Martyn’s Law: What It Means, Who It Affects and Why We All Need to Understand It.

Most of us have been to a concert, village fête, Christmas fair, sporting event or community gathering without giving security much thought.

We arrive, find our friends, perhaps grab something to eat or drink and enjoy ourselves.

Behind the scenes, somebody has usually thought about fire exits, first aid, toilets, parking, electrical safety and what happens if the weather turns against them.

But there is another question that organisations and event organisers are increasingly being asked to consider:

What would happen if there was a terrorist attack?

It is an uncomfortable question.

For a small venue or community organisation, it may even sound rather extreme.

But on 22 May 2017, a terrorist attack at Manchester Arena killed 22 people and injured hundreds more.

One of those killed was 29-year-old Martyn Hett.

What followed was an extraordinary campaign by his mother, Figen Murray, to make public places better prepared to protect the people using them.

That campaign eventually led to the Terrorism (Protection of Premises) Act 2025.

Most of us know it by another name.

Martyn’s Law.

Why Was Martyn’s Law Introduced?

On the evening of 22 May 2017, thousands of people had gathered at Manchester Arena to watch Ariana Grande perform.

At the end of the concert, as people were leaving and parents were arriving to collect children, a suicide bomber detonated an explosive device in the arena's City Room foyer.

Twenty-two people were killed.

The youngest victim was just eight years old.

Hundreds of people were physically injured and many more were affected psychologically.

The Manchester Arena Inquiry later examined the circumstances surrounding the attack, including the security arrangements at the venue and the emergency response.

For Martyn's mother, Figen Murray, one question became particularly important:

Why wasn't there a legal requirement for venues to have plans in place to protect people from terrorist attacks?

She began campaigning for change.

What followed wasn't a short campaign. It took years of lobbying, consultation, proposed legislation, amendments and parliamentary debate.

Eventually, on 3 April 2025, the Terrorism (Protection of Premises) Act 2025 received Royal Assent.

Martyn's Law had become law.

What Is Martyn’s Law Actually Trying to Do?

At its heart, Martyn's Law is about preparedness.

It isn't based on the idea that every venue is likely to experience a terrorist attack.

Nor is it about turning every village hall, shop, theatre or community venue into a fortress.

It is about making sure that certain organisations responsible for publicly accessible premises and events have actually considered what they would do if an attack occurred.

Because the middle of an emergency is a very bad time to start making the emergency plan.

The legislation therefore introduces requirements for certain premises and events where members of the public are likely to be present.

And importantly, those requirements are intended to be proportionate.

A premises that might contain 250 people isn't expected to have the same security arrangements as a stadium holding 25,000.

That brings us to two numbers worth remembering:

200 and 800.

First Things First: Does Martyn’s Law Apply Everywhere?

No.

This is probably one of the most important things to understand.

Martyn's Law doesn't automatically apply to every business, village hall, community group or public event.

For premises to fall within the Act, several conditions have to be met, including the way the premises are used and the number of people who might reasonably be expected to be present at the same time.

There are then two main levels of requirements:

Standard tier – generally 200 to 799 people

Enhanced tier – generally 800 people or more

There are also specific rules concerning qualifying events, which we'll come to shortly.

So if somebody tells you that every little village event now needs professional security because of Martyn's Law, that isn't correct.

But equally, simply saying "We're only a small organisation" isn't enough to establish that the law doesn't apply.

You need to understand the criteria.

What Does “Reasonably Expected” Mean?

This is an important phrase within the legislation.

The question isn't simply:

"How many people turned up last Tuesday?"

It is about the greatest number of individuals it is reasonable to expect might be present at the same time, from time to time.

That distinction matters.

Imagine a community venue that usually has 40 people attending an exercise class.

That doesn't necessarily make it a 40-person premises for the purposes of Martyn's Law if it also regularly holds functions where several hundred people can reasonably be expected to be there.

Organisations need to look realistically at how their premises are actually used.

The Standard Tier: 200–799 People

Premises that meet the relevant criteria and where between 200 and 799 people may reasonably be expected to be present at the same time will generally fall within the standard tier.

The emphasis here is not on expensive equipment.

It is on having sensible procedures that people understand.

The person responsible for the premises will need to notify the regulator, the Security

Industry Authority (SIA), and ensure appropriate public protection procedures are in place, so far as reasonably practicable.

Those procedures centre around four areas:

Evacuation.

Invacuation.

Lockdown.

