Martyn’s Law: Your Comprehensive Guide to Compliance

Martyn’s Law, officially the Terrorism (Protection of Premises) Act 2025, received Royal Assent in April 2025. Introduced following the Manchester Arena attack in 2017, its purpose is to ensure publicly accessible have organisations a legal duty to prepare for and respond to terrorist incidents.

If you work in a building with more than 200 people present at any one time, the chances are you’ve heard of it – although our research found that 44% of teachers aren’t familiar with the legislation.

But whether you’ve read up on the law or not, there’s no need to panic. There’s an implementation period – noted in the statutory guidance as at least 24 months from Royal Assent – so that gives us until April 2027. But that time will go quickly, so it’s important to start taking steps now to understand what your organisation needs to do to be compliant.

In this guide, we’ll explain what Martyn’s Law is, the type of venues affected, steps to take for compliance and common misconceptions so you’ll be ready when enforcement begins.

Contents: 

• What is Martyn’s Law?
• When does Martyn’s Law come into effect?
• Which venues are affected?
• Terminology explained
• Who is responsible for compliance?
• 5 tips to help you comply with Martyn’s Law
• How Little Green Button can help

What is Martyn’s Law?

Officially the Terrorism (Protection of Premises) Act 2025, Martyn’s Law is legislation that aims to ‘improve protective security and organisational preparedness across the UK by requiring that those responsible for certain premises and events consider how they would respond to a terrorist attack,’ according to the Government’s Factsheet on the law.

The legislation was introduced following the 2017 Manchester Arena attack, which exposed significant gaps in how publicly accessible venues prepare for and respond to emergencies. It was named in memory of Martyn Hett, one of the 22 people killed in the attack, as his mother Figen Murray significantly contributed to the campaigning that helped the Act become law. 

The law places a legal duty on organisations and venues to take reasonably practicable steps to prepare for potential terrorist incidents and reduce harm if one occurs.

At its core, Martyn’s Law is focused on improving:

• Risk awareness
• Emergency preparedness
• Staff training
• Incident response
• Communication during emergencies

One of the most important aspects of the legislation is that it focuses not just on whether organisations have procedures written down, but whether those procedures would actually work in practice during a real incident.

The Home Office guidance repeatedly emphasises the importance of:

• Acting quickly under pressure
• Sharing information effectively
• Ensuring staff understand what to do
• Reducing harm during an incident

For many organisations, this shifts the focus away from simply having a policy document and towards being able to demonstrate that teams can coordinate a real, practical response. 

Importantly, Martyn’s Law is designed to be proportionate. Most organisations won’t be expected to install airport-style security or expensive screening systems. Instead, the emphasis is on practical measures that are appropriate for the size and nature of the venue.

This could include:

• Lockdown procedures
• Evacuation and invacuation plans
• Staff training and drills
• Visitor management
• Emergency communication systems

For schools, healthcare providers, local authorities and other public-facing organisations, the legislation is likely to increase expectations around emergency planning and staff communication in the next few years.

When does Martyn’s Law come into effect?

Martyn’s Law received Royal Assent on 3rd April 2025, officially becoming the Terrorism (Protection of Premises) Act 2025.

However, the legislation won’t be enforced immediately. Statutory guidance was published on 15th April 2026, and the Government has indicated there will be an implementation period of around two years before enforcement begins.

This implementation period is intended to give organisations enough time to:

• Understand their responsibilities
• Review existing procedures
• Train staff
• Improve emergency response plans
• Put practical safety measures in place

Although enforcement may still be some time away, your organisation should begin preparing now. Updating procedures, carrying out risk assessments, improving communication systems and training staff can take a long time, especially for larger or multi-site organisations.

It’s also important to remember that many of the principles behind Martyn’s Law already overlap with existing safeguarding and health and safety responsibilities. Schools, healthcare organisations and public sector bodies are already expected to have emergency procedures in place, and regulators such as Ofsted increasingly expect organisations to demonstrate that staff know how to respond during critical incidents.

