comes into force, while others are good security practice.
For example, standard-tier premises focus on notification and public protection procedures. CCTV, access control, guarding, and patrols may support a stronger plan, but they should be based on site risk rather than assumed as automatic requirements.
The responsible person Martyn’s Law requirement means someone must be accountable for meeting the legal duties.
Depending on the site, this could be the owner, operator, tenant, event organiser, or another party with control over the premises or event.
The responsible person should be able to answer:
● Is the premises or event in scope?
● Which tier applies?
● Who manages emergency procedures?
● Are staff trained?
● Are evacuation routes clear?
● Do we have lockdown procedures?
● Do we have evacuation procedures?
● Can we communicate quickly with staff, visitors and contractors?
● Are our current security measures suitable for the risk?
This cannot sit vaguely between management, facilities and security. If everyone assumes someone else owns it, nobody owns it properly.
Public protection procedures are the core actions staff should follow during an attack or suspected attack.
The four key procedures are:
Evacuation means moving people safely out of the premises. Most businesses already think about evacuation because of fire safety, but terrorism response can be different.
For example, sending people straight outside may not always be the safest option if the threat is near the entrance, car park, or street outside. So evacuation routes should be reviewed with real security scenarios in mind.
Invacuation means moving people to a safer place inside the premises.
This is especially important when the threat is outside or when leaving the building could put people at greater risk. Offices, hotels, schools, healthcare premises, event venues, and shopping locations should all think carefully about where people could be moved internally.
This is one of the most overlooked areas. Many businesses have fire evacuation plans, but fewer have a strong plan for keeping people safely inside when needed.
Lockdown procedures are used when it may be safer to secure the premises or part of the premises.
This could involve locking doors, restricting access, lowering shutters, closing internal barriers, moving people away from exposed areas, or stopping movement through certain zones.
This is where access control for venues becomes very practical. If a building cannot quickly secure key areas, a lockdown procedure may look good on paper but fail in real life.
Communication procedures explain how instructions are shared quickly.
This may involve radios, PA systems, staff messaging groups, alarms, digital signage, phone trees, control room instructions, or direct staff briefings.
In a serious incident, confusion can spread fast. Clear communication helps reduce panic, guide movement, and prevent people from walking into danger.
The security steps needed will depend on the tier, site type, layout, risk level, and existing controls.
Possible measures may include:
● CCTV for venues and public areas
● Remote CCTV monitoring
● Access control for venues and restricted zones
● Manned guarding at entrances or high-risk areas
● Event security teams for crowd management and incident response
● Bag search policies where appropriate
● Vehicle checks for exposed or high-risk sites
● Mobile patrols
● Key holding and alarm response
● Visitor management procedures
● Lighting around entrances, exits, and car parks
● Clear emergency signage
● Protected evacuation routes
● Internal safe areas for invacuation
● Staff training and incident drills
CCTV, guards, and access control all have a role, but they should never be treated as separate pieces. A camera can show what is happening. A guard can respond and guide people. Access control can help secure areas.
The real strength comes when all three support the same plan.
That is the difference between having security equipment and having a security strategy. For businesses unsure where the gaps are, a practical site review from a provider like Intraguard can help turn the checklist into a workable plan.
Not automatically. Standard tier Martyn’s Law focuses on public protection procedures, not forcing every venue to install new CCTV.
However, CCTV for venues can support a stronger response plan. It helps teams monitor entrances, spot unusual activity, review incidents, and understand what is happening across public areas.
The key is connection. CCTV works best when it supports trained staff, clear communication procedures, access control, and a practical incident response plan.
Standard tier premises are not required to install physical security measures simply because they fall under Martyn’s Law. The focus is on notification and appropriate public protection procedures. Any CCTV, access control, or guarding upgrades should be based on real site risk, not panic buying.
A written emergency plan is useful, but it does not prove readiness. In a real incident, staff need to act quickly without searching documents or guessing responsibilities.
The plan must explain who leads, how instructions are shared, where people should move, and when evacuation, invacuation, or lockdown applies.
Our View: If key staff cannot explain the first two minutes clearly, the plan needs work. Martyn’s Law compliance is about procedures people can actually use under pressure.
Use this Martyn’s Law compliance checklist as a practical starting point:
Step | What to Check | Why It Matters |
1 | Confirm whether your premises or event is in scope | You need to know if Martyn’s Law applies before planning next steps |
2 | Estimate expected occupancy | This helps determine standard tier or enhanced tier |
3 | Identify the responsible person | Someone must clearly own the process |
4 | Review evacuation routes | Routes must be practical, visible, and usable |
5 | Identify invacuation areas | People may need to move to safety inside the building |
6 | Review lockdown options | Doors, shutters, and access points must work under pressure |
7 | Check communication procedures | Staff and visitors need fast, clear instructions |
8 | Assess CCTV coverage | Cameras should support visibility, monitoring, and incident review |
9 | Review access control | Restricted areas should not be easy to enter |
10 | Assess guarding needs | Some sites need trained security officers for response and control |
11 | Train staff | Procedures only work if people understand them |
12 | Test and update the plan | A plan should improve as the site changes |
Not sure where your venue stands? Intraguard can review your site, identify practical security gaps, and help turn Martyn’s Law preparation into clear procedures your team can actually use.
A lot of businesses will not struggle because they ignored Martyn’s Law completely. They may struggle because they assumed their existing security setup was enough.
