After an extended campaign by relatives of the victims of the Manchester Arena bombing, new legislation to protect people from terror attacks has been given Royal Assent. Officially dubbed The Terrorism (Protection of Premises) Act 2025, its unofficial title is Martyn’s Law—and it has major implications for all kinds of organisations.
Although the law is not due to come into effect until April 2027, it’s important for businesses and public sector institutions to start thinking about how it may impact them and making provisions for its implementation. So, what exactly is ‘Martyn’s Law’, what’s the reasoning behind it—and what impact will it have on businesses in the UK?
Martyn’s Law explained
The law has been painted in many quarters as a change to event safety. This is understandable given the attack which has inspired the legislation, and its obvious application to public events. But Martyn’s law looks set to impact a huge subset of businesses and public organisations, as it covers almost anywhere where large numbers of people congregate, and which thus constitute a target for terrorism.
The law will place responsibility not just on event organisers and premises, but also facilities such as retail, healthcare, schools, libraries, museums and galleries, hotels, and places of worship to ensure safety of attendees from terrorism as far as is reasonably practicable. In this sense, it operates on the same principle as existing health and safety laws.
It could be considered a clarification of responsibility regarding terror threats, which may have been ambiguous in the extent to which they could be foreseen and acted against. However, we don’t yet know exactly what is considered reasonably practicable. The exact implementation is pending further consultation and guidance, which should be delivered as soon as possible, so as to give organisations time to prepare.
Simply put, the law will increase the scope of existing requirements to keep people safe at events and in public places. The responsibility of organisations, venues and event organisers—whoever is legally responsible for existing health & safety implementation—will now go beyond issues like overcrowding, fire safety, and the provision of first aid, into the consideration of wider security threats from bad actors.
Who will Martyn’s Law affect?
Martyn’s Law represents a marked shift in the responsibility of a range of organisations when it comes to protecting customers and visitors from terrorism. Affected premises will include those hosting or undertaking the following:
- Retail sale of goods
- Provision of a service
- Sale of food or drink
- Nightclubs and social clubs
- Theatre/dance performances
- Cinema
- Indoor sporting events
- Live music
- Playing recorded music
- Recreation/leisure/exercise
- Library
- Museum/gallery
- Halls for exhibition/conference/event use
- Visitor attractions
- Hotels, hostel and holiday parks
- Place of worship (standard duty)
- Hospital/healthcare
- Bus/rail/tram stations
- Aerodromes
- Childcare (standard duty)
- Primary and secondary schools (standard duty)
- Further education (standard duty)
- Higher education
- Public authorities
This is an extensive list of impacted industries and goes far beyond the expectation some might have had of increased event safety. The law will impact retail premises and places of congregation as much as ticketed events, although these arguably remain the focus of the law. However, the extent of the protection required will differ, with three categories of protection for different types of businesses and venues.
The three levels of terrorism protection
The new law introduces three categories of ‘public protection procedures’ that will apply to different types of venues and organisations. These are designed to provide rough frameworks for the level of protection necessary depending on the perceived level of risk, largely in line with the number of people who will be in attendance.
Most businesses will fall into the enhanced category, which comes with more obligations than the standard category. Businesses in the standard category are noted next to the list of industries and sectors above. All events will fall into the event category, which requires the highest level of protection against terrorism.
Standard
- Objective: reduce risk of physical harm in an attack at (or “in the immediate vicinity of”) the premises;
- Implement “appropriate” public protection procedures;
- Procedures for:
- Evacuation
- Moving people
- Preventing people leaving
- Providing information.
Enhanced
- Objective: reduce vulnerability of premises to terror acts and reduce risk of physical harm;
- Implement public protection measures “so far as reasonably practicable”;
- Assess & review measures, which relate to:
- Monitoring premises & “immediate vicinity”
- Movement of people in/out
- Physical safety of premises
- Security of information.
Event
- Objective: reduce vulnerability of event to terror acts and reduce risk of physical harm;
- Implement public protection measures “so far as reasonably practicable”;
- Assess & review measures, which relate to:
- Monitoring event & “immediate vicinity”
- Movement of people in/out
- Physical safety of event
Security of information.
What should businesses do about Martyn’s law?
Now, not a lot. It may be worth thinking about the implications the law might have on your business, and how these could be mitigated. Some aspects of improving protection against terror attacks may stand to reason, such as implementing bag checks at a large event which does not currently have them.
Others, however, will be opaquer. For a school, the potential responses could range from improving the logging and monitoring of visitors to the school site, to gating the premises or even hiring security personnel. None of this can be explicitly discounted until further guidance is provided on what qualifies as reasonably practicable, in light of whatever the perceived terror threat is at a given time.
This could tie into the terrorism threat level which is set by the Joint Terrorism Analysis Centre and MI5, although given that this can change relatively quickly, it may not be reasonable to expect thousands of organisations to change their provisions and protections to match it. Instead, it would make more sense to meet a specific baseline of protection, which protects people while also acknowledging the costs this will impose on businesses.
–
The scope of Martyn’s law is such that few public-facing organisations will be unaffected, leading to a potentially huge scale of remedial work. Businesses should at least plan for the worst case now and look at what measures they can implement ahead of time—readying themselves for a future where it’s contingent on all of us to protect against the threat of terrorist attacks.