The new Terrorism (Protection of Premises) Act 2025 (also known as Martyn’s Law) will have implications in many business sectors, especially for venues and events with a capacity of over 800 people. Partner Kevin Clancy and solicitor Killian Dockrell, of the UK law firm Shepherd and Wedderburn, outline the key points
Martyn Hett was one of the 22 victims of the Manchester Arena bombing on 22 May, 2017. The Terrorism (Protection of Premises) Act 2025, nicknamed ‘Martyn’s Law’ in his memory, is expected to come into force around April 2027, and will introduce critical changes to public safety law in the UK.
The act applies to publicly accessible premises, and will therefore affect many business sectors including hotels, hospitality, leisure, food and drink, entertainment, sports and education.
While we do not currently know exactly when it will be enforced, premises owners, occupiers and managers should already be planning ahead. The Home Office recently published guidance that provides a good starting point.
Smaller venues and events – those for which it is reasonable to expect that no more than 200 individuals may be present at the same time – are not included in the new rules.
Those with capacity of between 200 and 799 are classed as ‘standard duty premises’. They must implement basic public protection measures, but physical modifications such as metal detectors will not be mandatory.
In fact, it is likely that many of these venues already meet many of the new requirements, so compliance with the act will not be too onerous for them. The UK government estimates that, for a typical venue in this tier, compliance will cost around £330 per year.
Venues and events with a capacity of more than 800 people are ‘enhanced duty premises’ under the act, and they will be required to implement enhanced protection against terrorist attacks “so far as reasonably practicable”.
Further measures may include arranging for regular risk assessments and security training to be carried out, CCTV coverage, entry screening and bag checks. A designated senior individual must have responsibility for compliance, and directors and other officers will be at a significantly greater risk of prosecution if a breach is found.
For both tiers of venues, the act will require those deemed a ‘responsible person’ to take reasonable steps to reduce vulnerability to terrorism attacks, and to mitigate harm to individuals if a terrorist attack were to occur.
Many people can be designated a ‘responsible person’, including owners of venues or premises, occupiers or tenants, facility managers, local authorities or employers. The Home Office guidance is clear that the person may “delegate tasks” but “cannot delegate their legal responsibility”.
Enforcement is another area that affects both standard and enhanced venues similarly: both types will have to report to the Security Industry Authority. This body will have powers to inspect venues or events, and to sanction those who fail to comply with their duties.
Those sanctions range from compliance notices that require venues to carry out corrective measures to, in the most serious cases, fines of up to £18m or 5 per cent of global turnover (whichever is greater). The SIA is currently consulting on its statutory guidance.
Any organisation that might be affected by the new act should start preparing now. Specifically, they should: identify who their “responsible persons” will be; review their risk assessment procedures and their security protocols and make any changes that are required; work out what staff training will be needed; and understand their future reporting obligations to the SIA.
Shepherd and Wedderburn’s team of health and safety specialists will be happy to provide expert advice and guidance if required.
Kevin Clancy is the lead partner of the Workplace Risk and Regulation group and Killian Dockrell is a solicitor in the Commercial Disputes team at Shepherd and Wedderburn.
Partner Content in association with Shepherd and Wedderburn