So although it may seem daunting, the chances are that you’ve already begun some of the work that’s required to ensure your organisation is compliant with Martyn’s Law. Treat the next two years as an opportunity to strengthen your preparedness and identify any gaps in your current response procedures.

Which venues are affected?

One of the biggest misconceptions about Martyn’s Law is that it only applies to major stadiums, arenas or city centre venues. In reality, the law affects a much broader range of organisations and public spaces.

Martyn’s Law applies to publicly accessible premises and events where it is reasonable to expect 200 or more people to be present at the same time. That means many everyday buildings and venues will fall within scope, including schools, large health clinics, hospitals, community venues and places of worship.

The legislation is split into two tiers depending on occupancy:

• Standard tier: 200-799 people
• Enhanced tier: 800+ people

The core requirements of the law are those that apply to the standard tier, which focuses on practical procedures like lockdowns, evacuation plans and communication systems rather than extensive physical security measures.

We’ve broken down our interpretation of some of the main sectors and venue types likely to be affected by Martyn’s Law:

Schools and the education sector

Many schools, colleges and universities will fall within the scope of Martyn’s Law, particularly secondary schools and larger primary schools.

Multi-academy trusts (MATs) and other educational bodies are already expected to have safeguarding and lockdown procedures in place, and Martyn’s Law is likely to increase the focus on how these procedures work in practice. 

Our research, featured in the Daily Express, revealed that less than half (42%) of teachers feel their school is prepared for a major security incident, so it’s clear that there is still work to be done to ensure that teachers are supported to respond to incidents effectively.

Schools will need to think carefully about:

• How staff are alerted during emergencies
• Whether lockdown procedures are clearly understood
• How visitors are managed
• How procedures work during break times, lunch or after-school activities
• Whether staff can respond quickly under pressure

This is particularly important because schools are complex environments, with pupils and staff often spread across multiple buildings, playgrounds, sports facilities or temporary classrooms.

Many schools still rely on phones, radios or verbal communication during emergencies, but Martyn’s Law is likely to increase expectations around faster, clearer communication systems and practical response capability. Schools may also need to review lockdown drills, invacuation procedures and how emergency plans support pupils with SEND (special educational needs or disabilities).

NHS and healthcare settings

Healthcare organisations are another sector likely to be heavily affected by the legislation. 

We expect that this will include services such as:

• GP surgeries
• Hospitals
• Clinics
• Community healthcare centres
• Walk-in services

Healthcare settings already deal with high levels of aggression and unpredictable incidents – the latest NHS staff survey found that attacks on staff are at a 3-year high. Martyn’s Law is likely to place greater emphasis on emergency communication, staff coordination, lockdown procedures, lone worker safety and fast incident response.

Healthcare organisations should begin reviewing:

• How staff raise alerts
• How incidents are escalated
• Whether communication systems work quickly under pressure
• How lockdown procedures would operate
• How lone workers are protected

As the legislation moves closer to enforcement, many NHS and healthcare organisations are likely to place greater emphasis on practical communication systems and coordinated emergency response procedures.

Theatres and entertainment venues

Theatres, cinemas and performance venues are all likely to fall within scope if they meet the occupancy threshold.

These venues may need to review:

• Evacuation procedures
• Public announcements
• Staff training
• Communication between front-of-house and security teams

Churches and places of worship

Martyn’s Law is likely to apply to larger places of worship such as churches, mosques, synagogues and temples if they regularly host gatherings above the occupancy threshold of 200.

This could include:

• Weekly services
• Weddings
• Funerals
• Community events

Volunteer training and clear communication procedures will be increasingly important in these settings.

Outdoor events

Martyn’s Law also applies to some temporary events and outdoor gatherings, which may include festivals, public celebrations and community events. 