Common gaps include:
CCTV can show what happened, but it cannot make decisions, guide visitors, or control movement. Without a response process, footage becomes evidence after the incident rather than protection during it.
Guards need to know exactly who leads, who communicates, and what action comes first. Without that structure, even visible security can become reactive instead of controlled.
Uncontrolled entry points create easy gaps in site security. These areas can expose staff-only zones, stockrooms, plant rooms, or back-of-house routes.
A blocked route can slow movement when every second matters. Poor signage also increases confusion, especially for visitors who do not know the building.
Evacuation is not always the safest option if the threat is outside or near an exit. Without invacuation planning, staff may move people into greater danger.
A lockdown plan only works if staff know how to secure doors, restrict movement, and communicate quickly. If it has never been tested, it may fail under pressure.
These staff are often on the front line with visitors, queues, and access points. If they are not briefed, the response becomes inconsistent across the site.
Visitors will look to staff for direction during an emergency. Without clear communication procedures, confusion can spread quickly and slow down safe movement.
One of the biggest mistakes we see is businesses treating emergency planning like paperwork. If the duty manager, receptionist, security officer, or event supervisor does not know what to do in the first two minutes, the plan needs work.
The best preparation starts with a practical site review.
Look at entrances, exits, reception areas, car parks, queues, delivery points, staff-only zones, and public areas.
Ask:
● Where could someone enter without being challenged?
● Where do crowds naturally gather?
● Which doors are usually left open?
● Are CCTV blind spots obvious?
● Could a vehicle get close to public areas?
● Can staff lock down key areas quickly?
● Are evacuation routes actually clear?
It is often where the biggest improvements are found. Not in complicated systems, but in basic control points that nobody has reviewed properly.
The right security setup should match the site, not a generic checklist. A retail store, warehouse, construction site, event venue, and vacant property all carry different risks.
For example:
● Retail stores: CCTV monitoring, staff alerts, front-of-house security, and entrance control.
● Warehouses: access control, mobile patrols, visitor checks, and alarm response.
● Construction sites: perimeter checks, CCTV towers, patrols, and out-of-hours monitoring.
● Event venues: bag search policies, crowd planning, stewarding, and protected routes.
● Vacant properties: inspections, key holding, alarm response, and protection against unauthorised access.
The right setup depends on the risk, not the category.
Staff training is one of the most important parts of emergency preparedness.
People do not rise to a plan they have never seen. They fall back on what they understand. That is why procedures should be simple, clear, and repeated.
Even a short briefing can make a difference if it explains who leads, how to communicate, where to move people, and what to avoid.
Martyn’s Law preparation works best when it is built around the site, not a template. The aim is to understand where the risks are, what procedures staff need, and which security measures would actually support the response.
For UK businesses, venues, landlords, event organisers, and facilities teams, this may include:
● Venue security assessments
● CCTV systems and remote monitoring
● Access control for venues and business premises
● Manned guarding
● Mobile patrols
● Key holding and alarm response
● Event security
● Retail security
● Warehouse security
● Construction site security
● Vacant property inspections
Our advice is simple: build the plan first, then match the security around it. CCTV, access control, guards, patrols, and emergency procedures work best when they are connected.
For Martyn’s Law readiness, Intraguard can support businesses by helping identify weak points, improve site control, strengthen public protection procedures, and create a security setup that works in real situations, not just on paper.
Martyn’s Law explained in real business terms, is about turning “we should probably have a plan” into “we know exactly what to do.” That shift matters. During a serious incident, confusion costs time, and time is the one thing no venue, shop, warehouse, or event space can afford to waste.
Start by reviewing your risks, tightening your procedures, and making sure your team understands the plan before they ever need it.
Not sure where your venue stands?
Intraguard can help review your site, identify practical security gaps, and improve your public protection procedures before Martyn’s Law comes into force.
No. Standard tier Martyn’s Law focuses on SIA notification and public protection procedures, not mandatory physical security upgrades.
A practical Martyn’s Law compliance checklist should include site scope, expected occupancy, responsible person, evacuation routes, invacuation areas, lockdown procedures, communication procedures, staff training, CCTV coverage, access control, and emergency preparedness.
Yes. Start with a site review before buying CCTV, access control, or extra guarding. Martyn’s Law preparation should begin with real risks, including entrances, exits, crowd points, blind spots, communication gaps, and lockdown options.
To put it simply, workforce management systems are digital tools that help businesses plan, schedule, track, and optimise their workforce. Instead of managing people manually, these systems automate key tasks like scheduling, attendance, and workforc
In recent years, supply chains have faced a wave of new threats. Criminal groups are becoming more organised, and the rise of e-commerce has pushed warehouses and delivery volumes to record highs.
Whether you run a small office, a retail shop, a warehouse, or an entire corporate facility, professional key holding and alarm response gives you peace of mind, fast reaction times, and legally safe emergency handling without putting yourself or you
Mobile patrol officers travel between multiple locations in marked or unmarked vehicles, performing scheduled and random security checks. Their job is simple but powerful: prevent crime before it happens
Whether it’s during the day or night, your property remains under the watchful eye of security cameras, ensuring constant protection. This round-the-clock surveillance is crucial in preventing potential break-ins and identifying suspicious activity i
Unlike traditional cameras that simply “record and hope for the best,” AI-powered surveillance actively detects unusual activity, identifies risks, and helps prevent incidents before they escalate