Communication.

They sound rather formal.

In reality, they are very practical questions.

Evacuation: How Would We Get People Out?

Most organisations already understand evacuation because we associate it with fire.

But a terrorist incident creates an important difference.

The safest route may not necessarily be the normal fire exit.

If the danger is outside the building, sending everybody outside could actually move them towards it.

So the question isn't simply:

"Where is our fire exit?"

It is: "How would we safely move people away from danger?"

Invacuation: Could We Bring People In?

This is a word many people won't have encountered before.

Invacuation is essentially the opposite of evacuation.

Rather than getting people out of a building, the safest response may be to bring people inside or into another safer part of the premises.

Imagine an incident occurring outside a community venue while an event is taking place.

Automatically sending everybody into the car park might be exactly the wrong thing to do.

The safer option could be bringing people indoors and securing the building.

Which leads neatly to...

Lockdown: Could We Secure the Premises?

If people needed to stay inside, could you actually secure the building?

Who has the keys?

Which doors can be locked?

Can they be locked quickly?

What about people outside?

Who makes the decision?

Would staff or volunteers know what was happening?

These are very simple questions.

But they're much easier to answer over a cup of tea during an emergency-planning meeting than during an actual emergency.

Communication: How Would We Tell Everybody?

This may be one of the most overlooked parts of any emergency plan.

Imagine 300 people are attending an event and something serious happens.

How do you tell them?

Is there a PA system?

Does somebody have a microphone?

Are staff using radios?

Who calls 999?

Who communicates with the emergency services?

Who tells people not to leave through a particular exit?

And what happens if the one person who knows the plan isn't there?

A written emergency procedure is useful.

A procedure that the people involved actually understand is considerably more useful.

“But We’re All Volunteers”

This is particularly relevant to charities, community organisations, clubs and village venues.

Martyn's Law isn't only something large businesses with security departments need to think about.

The official guidance recognises that people working at premises may include volunteers as well as paid employees and contractors.

That doesn't mean every volunteer needs to become a counter-terrorism expert.

Far from it.

It means that if somebody is expected to help manage people during an emergency, they need enough information to understand what they should do.

There is little value in having a wonderful emergency plan sitting in a folder if nobody present knows it exists.

The Enhanced Tier: 800+ People

Where 800 or more people can reasonably be expected to be present at qualifying premises at the same time, the enhanced requirements may apply.

At this level, organisations need to go further.

As well as public protection procedures, they must consider appropriate public protection measures designed to reduce vulnerability to an attack or reduce the risk of physical harm if an attack happens.

Depending upon the premises, that might involve measures concerning:

• monitoring the premises;

• movement of people;

• physical security;

• security of information.

What is appropriate for one location won't necessarily be appropriate for another.

A theatre, shopping centre, large conference venue and sports stadium are very different environments.

Again, the legislation uses an important concept:

What is reasonably practicable?

The objective isn't security for security's sake.

It is appropriate protection based upon the particular circumstances.

Enhanced-tier premises also have additional documentation requirements and, where the responsible person is an organisation, a senior individual must be designated to oversee compliance.

What About Events?

This is where Martyn's Law can easily be misunderstood.

An event doesn't automatically become a qualifying event simply because 800 people might attend.

Generally, a qualifying event involves 800 or more people being reasonably expected to be present at the same time AND some form of entry control.

That could include checking:

• tickets;

• invitations;

• passes;

• membership;

• accreditation; or

• other permission to enter.

An open event where members of the public can freely walk onto the site may therefore be treated differently from a ticketed event with controlled entrances.

That distinction is extremely important for organisers of community events.

Don't assume.

Check.

So What About Village Fêtes, Community Picnics and Local Events?

This is perhaps where Martyn's Law sounds much more intimidating than it needs to.

A small village fête doesn't suddenly need airport-style security.

A community coffee morning doesn't need somebody checking bags at the door simply because Martyn's Law exists.

And a small open-access event doesn't automatically become subject to the legislation.

But there is a useful lesson here that applies whether Martyn's Law legally covers your event or not.

Ask yourself:

If something serious happened, would we know what to do?

Not necessarily terrorism.

It could be a fire.

A serious incident nearby.

A vehicle entering a pedestrian area.

A suspicious package.

An aggressive individual.

A major medical emergency.

Severe weather.

Or something nobody had anticipated.

Who takes charge?

Who calls the emergency services?

How do you communicate with everybody?