Some organisers have already raised concerns about the practical implications and costs of compliance, particularly for smaller events run by volunteers. In our local area, we were saddened to hear that the organisers of Swanton Moreley fireworks display have cancelled the event due to the law. 

But the aim of the legislation is not to stop events from happening. It’s to ensure organisers have considered how they would respond during an emergency and reduce harm where reasonably practicable.

If your organisation regularly welcomes members of the public, it’s worth reviewing whether Martyn’s Law could apply to your premises or events, even if you wouldn’t traditionally think of yourself as a high-risk venue.

Terminology explained

Martyn’s Law introduces a lot of new terminology that you might not be familiar with. Understanding these key terms will make it much easier to interpret the guidance and identify what your organisation needs to do to prepare.

Standard and enhanced tiers

Martyn’s Law splits premises and events into two categories depending on the number of people expected to be present at the same time.

Standard tier

The standard tier applies to premises and events where it is reasonable to expect between 200 and 799 people to be present at any one time.

The requirements at this level are designed to be practical and proportionate. Organisations are expected to have procedures in place to help protect people during an incident, but there is less emphasis on formal documentation and physical security infrastructure.

The focus is mainly on:

• Emergency procedures
• Staff awareness
• Communication
• Acting quickly during an incident
• Reducing harm

For most organisations, this will mean reviewing how they would respond to situations such as lockdowns, evacuations or invacuations, and ensuring staff understand what to do.

Enhanced tier

The enhanced tier applies to venues and events with an occupancy of 800 or more people.

Large hospitals, universities, stadiums and large entertainment venues are the most likely to fall into this tier. These organisations are likely to face greater scrutiny and additional requirements, including:

• Formal terrorism risk assessments
• More detailed documented procedures
• Evidence showing how risks are being managed
• Greater oversight of preparedness measures

While enhanced tier organisations may need more detailed plans, the overall principle remains the same: organisations must be able to respond effectively and reduce harm during an incident.

Lockdown vs evacuation vs invacuation

One area that causes a lot of confusion is the difference between lockdowns, evacuations and invacuations. Under Martyn’s Law, organisations should understand the difference between each procedure and when they might be appropriate.

Lockdown

A lockdown is used when there is a threat inside or close to the building and it is safer for people to stay where they are and secure themselves away from danger.

Examples could include:

• An intruder on site
• A violent individual inside the building
• An active threat nearby

During a lockdown, people may be instructed to:

• Stay inside rooms
• Lock or barricade doors
• Move away from windows
• Remain quiet
• Wait for further instructions

Clear communication is critical during lockdown situations. Staff need to understand exactly what is happening and what action they should take.

Evacuation

An evacuation is the process of safely moving people out of a building or area when it is unsafe to remain there.

This is most commonly associated with:

• Fires
• Gas leaks
• Structural risks
• Some external threats

Most organisations will already have evacuation procedures and fire drills in place. However, one of the important messages within Martyn’s Law guidance is that evacuation is not always the safest response during every emergency.

Invacuation

In our experience, invacuation is often less well understood than lockdown or evacuation. It refers to bringing people inside a building to protect them from a threat outside.

Examples might include:

• Violence in the local area
• Suspicious activity nearby
• Dangerous animals
• Chemical or environmental hazards

In schools, invacuation procedures are already becoming more common and may involve bringing pupils inside from playgrounds or sports fields quickly and safely.

The important thing is that staff understand the difference between these procedures and can act quickly under pressure. Different emergency situations require different responses, which is why clear alerts and communication systems are becoming increasingly important.

‘Must’, ‘should’ and ‘could’

If you read the Martyn’s Law guidance, which is a hefty 127 pages, you’ll notice ‘must’, ‘should’ and ‘could’ is used throughout the documentation. If you understand what these terms mean in relation to the law, it’ll help you prioritise your organisation’s preparations correctly.

