The Terrorism (Protection of Premises) Act 2025, also known as Martyn’s Law, is due to come into force by April 2027. Named in memory of Martyn Hett who was killed in the Manchester Arena attack, it requires those responsible for certain premises and events to take steps to prepare for potential terrorist attacks. That is likely to include commercial properties such as shopping centres, cinemas, larger shops and restaurants and other such venues.

Brodies have discussed Martyn’s Law in previous blogs. Here, we focus on the impact of Martyn’s Law on commercial properties and what can be done now by owners, occupiers, operators and managing agents to prepare for Martyn’s Law coming into force.

What types of premises and events are affected?

The new rules apply to “qualifying premises” and “qualifying events” in the UK.

Qualifying premises are those used for a specified use and are divided into (a) standard duty premises where one can reasonably expect 200-799 individuals may be on the premises at the same time; and (b) enhanced duty premises where one can reasonably expect 800+ individuals may be on the premises at the same time.

The specified uses are wide-ranging but include:

  • Shops and shopping centres
  • Food and drink venues
  • Nightclubs
  • Entertainment, leisure or recreation venues
  • Events venues, exhibition halls, conference centres
  • Hotels, hostels, holiday parks.

There may be doubling up of qualifying premises: a shopping centre may qualify as well as a larger retail unit or restaurant within the centre.

Qualifying events are those where (a) it is reasonable to expect that at some point during the event 800+ individuals may be present; and (b) there are measures in place to restrict access to the event, e.g. ticketing.

Who is responsible for compliance?

A ‘Responsible Person’ must ensure that a qualifying premises or qualifying event complies with Martyn’s Law. They are the party (either an individual person or company) who has control of the premises. For commercial premises, that could be the landlord, tenant or operator, facilities manager or managing agent.

For enhanced duty premises or a qualifying event, where the Responsible Person is not an individual, they will need to designate a senior individual to be responsible for compliance.

Responsible Person’s duties

The Security Industry Authority (SIA) is the Regulator responsible for enforcement.

Standard duty premises: the Responsible Person must notify the SIA that they are responsible for their premises. They must also have in place, so far as is reasonably practicable, appropriate public protection procedures for: (i) evacuation; (ii) moving individuals to a “safe place”; (iii) preventing individuals entering or leaving the premises; and (iv) providing information to individuals on the premises during a terror attack or when one is about to occur.

Enhanced duty premises: the duties relating to standard duty premises apply and, in addition, the Responsible Person will have to:

  • Assess, put in place and regularly review public protection measures to reduce, so far as is reasonably practicable (i) the vulnerability of the premises or event to acts of terrorism and (ii) the risk of harm to individuals if an act of terrorism occurred.
  • Produce documentation to the SIA explaining (i) the public protection procedures/measures in place or to be put in place, and (ii) a risk assessment of how those should reduce vulnerabilities and the risk of harm, so far as is reasonably practicable.

Note that standard duty premises occasionally holding events attended by 800+ people will be subject to the enhanced measures for the day of the event before returning to the standard duty obligations (e.g. a hotel hosting weddings or conferences).

Practical implications

Measures should be tailored to the specific risks of the business, premises or event. Staff training on any incident response plan - including regular drills - will be essential. The Government is to provide guidance on these aspects.

Organisations should be aware of these duties when purchasing premises or agreeing contracts where they have any control over premises.

Contracts such as leases, operating agreements or facilities management contracts should set out who is responsible for compliance with Martyn’s Law and the procedures for co-ordination.

Similarly, where there is more than one qualifying premises in the same building or in close vicinity (e.g. a restaurant or cinema within a shopping centre), close co-ordination between the respective Responsible Persons in terms of risk assessment, procedures, training and drills will be needed.

Consequences of non-compliance

The SIA will be responsible for ensuring compliance and taking enforcement action. That includes imposing a non-compliance penalty on a Responsible Person of the greater of £18 million or 5% of the organisation's most recent worldwide revenue. Failure to comply with a penalty notice will be a criminal offence, punishable by an unlimited fine for companies and/or up to two years' imprisonment for individuals.

Martyn’s Law also states that individuals involved in the management or control of a corporate entity will be guilty of an offence committed by that entity if the offence is committed with their consent, connivance or neglect. This too will be punishable by an unlimited fine and/or up to two years' imprisonment.

What can organisations do now?

Martyn’s Law requires organisations to take a proactive approach to security and incident response. Whilst Martyn’s Law is not due to come into force for another 18 months, organisations should prepare now. Consideration should be given as to whether they will or could be a Responsible Person and, if so:

  • consider whether standard or enhanced duties will apply to their premises;
  • for enhanced duty premises or events where the Responsible Person is a corporate entity: identify the relevant senior person to be responsible for compliance and ensure that person is competent to carry out the role;
  • carry out a risk assessment and identify any additional measures that will be necessary to comply with Martyn’s Law;
  • consider how and when these additional measures will be implemented; and
  • review any relevant contracts – both existing and standard template documentation – to ensure provision is made for the division of responsibility between, and measures for co-ordinating with all of those with control over the premises and/or neighbouring Responsible Persons.

Key take aways

Martyn’s Law will affect many commercial premises, not just large entertainment venues such as arenas. The consequences for individuals and companies of non-compliance are serious. Getting organised now to ensure you and your venue is compliant is therefore prudent.

Contributors

Amy Anderson

Senior Associate

Michael McQuade

Senior Associate