Martyn’s Law receives Royal Assent

The Terrorism (Protection of Premises) Act 2025 (“the Act”), also known as Martyn’s Law, received Royal Assent on 3 April 2025.  

The law is named after Martyn Hett, who tragically lost his life in the Manchester Arena attack on 22 May 2017. His mother, Figen Murray, has been campaigning for better protection from terrorism for the British public and was a key advocate for the new legislation.

There will be an implementation period of at least 24 months before the Act comes into force. This will allow time for the new regulator (the Security Industry Authority (“SIA”)) to be established and for detailed government guidance to be published.

The Act aims to improve protective security and organisational preparedness across the UK by requiring that those responsible for certain premises and events consider how they would respond to a terrorist attack. In addition to this, at larger premises and events, appropriate measures to reduce vulnerability to terrorist attacks must also be put in place. 

The new duties

The Act establishes a tiered approach:

• “Standard duty” premises are those where it is reasonable to expect 200-799 individuals to be present (including staff). These premises must put in place public protection procedures to be followed if an act of terrorism occurs. These measures might include evacuation and locking down the premises. A responsible person (being the person who has control of the premises) must ensure the relevant measures are in place and must notify the SIA of their premises. 
• “Enhanced duty” premises are those where it is reasonable to expect that 800 or more individuals (including staff) may be present. In addition to the standard duties detailed above, the person responsible for enhanced duty premises must have in place measures to reduce the vulnerability of the premises to an event of terrorism and the risk of harm to individuals if an attack was to occur. These measures need to be documented and provided to the SIA.

Premises which are in scope

To be in scope, premises must be mainly used for one or more of the following qualifying activities: entertainment, retail, food and drink, museums and galleries, sports grounds, visitor attractions, places of worship, health, and education establishments. 

Premises can consist of a building and other land where the qualifying activity occurs. So, for example, racecourses and pub gardens can be in scope. Parks, gardens and open-air premises are outside of the scope of the Act unless a ticketed event, such as a music festival, is taking place. It is also possible to have qualifying premises within qualifying premises (for example, a large shop within a shopping centre). Those responsible for each part will be required to coordinate.

The regulator and its sanctions

The SIA will be the body responsible for regulation under the Act, and their role will be to ensure compliance with the Act and advise on the regulatory requirements it contains.

The SIA will also be granted powers to investigate and take enforcement actions against premises who it is considered are not or have not complied with their obligations.

During the implementation period the SIA is required to prepare guidance setting out how its function will be exercised, together with how it will seek to enforce the requirements of the Act, such guidance will be approved by the Home Secretary before publication.

 SIA Powers

Under the Act, the powers of the SIA through their inspectors will be as follows:

• Power to access premises and events to conduct inspections upon 72 hours’ notice for the purposes of inspection and observation. If access is denied, or less than 72 hours’ notice is required the SIA will be able to apply for a warrant to gain such access; and
• Power to gather information which will be used to assess a premises’ compliance with the Act, for example documentation regarding security provision at a specific event.

Consequences of Failure to Comply

The Act provides the SIA with a variety of sanctions they can issue against a premises for a serious, or repeated, failure to comply with the Act.

The sanctions available to the SIA include:

• Compliance notices which will require the remediation of the breach within a specified time period.
• Restriction notices which it is anticipated will only be used in exception circumstances, but these notices will put restrictions in place at a premises until the perceived threat is reduced by suitable measures being implemented.
• Penalty notices which authorise the SIA to impose financial penalties for non-compliance of up to £10,000 for standard duty premises and up to £18m, or 5% of worldwide revenue, for enhanced duty premises. Further fines of £5,000 are available for failure to attend an interview and where a compliance notice, or a restriction notice has not been complied with the SIA can issue a daily fine of £500 for a standard duty premises and £5,000 for an enhanced duty premises for the period of the non-compliance.
• Criminal Offences will be committed where false or misleading information is provided to the SIA or there is an obstruction of an authorised inspector, or where there is the impersonation of an authorised inspector.  It will also be a criminal offence to fail to comply with an information notice, a compliance notice or a restriction notice where one has been issued by the SIA although the anticipation is that such non-compliance will be primarily sanctioned with a penalty notice.

Notice must be given by the SIA to the relevant party before the above notices are issued, and there is the right of appeal to the Tribunal in relation to any sanctions the SIA seek to impose.

Comment

Joanna Onisiforou, Associate in our Regulatory and Criminal Group, comments on the Act:

“Whilst we are still awaiting further detail in relation to the full guidance from the SIA, the responsible person who has control of the premises has enough information at their disposal to start putting relevant measures in place to ensure their premises are compliant with the requirements of the Act when it comes into force.

“It is advisable to start carrying out risk assessments and identify which tier the premises fall into at this early stage and start to plan for the requisite training that will be required under the Act.”

For further advice or assistance please contact our team.