Skip to content
Secure SystemsSecurity Systems Installation

Terrorism (Protection of Premises) Act 2025 · duties expected to commence spring 2027

Martyn’s Law Security & Lockdown Systems

Explained for the people who will actually have to do it. The Terrorism (Protection of Premises) Act 2025 will require many publicly accessible premises to have thought through what their staff would do in an attack. This page sets out what the law asks for, which tier your venue is likely to fall into, and — honestly — where security systems help and where they don’t.

Book a readiness assessmentStart reading
Legislation
Terrorism (Protection of Premises) Act 2025
Royal Assent
3 April 2025
Applies to
England, Wales, Scotland and Northern Ireland
Regulator
Security Industry Authority (SIA)
Statutory guidance
Published 15 April 2026
Expected commencement
Spring 2027 — not yet confirmed

Verified against GOV.UK statutory guidance and the Home Office factsheet, September 2026.

The basics

What Martyn’s Law actually is

Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025. It received Royal Assent on 3 April 2025 and applies across England, Wales, Scotland and Northern Ireland.

It is named after Martyn Hett, one of 22 people killed in the Manchester Arena attack in May 2017, and follows a six-year campaign by his mother, Figen Murray OBE. The Act puts a duty on those responsible for certain publicly accessible premises and events to be better prepared to respond if an attack happens.

The important word is prepared. The Act does not ask you to predict an attack or to prove your premises is a likely target. It starts from the assumption that an incident could happen anywhere, and asks a narrower question: if it did, would the people working in this building know what to do?

It is also outcomes-based. It sets out what must be achieved, not which products to buy. What is appropriate for a 250-capacity village hall is not what is appropriate for a stadium, and the legislation is written to allow for that.

Scope

Who it affects

A premises is likely to be in scope if it is a building (or a building and land), it is used for one of the purposes listed in the legislation, and you can reasonably expect 200 or more people to be present at the same time.

Premises uses covered by the legislation

  • Shops and retail parks
  • Bars, restaurants and cafés
  • Hotels and hospitality venues
  • Entertainment and leisure venues
  • Sports grounds
  • Museums, galleries and libraries
  • Places of worship
  • Healthcare settings
  • Schools, colleges and childcare
  • Village and community halls
  • Visitor attractions
  • Public authority buildings

Qualifying events

Events can be caught separately — broadly where 800 or more people are expected and access is controlled by payment, a ticket, a pass or membership. That can bring open land into scope even where the site itself normally is not.

Exclusions

Some premises are excluded by the legislation, including certain transport premises already covered by their own security regimes. Parks and gardens with open access are normally out of scope, though a controlled-access event held there may not be.

Members of the public moving through the glazed entrance concourse of a large public building
The test is capacity, not category: a premises is likely to be in scope where 200 or more people can reasonably be expected to be present at the same time.

Tiers

Standard tier and enhanced tier

Which tier you are in is decided by how many people you can reasonably expect on site at the same time — everyone present, not just customers or ticket holders.

Standard tier

200–799

people reasonably expected on site

The lower duty. It is about having thought through what your people would actually do, and making sure they know it.

What the duty involves

  • Notify the SIA that the premises is in scope.
  • Put in place appropriate public protection procedures — evacuation, invacuation, lockdown and communication.
  • Make sure staff are aware of those procedures and could carry them out.

The Act does not require the standard tier to buy equipment, install physical measures or produce a formal document for the regulator.

Enhanced tier

800+

people, plus qualifying events

Everything in the standard tier, plus measures that reduce how vulnerable the premises is in the first place — and a paper trail.

What the duty involves

  • All standard-tier duties.
  • Put in place public protection measures covering monitoring, movement of people, physical safety and security, and security of information.
  • Document the procedures and measures, and provide that document to the SIA.
  • Where the responsible person is an organisation, designate a senior individual to ensure compliance.

Designating a senior individual does not transfer legal responsibility away from the organisation.

Childcare, primary, secondary and further education settings, and places of worship, remain in the standard tier even where 800 or more people may be present. The legislation also allows the thresholds to be amended in future, within limits set out in the Act.

The duty in practice

The four procedures

Every premises in scope needs appropriate public protection procedures covering these four responses. They are not four separate plans — they are four things staff might need to do, depending on where the danger is.

  • Evacuation

    Getting people out of the premises, or out of part of it, safely.