Where do people go?

Can an ambulance, fire engine or police vehicle actually get onto the site?

Is there another exit?

Would volunteers know what to do?

Those questions cost very little to answer.

But answering them before an emergency could make an enormous difference.

A Risk Assessment Is a Starting Point, Not the Whole Plan

We often associate safety with paperwork.

"Have we done a risk assessment?"

That's important.

But the purpose of a risk assessment isn't to produce a document.

It is to identify risks and decide what you're going to do about them.

A beautifully completed risk assessment sitting in a folder cannot evacuate a building.

It cannot call 999.

It cannot tell frightened members of the public where to go.

People do that.

And people are much better at responding when they've already discussed what they might need to do.

That is one of the most useful lessons behind Martyn's Law.

Try Looking at Your Venue Differently

Next time you're at your workplace, venue or event, try something.

Stop looking at it as somebody who knows the building.

Look at it as a visitor.

Where would you enter?

Where would you leave?

Where will crowds naturally gather?

Could somebody enter without being noticed?

Where do vehicles and pedestrians cross?

Where might queues develop?

Could emergency vehicles get through?

What if your normal exit suddenly couldn't be used?

Where could people shelter?

Can doors be secured?

How would you communicate with 20 people?

What about 200?

Who would take charge?

And here's an important one:

What happens if that person isn't there?

You may suddenly notice things you've walked past hundreds of times.

That doesn't mean your venue is dangerous.

It means you're starting to think about preparedness rather than simply paperwork.

“But Surely This Will Never Happen Here?”

Hopefully it won't.

Hopefully almost every emergency procedure written as a result of Martyn's Law will never need to be used.

But think about the other safety measures we accept without question.

We don't install a fire extinguisher because we're expecting the building to catch fire next Tuesday.

We don't have a defibrillator because we're expecting somebody to suffer a cardiac arrest.

We don't keep a first aid kit because we're hoping somebody gets injured.

We prepare because the consequences of not being prepared can be enormous.

Martyn's Law works on much the same principle.

Is Martyn’s Law in Force Yet?

This is another important point.

The Terrorism (Protection of Premises) Act became law when it received Royal Assent on 3 April 2025.

However, the substantive duties within the Act are not yet in force.

The Government allowed an implementation period so that organisations could understand their responsibilities and prepare.

As of August 2026, the Security Industry Authority expects the new regime to come into force in spring 2027.

Official statutory guidance has already been published to help organisations prepare.

So this isn't something to panic about.

But equally, for organisations likely to fall within scope, it probably isn't something to leave until the week before implementation either.

What Should Organisations and Event Organisers Do Now?

Start with information rather than equipment.

Find out whether the Act is likely to apply to your premises or event.

Consider how many people can reasonably be expected to be present at the same time.

Look at whether entry to larger events is controlled.

Identify who is actually responsible for the premises or event.

Review your existing emergency arrangements.

Talk to your staff and volunteers.

Think about evacuation, invacuation, lockdown and communication.

And use the official guidance and free resources available through GOV.UK and ProtectUK.

You may discover that you already have many of the foundations in place.

Or you may discover a few gaps that are surprisingly easy to fix.

Either outcome is useful.

Why Martyn’s Law Matters

It would be very easy to finish an article about Martyn's Law talking about thresholds, tiers, procedures and compliance.

But that isn't really where this story began.

It began with a 29-year-old man going to a concert.

Martyn Hett should have come home that night.

Twenty-one other people should have come home too.

Figen Murray couldn't change what happened to her son.

Instead, she spent years trying to change what might happen to somebody else's.

Martyn's Law cannot prevent every attack.

It cannot remove every risk.

And it cannot guarantee that everybody will always make the right decision in an emergency.

What it can do is make organisations stop and ask a question that perhaps should have been asked more often before:

If the unthinkable happened here, are we prepared?

And you don't need to wait until a law tells you to ask it.

Whether you're responsible for a venue holding 2,000 people, a community event expecting 250 or a small gathering of 50, thinking about how you would protect the people who have trusted you with their safety is simply good planning.

Because preparedness isn't about expecting the worst.

It's about knowing what to do if the worst ever happens.

This article is intended to provide general information about the Terrorism (Protection of Premises) Act 2025 and should not be treated as legal advice. Requirements will depend upon the circumstances of individual premises and events. Organisations should consult the latest GOV.UK, Security Industry Authority and ProtectUK guidance when determining their responsibilities.