Martyn’s Law for Small Businesses: What Should You Be Doing Now?

Understanding what the Terrorism (Protection of Premises) Act 2025 means for smaller organisations

When people hear Martyn’s Law, they may immediately think about major events, football stadiums, shopping centres or large entertainment venues.

But the Terrorism (Protection of Premises) Act 2025  commonly known as Martyn’s Law has a much broader reach.

A wide range of premises and organisations that are accessible to members of the public may potentially fall within its scope.

For smaller businesses, this can understandably create uncertainty.

Does the legislation apply to us? What do we actually have to do? How do we know which tier we’re in? And do we need to spend thousands of pounds on security?

The answer begins with something much simpler:

Understand your position first.

Don’t start with security measures, start with scope

One of the most important mistakes an organisation can make is jumping straight to the question:

“What security equipment do we need?”

before establishing whether the organisation is actually within scope and, if it is, which duties apply.

The first step should be to understand your premises, your activities, your expected occupancy and the way in which the legislation applies to your organisation.

For smaller businesses, particularly those operating close to the relevant occupancy threshold, this assessment can be particularly important.

A simple assumption that “we’re too small” isn’t the same as establishing and evidencing why you believe you are outside the scope of the legislation.

And also your core purpose still remains, to deliver a safe, secure and enjoyable event/experience.

Could small businesses be affected?

Potentially, yes.

Martyn’s Law is relevant to a broad range of publicly accessible premises and activities.

Depending on the circumstances, this can include organisations such as:

• Pubs and bars

• Restaurants

• Leisure venues

• Sporting facilities

• Entertainment venues

• Community facilities

• Visitor attractions

• Places of worship

• Retail and commercial premises

• Other premises where members of the public may be present

The fact that an organisation is a small business does not, by itself, determine whether the legislation applies.

Scope needs to be established from the circumstances of the premises and the activities taking place.

Standard Tier: what does it mean?

For organisations falling within the standard tier, the emphasis is on having appropriate public protection procedures in place.

This is not necessarily about installing expensive physical security infrastructure.

The standard tier is principally concerned with having appropriate procedures that could reduce the risk of harm to individuals if an act of terrorism were to occur.

This means organisations should be thinking about issues such as:

• How would staff respond to a terrorist-related incident?

• What procedures are in place?

• How would staff receive and act upon relevant information?

• How would people be warned or informed?

• What arrangements exist for responding to an incident?

• Have staff received appropriate information or training?

• Are the procedures realistic and proportionate to the organisation?

The important word is proportionate.

Martyn’s Law is not intended to require every small business to operate like a major national-security facility.

What about the Enhanced Tier?

The enhanced tier applies to premises and events meeting the relevant criteria and has more extensive requirements.

The focus moves beyond simply having procedures and includes requirements relating to the reduction of vulnerability and risk, with organisations required to undertake appropriate assessments and consider measures designed to reduce the risk of harm.

For organisations falling into this category, protective security becomes a much more substantial area of organisational responsibility.

That can include consideration of:

• Physical security

• Access and movement

• Search arrangements

• Security personnel

• Surveillance and monitoring

• Emergency procedures

• Incident response

• Staff responsibilities

• Security planning

• Testing and exercising

• Governance and assurance

The precise requirements depend on the organisation and its circumstances.

What should a small business be doing now?

The answer isn’t necessarily to spend money immediately.

Instead, start with understanding, assessment and preparation.

1. Establish whether you are in scope

Look carefully at your premises and activities.

Consider your normal operating arrangements and reasonably foreseeable circumstances that could affect occupancy.

If you are close to the relevant threshold, don’t simply make an assumption.

Establish the facts and document your reasoning.

2. Understand which tier applies

If you are within scope, determine which tier your premises or activity falls within.

The duties associated with the standard tier are different from those associated with the enhanced tier.

Understanding this distinction is fundamental to preparing appropriately.

3. Assess your existing arrangements

Don’t automatically assume that you need a completely new security system.

You may already have useful arrangements in place.

Consider:

• Existing emergency procedures

• Staff training

• Evacuation arrangements

• Communication systems

• Incident-management procedures

• Relationships with emergency services

• Existing risk assessments

• Security measures

• Business continuity arrangements

The question is:

Are your existing arrangements appropriate, proportionate and effective?

4. Identify the gaps

Once you’ve established what you already have, identify what is missing.

This creates a much more sensible starting point than buying security products simply because you are concerned about the legislation.

Your gap assessment might identify a need for:

• Additional staff training

• Improved procedures

• Better communication arrangements

• Updated emergency plans

• Improved signage

• Additional physical security

• Better documentation

• Testing and exercising

The appropriate response will be different for every organisation.

Don’t forget the evidence

One of the most valuable things a small organisation can do is document its decision-making.

For example:

• How did you establish your occupancy?

• What information did you use?

• Why did you determine that you were, or were not, within scope?

• Which tier did you determine applied?

• What risks did you identify?

• What measures already existed?

• What improvements did you make?

• Why were particular measures considered proportionate?

This creates an audit trail of your decision-making.

For organisations close to the scope threshold, this can be particularly valuable because it demonstrates that the organisation did not simply ignore the legislation or make an unsupported assumption.

Don’t fall into the “we’re only a small business” trap

One of the biggest misconceptions surrounding Martyn’s Law is that smaller organisations don’t need to think about protective security.

The better approach is:

Don’t ask whether you’re big enough to worry about security.

Ask:

“What is our actual position, what does the legislation require of us, and what is proportionate for our organisation?”

That is a much more defensible approach.

Preparation doesn’t have to mean huge expenditure

Martyn’s Law shouldn’t automatically translate into a shopping list of expensive security equipment.

For many organisations, the first improvements may involve:

People.

Procedures.

Training.

Communication.

Planning.

Testing.

And importantly:

Understanding your risks.

Good protective security begins with understanding the problem before deciding on the solution.

What should you do next?

If you haven’t considered Martyn’s Law yet, don’t panic.

Start with the basics:

1. Understand your premises.

2. Establish your occupancy position.

3. Determine whether you are in scope.

4. Understand which tier applies.

5. Review what you already have.

6. Identify gaps.

7. Document your decisions.

8. Take proportionate action.

If you are uncertain about where your organisation sits, particularly if you are close to the relevant threshold, obtaining appropriate professional advice can help you establish a clear and defensible position.

Meraxes Secure Ltd

At Meraxes Secure Ltd, we help organisations understand protective security requirements and prepare for Martyn’s Law using practical, proportionate and understandable advice.

You don’t need to become a security expert.

You do need to understand your responsibilities.

If you’re unsure where to start, get in touch with Meraxes Secure Ltd and let’s establish where you stand.

Visit www.MeraxesSecure.co.uk

Protecting People. Places. Purpose.