Martyn’s Law for Small Businesses: What Should You Be Doing Now?

Martyn’s Law, formally known as the Terrorism (Protection of Premises) Act 2025, is changing the way businesses and organisations across the UK need to think about protective security, counter-terrorism preparedness and public safety.

For many businesses, particularly pubs, bars, restaurants, hospitality venues, leisure facilities, community venues and other publicly accessible premises, the question is no longer simply “Does Martyn’s Law apply to us?”

The more useful question is:

“Are we prepared for Martyn’s Law, and can we demonstrate that we have taken proportionate steps to protect people?”

The Act received Royal Assent on 3 April 2025. The Government has provided an implementation period of at least 24 months, giving organisations time to understand their responsibilities and prepare before the substantive requirements come into force. Statutory guidance was published by the Home Office in 2026.

That means businesses should not be waiting until the final stages of implementation before starting to assess their position.

What is Martyn’s Law?

Martyn’s Law is legislation designed to improve protective security and preparedness against terrorism at certain public premises and events.

The legislation introduces a more consistent approach to counter-terrorism preparedness by placing responsibilities on those who control qualifying premises and events.

The Government describes the purpose of the Act as improving preparedness and readiness to respond to a terrorist attack, while requiring certain larger premises and events to consider reasonably practicable measures to reduce their vulnerability.

The legislation uses a tiered approach, meaning the requirements placed on an organisation depend partly on the number of people reasonably expected to be present.

This is important because Martyn’s Law is not intended to mean that every business must install expensive security equipment or operate like a high-security facility.

Instead, the approach is intended to be proportionate to the size and circumstances of the premises or event.

Does Martyn’s Law apply to my business?

This is one of the most important questions businesses should be asking.

The Act applies to qualifying publicly accessible premises and events where the relevant statutory criteria are met.

For qualifying premises, the legislation uses the number of individuals who may reasonably be expected to be present at the same time, including staff, when determining the applicable tier. Premises where between 200 and 799 people may reasonably be expected to be present fall within the standard duty threshold, subject to the other requirements of the legislation.

Larger premises and events can fall within the enhanced duty.

Importantly, this means businesses should not rely solely on their everyday trading capacity when considering whether they could fall within scope.

Patterns of occupancy, events, seasonal activity and changes in how premises are used can all be relevant when determining the number of people reasonably expected to be present.

Examples of potentially relevant premises and activities

Depending on the circumstances, Martyn’s Law can be relevant to sectors including:

• Pubs and bars

• Restaurants and hospitality venues

• Hotels and holiday accommodation

• Retail premises

• Cinemas and entertainment venues

• Sports venues

• Places of worship

• Community facilities

• Educational settings

• Public events

• Other publicly accessible premises and events.

  
  

The precise application of the legislation depends on the statutory criteria, so businesses should assess their individual circumstances rather than assuming that a particular industry is automatically included or excluded.

Standard Duty and Enhanced Duty

Understanding the difference between the two tiers is essential.

Standard Duty

The standard duty applies to qualifying premises and events where the number of individuals reasonably expected to be present falls within the relevant standard-duty range.

The focus is primarily on preparedness and public protection procedures.

Organisations should consider how they would respond to a terrorist attack and ensure that appropriate procedures are in place.

This can include considerations around:

• Evacuation

• Invacuation

• Lockdown

• Communication

• Staff responsibilities

• Incident response

• Information sharing

• Training and awareness

• Emergency procedures

The objective is not simply to produce a document and put it in a folder.

The objective is to ensure that people understand what they are expected to do if something happens.

Enhanced Duty

Enhanced duty applies to qualifying larger premises and events.

Because these locations can involve significantly larger numbers of people, the legislation introduces additional requirements, including the consideration and implementation of reasonably practicable public protection measures.

This moves the emphasis beyond preparedness alone and towards reducing vulnerabilities as well as preparing for an incident.

The Government’s guidance makes clear that enhanced-duty organisations will have additional responsibilities compared with standard-duty premises. (GOV.UK)

What should businesses be doing now?

Even though the substantive requirements of Martyn’s Law are not yet being enforced, there is a strong argument for businesses to begin preparing now.