    Most buildings already have a fire evacuation plan, and most of them assume the danger is inside and safety is outside. That assumption does not always hold. Evacuation routes need to work when the reason for moving people is not a fire — including where the assembly point itself may be exposed.

  • Invacuation

    Moving people away from danger into a safer place inside the building.

    The opposite instinct to a fire drill, and the one staff are least likely to have practised. It matters when the threat is outside — bringing people in from a forecourt, car park or open frontage rather than sending them towards it.

  • Lockdown

    Securing the premises to stop people entering, or in some cases leaving.

    This is where most sites find their gap. Locking a building quickly means knowing which doors matter, who can trigger it, how staff in a far corner of the site find out, and how emergency services get in afterwards. Doors that free-open on a fire signal will need thinking about carefully.

  • Communication

    Alerting people on the premises and giving them clear instructions.

    A procedure nobody hears is not a procedure. Communication has to reach staff and the public, be distinguishable from the fire alarm so people do not do the wrong thing, and work for visitors who have never been in the building before.

Timeline

How we got here, and what happens next

  1. 22 May 2017

    Manchester Arena attack

    Martyn Hett was one of 22 people killed. The law carries his name.

  2. 17 June 2021

    Manchester Arena Inquiry, Volume One

    The inquiry chaired by Sir John Saunders reported on security operations and preparedness at the venue.

  3. 3 April 2025

    Royal Assent

    The Terrorism (Protection of Premises) Act 2025 becomes law, after a six-year campaign led by Figen Murray OBE, Martyn’s mother.

  4. 15 April 2026

    Statutory guidance published

    The Government published guidance under section 27, setting out how the duties are expected to work in practice.

  5. Expected spring 2027

    Duties expected to commence

    The Government committed to an implementation period of at least 24 months from Royal Assent. The exact commencement date is set by Government and has not been fixed.

Where we come in

How security systems can support your procedures

Once you have decided what your procedures are, the practical question is whether your building can actually deliver them. That is the part we can help with — and every item below maps to something Secure Systems designs, installs and maintains.

  • Lockdown alerting

    Trigger points that let a member of staff raise a lockdown alert quickly from where they actually are, with a signal that is deliberately distinct from the fire alarm.

  • Access control and door release

    Controlling which doors secure, which stay available, and how the building behaves on a lockdown signal — including how emergency services get in.

    Access control systems

  • Voice messaging and public address

    Zoned announcements and pre-recorded messages that can give clear, specific instructions rather than an ambiguous tone people have to interpret.

    Public address systems

  • Visual and audible alerts

    Sounders and visual indicators for noisy areas and for people who will not hear an announcement — so the alert reaches everybody on site.

    Fire alarm systems

  • CCTV and situational awareness

    Seeing what is actually happening at an entrance or in a car park before deciding whether to evacuate, invacuate or lock down.

    CCTV systems

  • Integration between systems

    Making the alarm, access control, CCTV and communication systems behave as one coordinated response rather than four unrelated boxes.

    Intruder alarm systems

  • Maintenance and testing

    Scheduled servicing and testing, so that what you specified two years ago still works on the day it is needed — and you can show it was tested.

Please read this part

What no product can do for you

We would rather lose the enquiry than sell you something on a false premise. Here is the position, in the Government’s own terms.

  • No product makes a premises compliant.

    The Act is outcomes-based and does not mandate or endorse any specific product, system or standard. Compliance is about whether your procedures are appropriate for your premises — not about what is installed in it.

  • Nothing is endorsed by the Home Office or the SIA.

    Neither body endorses third-party products or services for compliance with this legislation, and the Government has said it strongly advises against using providers who claim they can make premises or events compliant.

  • You should not need to buy specialist services.

    The published guidance is explicit that the intent is for those responsible for premises and events in scope to be able to comply without buying in specialist services.

  • The responsibility stays with you.

    The responsible person for the premises must determine what is appropriate and reasonably practicable for that site. An installer cannot take that decision on your behalf, and designating a senior individual does not move the legal responsibility off the organisation.

  • We install technology. We do not certify compliance.

    Secure Systems designs, installs and maintains security and life-safety systems. We do not issue compliance certification for Martyn’s Law, and we will tell you plainly when the answer to a problem is a procedure or a conversation with your staff rather than equipment.

Before commencement

Seven things worth doing now

None of these cost anything, and all of them make any later decision about equipment a far better-informed one.

Get help with this
  1. 1

    Work out your likely tier

    Establish the maximum number of people you can reasonably expect on site at the same time — staff and public together, not just ticketed capacity. That figure decides which tier you fall into, and everything else follows from it.

