Martyn’s Law Receives Royal Assent – Changes Resulting From Manchester Arena Attack

On 3 April 2025 the Terrorism (Protection of Premises) Act 2025 received Royal Assent.

“Martyn’s Law”  is named after Martyn Hett, one of the 22 victims of the 2017 Manchester Arena terrorist attack.  It is estimated that around 178,900 venues may be affected.

This landmark  legislation creates a new legal duty for those responsible for certain public premises and events across the UK to mitigate the risk of terrorist attacks. This Act delivers the Government’s manifesto commitment to strengthen the security of public premises and events.

Timescales:

The Government intends for there to be an implementation period of at least 24 months before the Act comes into force. This will allow the Security Industry Authority (“SIA”), a new regulator be established to oversee compliance and provide guidance to those responsible for qualifying premises and events to meet their obligations, to be established, whilst ensuring those responsible for premises and events in scope have sufficient time to understand their new obligations. This will enable them to plan and prepare appropriately.  The Government will also publish statutory guidance to support the implementation of the new duties. We are told that this guidance will be “designed to be easy to follow”.

The SIA will seek to support, advise and guide those responsible for premises and events in meeting the requirements of this legislation. Where there are instances of serious or persistent non-compliance the SIA will be able to take enforcement action including compliance notices, monetary penalties and restriction notices. The legislation also includes some criminal offences. The SIA must prepare statutory guidance about how it will discharge its functions under the Act, which must be approved by the Home Secretary before it is published.

Premises that satisfy the following four criteria fall within scope of the Act:

• There is at least one building (or the premises are in a building);
• The premises are wholly or mainly used for one or more of the uses specified at Schedule 1 to the Act, e.g. a restaurant or a shop;
• It is reasonable to expect that at least 200 individuals may be present at least occasionally; and
• The premises are not excluded under Schedule 2 to the Act

If 800 or more individuals may be expected, the premises will be an enhanced duty premises unless the Act says otherwise.

An event that satisfies the following criteria fall within scope of the Act:

• It will take place at premises within section 3(1)(a) of the Act, including land without buildings, that are not enhanced duty premises (or part of enhanced duty premises);
• The relevant premises are accessible to members of the public for the purpose of the event;
• It is reasonable to expect that there will be at least 800 individuals present for the event at once at some point during it;
• There will be measures to check entry conditions are met, such as a ticket checks; and
• The event is not excluded under Schedule 2 to the Act.

The Act establishes a tiered approach, linked to the number of individuals it is reasonable to expect may be present at the same time at premises and events.

Standard duty premises are generally those where it is reasonable to expect that between 200 and 799 individuals (including staff) may be present at the same time at least occasionally. The responsible person will be required to:

• notify the Security Industry Authority (SIA) of their premises; and
• have in place, so far as reasonably practicable, appropriate public protection procedures.

These public protection procedures are those which should be followed by people working at the premises if an act of terrorism were to occur at the premises, or in the immediate vicinity. They are procedures which may be expected to reduce the risk of physical harm being caused to individuals relating to evacuation, moving people to a safe place, locking down the premises, and communicating with individuals on the premises.

The requirements for standard duty premises are centred around simple, low-cost activities with costs relating primarily to time spent. There is no requirement to put in place physical measures.

Premises and events with a capacity of 800 individuals or more at any one time will fall under the “enhanced tier”, with more rigorous requirements.

In addition to the same requirements as standard duty premises, the person responsible for enhanced duty premises and qualifying events will additionally be required to:

• have in place, so far as reasonably practicable, appropriate public protection measures that could be expected to reduce both (i) the vulnerability of the premises or event to an act of terrorism, and (ii) the risk of physical harm being caused to individuals if an attack was to occur there or nearby. For example, enhanced duty premises will be required, so far as is reasonably practicable, to implement measures relating to the monitoring of the premises and their immediate vicinity;
• document the public protection procedures and measures in place, or proposed to be put in place, and provide this document to the SIA. This document should include an assessment of how the public protection procedures and measures reduce vulnerability and/or the risk of harm; and
• Where the responsible person is not an individual, they must designate a senior individual with responsibility for ensuring that the responsible person complies with these requirements.

“Responsible Person”:

For qualifying premises, the responsible person is the person who has control of the premises in connection with their relevant use. Where there is more than one use (e.g. a church that also has a creche), it will be the person in control of the premises in connection with whichever use is the principal use.

For qualifying events, the responsible person is the person who has control of the premises at which the event will be held for the purposes of the event. The circumstances of the event will need to be considered to determine who the responsible person is. For example, if a concert is to be held in a park and the company putting on the event takes control of an area of the park for the purposes of that concert, the company putting on the event will be the responsible person. Conversely, if a stately home puts on a concert in its grounds and maintains control of the site for the purposes of that concert, the stately home will be the responsible person. This would be the case even if the stately home contracted organisations to do aspects of the event (e.g. to provide door security or ticketing).

What You Need To Do:

Although there is a 2-year lead in period, it is important that owners and occupiers of premises and event operators who will fall under the scope of the new legislation begin to plan what appropriate procedures or measures will need to be put in place to comply with their new duties.   Until further guidance is published, it may be a time of uncertainty for many businesses considering how to comply and how much it might cost.

Clearly, there are a few details to be finalised – the proverbial “dotting the I’s and crossing the T’s”, but for advice on this and other matters relating to commercial property, our expert team is on hand for a no obligation initial discussion.