• Must: If the guidance says an organisation ‘must’ do something, this is a legal requirement under the legislation. Failure to comply could result in enforcement action or penalties once the preparation period is over.
• Should: Indicates that it’s not an express requirement, but is strongly recommended and encouraged good practice. It’s likely that organisations would be expected to justify why they chose not to follow a ‘should’ recommendation.  
• Could: Suggestions or examples that are optional and not a legal requirement. You may want to consider these examples depending on your premises’ size, layout, risk profile or operational needs. They may help you understand how to implement a ‘should’ or ‘could’ recommendation.

The ‘must’, ‘should’ and ‘could’ wording is important because Martyn’s Law is designed to be proportionate. Not every organisation is expected to introduce extensive or expensive security measures. Instead, organisations are expected to take reasonably practicable steps that are appropriate for their environment and level of risk.

Who is responsible for compliance?

Under Martyn’s Law, responsibility for compliance sits with the person or organisation that has control of the premises or event. The legislation refers to this as the ‘responsible person’.

According to the statutory guidance, the responsible person is ‘the individual, organisation or company that has control over the qualifying premises for the purpose of their Schedule 1 [the specific types of activities in scope of the Act] use, or control over the premises for the purposes of the qualifying event.’ 

This means that the responsible person is defined in the Act, and it isn’t a matter of choice. 

For example, if a company leases a building to use as a retail store, the responsible person is the company operating the shop, because this is the relevant use of the building. The owner of the building isn’t involved. 

However, if a large brewery owns and holds a licence for a pub but leases it to a tenant, the brewery is the responsible person because they are the licence holder.

The Security Industry Authority (SIA) is the regulator for Martyn’s Law. If your premises falls under the enhanced tier, the responsible person must submit a report to the SIA detailing the public protection procedures and measures that will be put in place, explaining how they are expected to reduce harm should a terrorist attack occur and how the measures are expected to reduce the vulnerabilities to a terrorist attack.

If you’re not sure who the responsible person would be for your premises, you should seek legal advice to ensure that you stay compliant and avoid costly penalties when the Act is enforced.

5 tips to help you comply with Martyn’s Law

One of the reassuring things about Martyn’s Law is that most organisations are not expected to introduce airport-style security, armed guards or expensive screening systems.

Instead, the legislation focuses on whether organisations have taken reasonably practicable steps to prepare for an incident and reduce harm if one occurs.

The Home Office guidance places a strong emphasis on practical response capability. In other words, it’s not just about having policies written down – it’s about whether your procedures would actually work under pressure in a real emergency.

For most organisations in the standard tier, compliance is likely to centre around emergency planning, staff awareness, clear communication and reviewing existing risk assessments and procedures.

1. Develop practical emergency procedures

Affected organisations will need procedures covering incidents such as:

• Lockdowns
• Evacuations
• Invacuations
• Communicating with staff and visitors during emergencies

These procedures should be easy to understand, realistic, usable under pressure and appropriate for the size and layout of the premises.

The guidance repeatedly focuses on reducing harm during an incident, so organisations should think carefully about how quickly people can be informed and how clearly instructions can be communicated.

2. Ensure staff know what to do

Having a policy document hidden away in a folder isn’t enough to comply with the law. You’ll need to conduct regular training with your team, ensuring that in the event of a terrorist incident, they:

• Understand emergency procedures
• Know how to raise the alarm
• Know what different alerts mean
• Are confident in how to respond during different scenarios

For example, schools may need to practise lockdown procedures more regularly, while healthcare organisations may need to review how incidents are escalated across multiple departments or sites.

You may also want to train your staff in how to conduct a dynamic risk assessment. These assessments are useful to help people measure risk in a fast-moving situation where things may change suddenly.

3. Improve communication during incidents

One of the clearest themes running throughout the statutory guidance is the importance of sharing information quickly and effectively during an incident.

Think about what would happen if there were a potential terrorist attack unfolding on your premises. Ask yourself:

• How would staff be alerted right now?
• Would everyone receive the message immediately?
• Would the system still work under pressure?
• Would staff understand what action to take?

