Protective security guidance

Martyn’s Law: A Practical Preparation Guide

Understand the current status, likely scope, standard and enhanced duties, and practical preparation steps for Martyn’s Law.

  • Use the current 200 and 800-person thresholds correctly
  • Separate procedures from enhanced-tier measures
  • Keep responsibility with the person or organisation in control

The Home Office has published statutory guidance to help responsible persons prepare. Current scope and commencement information should always be checked before relying on this guide.

Who is likely to be in scope

Premises are likely to qualify when all of these conditions apply:

  • They include a building or part of a building.
  • They are wholly or mainly used for a purpose listed in Schedule 1.
  • It is reasonable to expect 200 or more people, including staff, at the same time from time to time.
  • They are not excluded under Schedule 2.

A qualifying event is likely to require all of the following:

  • The event is accessible to members of the public.
  • Entry includes checks for a ticket, pass, membership or guest status.
  • It is reasonable to expect at least 800 people, including staff, at the same time.
  • The event is not held at premises already in the enhanced tier.
  • No Schedule 2 exclusion applies.

Thresholds alone do not determine scope. Use the official guidance and flowcharts for the exact premises or event.

Standard and enhanced tiers

  • Standard tier generally covers qualifying premises where 200 to 799 people may be present at the busiest time.
  • Enhanced tier generally covers qualifying premises where 800 or more people may be present.
  • Qualifying events use enhanced-tier requirements.
  • Childcare, primary, secondary and further-education premises and places of worship have special tier treatment described in the official guidance.

Duties once the provisions commence

All in-scope responsible persons will need to notify the SIA and ensure appropriate, reasonably practicable public-protection procedures covering:

  • Evacuation: moving people out and away from danger
  • Invacuation: moving people to a safer place within the premises or event
  • Lockdown: securing the premises or event to control entry or exit
  • Communication: giving people the information they need during the incident

Enhanced-tier premises and qualifying events will also need appropriate, reasonably practicable public-protection measures, documented reasoning, an up-to-date compliance document and, where the responsible person is an organisation, a senior individual.

Who is the responsible person?

The responsible person is normally the individual or organisation controlling the premises for the relevant use, or controlling the event premises for the event. Responsibility cannot simply be transferred to a security contractor.

What reasonably practicable means

It means weighing likely effectiveness against the time, cost and difficulty of implementation in the circumstances of the premises or event. It is not a command to buy every available security product.

Practical preparation before commencement

  1. Read the Home Office statutory guidance and official scope flowchart.
  2. Identify who controls the premises or event for the relevant use.
  3. Estimate the reasonable maximum number of people present, including staff.
  4. Record why the premises or event is likely to be in or out of scope.
  5. Map existing emergency, fire, safety, security and communication arrangements.
  6. Identify gaps in evacuation, invacuation, lockdown and communication procedures.
  7. Define roles shared with landlords, tenants, venues, organisers and contractors.
  8. Brief employees, volunteers and contractors who may implement procedures.
  9. Test communications and use proportionate scenario exercises.
  10. Record decisions, changes and review dates.
  11. Subscribe to Home Office and SIA updates before relying on dates or portal details.

How a security provider can support

A provider can contribute operational knowledge about access control, licensed roles, incident communication, restricted areas, crowd interfaces and deployment instructions. It cannot become the responsible person merely by contract, certify legal compliance or replace the organisation’s own decisions.

Frequently asked questions

Is Martyn’s Law already in force?

The Act has been passed, but most substantive requirements were not yet commenced on 30 July 2026. The current expectation is spring 2027, subject to regulations.

Does every venue with 200 people fall in scope?

No. The building, use, expected attendance and exclusions all matter. Use the official guidance rather than the threshold alone.

Are staff included in the attendance figure?

Yes. Current official guidance says the reasonable expectation includes staff.

Must a venue hire a security company to comply?

No. Government guidance expressly says specialist services should not be necessary for compliance. A provider may support operational security where the risk and event plan justify it.

Can the responsible person delegate the legal duty?

No. Contractors can perform tasks and provide advice, but the responsible person remains responsible.

Does standard tier require new barriers or equipment?

Not merely to satisfy the standard-tier procedure duty. The Home Office says standard-tier requirements focus on practical procedures rather than mandatory physical alterations or equipment purchases.

Sources and further reading

  1. Home Office: Martyn’s Law statutory guidance
  2. Home Office: Terrorism (Protection of Premises) Act 2025 factsheet
  3. SIA: understanding Martyn’s Law and the regulator’s role
  4. Legislation.gov.uk: Terrorism (Protection of Premises) Act 2025

Coordinate security with the event or premises plan

We can discuss operational event-security duties while the responsible person retains control of legal compliance.