  2. 2

    Identify who the responsible person is

    Usually whoever has control of the premises. On leased, shared or multi-occupancy sites this is worth settling early, in writing, rather than discovering the ambiguity later.

  3. 3

    Read your existing emergency plan honestly

    Most sites have a fire plan and nothing else. Ask what it tells staff to do if the safest action is to bring people in and lock the doors rather than send them outside.

  4. 4

    Find the communication gaps

    Walk the site and ask where an instruction would not be heard — stockrooms, kitchens, plant rooms, outbuildings, car parks, upper floors. Those are the places a procedure quietly fails.

  5. 5

    Review how quickly you can secure the building

    Time it. How long to lock the doors that matter, who is authorised to do it, and what happens if that person is not on shift.

  6. 6

    Plan how staff will be told and trained

    Procedures live or die on whether a part-time member of staff on a Saturday knows what the signal means. Build in briefing and rehearsal, not just a document.

  7. 7

    Get proportionate professional advice

    For legal interpretation, take proper advice. For the physical and technical side, use people who will tell you what you do not need as readily as what you do.

Questions

The questions we get asked

If yours isn’t here, ask us. We’ll give you a straight answer, including when the honest one is “that’s a question for your legal advisers”.

  • Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025. It requires those responsible for certain publicly accessible premises and events to be better prepared to respond to a terrorist attack. It is named after Martyn Hett, who was killed in the Manchester Arena attack in 2017, following a campaign led by his mother, Figen Murray OBE.

  • The Act received Royal Assent on 3 April 2025, but the main duties are not yet in force. The Government committed to an implementation period of at least 24 months from that date, and current guidance indicates commencement is expected in spring 2027. The exact date is set by Government and has not been fixed, so check GOV.UK for the current position before making decisions based on timing.

  • It depends on how many people you can reasonably expect to be present at the same time. Broadly, 200 to 799 puts a qualifying premises in the standard tier, and 800 or more puts it in the enhanced tier. That figure covers everyone present, not just customers or ticket holders. Certain premises — including childcare, primary, secondary and further education settings, and places of worship — remain in the standard tier even where 800 or more people may be present.

  • Education settings can fall within scope where the attendance threshold is met. Current guidance gives specific consideration to childcare, primary, secondary and further education settings, which stay in the standard tier even if 800 or more people are present. The practical focus for schools is on proportionate procedures — evacuation, invacuation, lockdown and communication — rather than on buying equipment.

  • Invacuation means moving people away from danger to a safer place inside the premises, rather than sending them outside. It is the appropriate response when leaving the building would put people at greater risk than staying in it — for example where the threat is outside the entrance.

  • No. The Act is outcomes-based and does not mandate any particular product, system or standard. The Government has been explicit that no third-party product is endorsed by the Home Office or the SIA, and that the intent is for those in scope to be able to comply without buying specialist services. Equipment can support your procedures, but it is the procedures — and whether they are appropriate for your premises — that the duty is about.

  • No, and you should be wary of anyone who says they can. The Government specifically advises against using providers who claim they can make premises or events compliant. What we can do is help with the practical side: reviewing how quickly and reliably you could secure a building, where an instruction would not be heard, and what technology would genuinely support the procedures you have decided on.

  • The Security Industry Authority (SIA) takes on a new regulatory function for Martyn’s Law. Its stated approach is to support, advise and guide those responsible for premises and events. Where there is serious or persistent non-compliance, it will have enforcement powers including compliance notices, monetary penalties and — for the enhanced tier — restriction notices.

  • Broadly, an event held at premises that are not already in the enhanced tier, where 800 or more people are expected at the same time, and where there is some form of controlled access — payment, a ticket, a pass, or membership of a club or association. Excluded premises are set out in the legislation.

  • Work out your likely tier and who the responsible person is, review your existing emergency plan against the four procedures, find the places on site where an instruction would not be heard, and plan how staff would be briefed. None of that requires spending money, and all of it makes any later decision about equipment a better-informed one.

Martyn’s Law readiness assessment

Find out where your building would let your procedures down.

Tell us about the venue and we’ll come and look at it with you: where an instruction wouldn’t be heard, how quickly you could actually secure the place, and what — if anything — is worth changing.

Book an assessment0800 118 5939

Official sources

Everything on this page is drawn from these. Check them for the current position before making decisions.