Many organisations, particularly schools, are still using unreliable methods to respond in emergencies. That’s why many organisations are now reviewing tools such as panic alarm software, lockdown alert systems, mass notification tools and escalation procedures to ensure that the right people receive the right information as quickly as possible.

4. Review your existing risk assessments and procedures

Although formal terrorism risk assessments are mainly associated with the enhanced tier, all organisations should still review their current procedures and identify any gaps in preparedness.

This may include reviewing:

• Entry and exit points
• Visitor management
• Lone worker arrangements
• Emergency communication methods
• Staff training records
• Existing lockdown or evacuation plans

Many organisations will already have some of these measures in place through safeguarding, health and safety or emergency planning procedures. Martyn’s Law is likely to build on these existing responsibilities rather than replace them entirely.

5. Focus on what would actually happen during an incident

Perhaps the biggest shift introduced by Martyn’s Law is the focus on real-world response rather than paperwork alone.

The key question your organisation should ask itself is:

“If an incident happened right now, could we quickly alert staff and coordinate an effective response?”

If the answer is uncertain, the next two years are your opportunity to strengthen procedures, improve communication systems and ensure staff feel confident responding under pressure.

How Little Green Button can help

One of the clearest themes running throughout the Martyn’s Law guidance is the importance of being able to communicate quickly and respond effectively during an incident.

The law requires organisations to go further than just having documented policies. The guidance repeatedly focuses on whether organisations can actually carry out their procedures under pressure and reduce harm in a real terrorist attack.

That’s where Little Green Button can help.

Little Green Button helps organisations bridge the gap between written procedures and real-world response capability by enabling staff to raise emergency alerts instantly and coordinate a response in real time.

Instant emergency alerts

Staff can raise alerts immediately from desktop computers, mobile devices, USB panic buttons (Big Green Buttons) or Bluetooth panic buttons (Mini Green Buttons). 

Your team can trigger emergency responses quickly, discreetly and to the right people without relying on phone calls or verbal communication.

Support for lockdown, evacuation and invacuation procedures

Little Green Button’s configurable alert types can support a wide range of emergency procedures, including:

• Lockdowns
• Invacuations
• Medical emergencies
• Fire alerts
• Intruder incidents
• Aggressive behaviour incidents

Different alert types can be configured to trigger different response procedures, helping to get the right information to the right people so staff understand exactly what action to take.

Little Green Button allows you to:

• Create alert groups
• Define escalation paths
• Route different alert types to specific teams
• Use receive-only notifications for wider staff, pupil, visitor or client communication

For example, a lockdown alert could notify security staff and senior leadership immediately and require a response, whereas it could alert all other staff, visitors or pupils in a building but not allow responses. 

This helps you coordinate a faster, clearer and more structured response during high-pressure situations.

Improve visibility and reporting

Martyn’s Law places strong emphasis on preparedness and practical response capability.

Little Green Button’s reporting features can help you review incidents and strengthen procedures over time through email alert timelines, evacuation reports and location data.

Features such as smart location prompting and evacuation reports can help you understand where staff were located during an incident and improve emergency planning.

Practical, proportionate preparation

One of the key principles behind Martyn’s Law is proportionality. Most organisations aren’t expected to install extensive physical security infrastructure, but they are expected to take reasonably practicable steps to reduce harm.

For many schools, healthcare organisations, councils and public-facing workplaces, having a reliable way to alert staff quickly may be one of the simplest and most effective improvements they can make. 

There aren’t any products or services on the market that can guarantee compliance with Martyn’s Law, but Little Green Button could be an important part of your toolkit to help you demonstrate to the SIA that you have safety measures in place that work in real-world situations.

If you’d like to speak to the team about how Little Green Button could help you prepare for Martyn’s Law, contact us and we’ll be in touch.