Martyn’s Law: how will it impact the education sector?

The Terrorism (Protection of Premises) Act 2025, also known as Martyn’s Law, is due to come into force by April 2027. Named in memory of Martyn Hett who was killed in the Manchester Arena attack, it requires those responsible for certain premises – including education settings – and events to take steps to prepare for potential terrorist attacks and to reduce their vulnerability to terrorist attacks.

Brodies have discussed Martyn’s Law in previous blogs. Here, we focus on the impact of Martyn’s Law on education settings and what can be done now by education providers to prepare for Martyn’s Law coming into force.

What types of premises and events are affected?

The new rules apply to “qualifying premises” and “qualifying events” in the UK.

Qualifying premises are those used for a specified use and are divided into (a) standard duty premises where one can reasonably expect 200-799 individuals may be on the premises at the same time; and (b) enhanced duty premises where one can reasonably expect 800+ individuals may be on the premises at the same time.

The specified uses are wide-ranging but include use for the provision of:

Childcare (such as early learning, nursery, and day care);
Primary and secondary education;
Further education; and
Higher education institution.

The specific meaning of “childcare”, “primary or secondary education”, “further education” and “higher education institution” will depend on where the qualifying premises are located within the UK. It will generally include the main school building as well as all related buildings and land.

Qualifying events are those where (a) it is reasonable to expect that at some point during the event 800+ individuals may be present; and (b) there are measures in place to restrict access to the event, e.g. ticketing.

Who is responsible for compliance?

A ‘Responsible Person’ must ensure that a qualifying premises or qualifying event complies with Martyn’s Law. They are the party (either an individual person or organisation) who has control of the premises. For educational settings, depending on the use of the premises, the Responsible Person could be the local authority, the governing body, the proprietor of the institution or someone nominated by the institution.

For enhanced duty premises or a qualifying event, where the Responsible Person is not an individual, they will need to designate a senior individual to be responsible for compliance.

Responsible Person’s duties – the “usual” rules

Standard duty premises: the Responsible Person must notify the Security Industry Authority that they are responsible for their premises. They must also have in place, so far as is reasonably practicable, appropriate public protection procedures for: (i) evacuation; (ii) moving individuals to a “safe place”; (iii) preventing individuals entering or leaving the premises; and (iv) providing information to individuals on the premises during a terror attack or when one is about to occur.

Enhanced duty premises: the duties relating to standard duty premises apply and, in addition, the Responsible Person will have to:

Assess, put in place and regularly review public protection measures to reduce, so far as is reasonably practicable (i) the vulnerability of the premises or event to acts of terrorism and (ii) the risk of harm to individuals if an act of terrorism occurred. “Public protection measures” are measures relating to:

The monitoring of the premises or event and the immediate vicinity;
The movement of individuals into, out of and within the premises or event;
The physical safety and security of the premises or the premises at which the event is to be held;
The security of information in relation to the premises or the event.

Produce documentation to the Security Industry Authority explaining (i) the public protection procedures/measures in place or to be put in place, and (ii) a risk assessment of how those should reduce vulnerabilities and the risk of harm, so far as is reasonably practicable.

Standard duty premises occasionally holding events attended by 800+ people will be subject to the enhanced measures for the day of the event before returning to the standard duty obligations (e.g. a university hosting a conference).

Note that there may be doubling up of qualifying premises: a university may qualify, as well as premises leased to private accommodation providers on the university’s land.

Responsible Person’s duties - special rules for education settings

Whilst the above are the “usual” rules under the Act, there are special rules which will apply to education settings.

Education settings used for early years or primary, secondary or further education are exempt from the Enhanced Tier requirements regardless of their capacity, as are government funded independent training providers. This means that, even if such an education setting has over 800 learners and staff, it will still only be required to comply with Standard Tier requirements. Similarly, events held in educational settings, no matter their capacity, will not be classed as “qualifying events”.

There will be no such exemption for higher education settings or for privately owned independent training providers, who will have to comply with the Enhanced Tier requirements if they fall within that category.

It should be noted that whilst educational settings that can reasonably expect below 200 individuals to be present do not fall within the scope of the Act, the Government encourage all settings to have preparedness plans in place for the safety of their learners and staff.

Practical implications

Measures taken by education settings to comply with their requirements should be tailored to the specific risks of the education setting or event. Staff training on any incident response plan - including regular drills - will be essential. In anticipation of the law coming into force in April 2027, the government will consult on and publish guidance on how Responsible Persons can comply with their obligations. We will monitor this and provide further updates once this is published.

Where there is more than one qualifying premises in the same building or in close vicinity (e.g. university buildings and private student accommodation), close co-ordination between the respective Responsible Persons in terms of risk assessment, procedures, training and drills will be needed.

Contracts such as leases, operating agreements or facilities management contracts should set out who is responsible for compliance with Martyn’s Law and the procedures for co-ordination. Organisations should be aware of these duties when purchasing premises or agreeing contracts where they have any control over premises.

Consequences of non-compliance

The Security Industry Authority will be the regulator responsible for ensuring compliance and taking enforcement action. That includes imposing a non-compliance penalty on a Responsible Person of the greater of £18 million or 5% of the organisation's most recent worldwide revenue. Failure to comply with a penalty notice will be a criminal offence, punishable by an unlimited fine for companies and/or up to two years' imprisonment for individuals.

Martyn’s Law also states that individuals involved in the management or control of a corporate entity will be guilty of an offence committed by that entity if the offence is committed with their consent, connivance or neglect. This too will be punishable by an unlimited fine and/or up to two years' imprisonment.

What can organisations do now?

Martyn’s Law requires organisations to take a proactive approach to security and incident response.

Whilst Martyn’s Law is not expected to come into force until April 2027, education settings should take steps to prepare now. Consideration should be given as to whether they will or could be a Responsible Person and, if so:

consider whether standard or enhanced duties will apply to their premises;
consider whether any events held by the organisation will be qualifying events;
for enhanced duty premises or events where the Responsible Person is a corporate entity: identify the relevant senior person to be responsible for compliance and ensure that person is competent to carry out the role;
carry out a risk assessment and identify any additional measures that will be necessary to comply with Martyn’s Law;
consider how and when these additional measures will be implemented; and
review any relevant contracts – both existing and standard template documentation – to ensure provision is made for the division of responsibility between, and measures for co-ordinating with, all of those with control over the premises and/or neighbouring Responsible Persons.

Key take aways

Martyn’s Law will affect education settings and the consequences of non-compliance for individuals and organisations are serious. Education providers should take steps now to ensure they can comply with their obligations when the law comes into force.

If you wish to discuss how Martyn’s law may impact your organisation, get in touch with Brodies’ Health and Safety Team or your usual Brodies’ contact.