The Home Office has specifically stated that organisations which fall within scope may wish to consider the requirements before the legislation comes fully into force. (Home Office Media)

1. Establish whether your premises could be in scope

Start with the basics.

Ask:

What activities take place at our premises?

How many people could reasonably be expected to be present at the same time?

Does that change during weekends, evenings, events, seasonal periods or special occasions?

Who is responsible for the premises?

Understanding your potential position under the legislation is the first step towards effective preparation.

2. Review your existing security arrangements

Do not automatically assume that Martyn’s Law means starting again from scratch.

Your organisation may already have:

• Emergency plans

• Fire evacuation procedures

• Business continuity arrangements

• CCTV

• Access control

• Staff training

• Incident reporting procedures

• Security personnel

• Communication systems

• Emergency contacts

• Existing risk assessments

The important question is whether these arrangements adequately consider the terrorism threat and whether they work together effectively.

3. Consider evacuation, invacuation and lockdown

One of the most important areas of preparedness is understanding what people should do during an attack.

For some incidents, evacuation may be appropriate.

For others, remaining inside the building and securing areas may be safer.

In certain circumstances, lockdown procedures may be required.

Businesses therefore need more than a generic emergency procedure.

Staff should understand:

What happens?

Who makes the decision?

How is the instruction communicated?

Where do people go?

What happens to customers or visitors?

How do we account for staff?

What happens if normal routes or communications are unavailable?

These questions can expose weaknesses that are not always obvious during normal operations.

4. Build a security-aware culture

Protective security is not simply the responsibility of a security manager.

In many businesses, the people most likely to notice something unusual will be front-line employees.

Receptionists.

Bar staff.

Door supervisors.

Managers.

Retail workers.

Stewards.

Cleaners.

Volunteers.

Security personnel.

Creating an environment where employees understand what suspicious behaviour might look like, know how to report concerns and understand what to do during an incident can significantly strengthen organisational preparedness.

Training does not necessarily need to be complicated.

It needs to be relevant, understood and practised.

5. Test your procedures

A procedure that has never been tested is an assumption.

Businesses should consider whether their emergency arrangements would actually work under pressure.

For example:

• Can staff communicate quickly?

• Do managers know who is responsible for making decisions?

• Can customers receive clear instructions?

• Are emergency contacts accessible?

• Do staff understand evacuation and invacuation procedures?

• Could vulnerable people be supported?

• Are there areas of the building that create particular vulnerabilities?

• Would procedures still work if normal communications failed?

Tabletop exercises and scenario-based training can provide valuable insight without requiring a major operational exercise.

6. Keep evidence of your preparation

Good protective security is not simply about having policies.

Organisations should be able to demonstrate that they have considered their responsibilities and taken appropriate action.

That can include maintaining records of:

• Assessments

• Procedures

• Training

• Exercises

• Reviews

• Actions taken

• Management decisions

• Relevant communications

This creates an auditable trail and helps ensure that protective security becomes part of normal organisational management rather than a one-off compliance exercise.

A proportionate approach to Martyn’s Law

One of the biggest misconceptions surrounding Martyn’s Law is that compliance automatically means significant expenditure on physical security.

That is not the purpose of the legislation.

The Government’s approach is based around reasonably practicable measures and recognises that different premises have different circumstances and levels of risk. (GOV.UK)

For one organisation, the most important improvements might involve training and procedures.

For another, it might involve reviewing access arrangements, CCTV coverage, hostile vehicle considerations, communications or the management of crowded areas.

There is no universal security package that is appropriate for every business.

The starting point should always be:

Understand the risk.

Understand the vulnerability.

Understand what you can reasonably do about it.

Martyn’s Law is an opportunity to improve security

For businesses, Martyn’s Law should not simply be viewed as another piece of legislation to comply with.

It provides an opportunity to look at protective security more broadly.

A well-prepared organisation is not necessarily one with the most security equipment.

It is one where:

• Responsibilities are understood.

• Staff know what to do.

• Procedures are realistic.

• Vulnerabilities have been considered.

• Security measures are proportionate.

• Emergency arrangements are tested.

• Management understands the risks.

• Lessons are acted upon.

That is what effective protective security should look like.

Preparing for Martyn’s Law: Where should you start?

If you are responsible for a pub, restaurant, hospitality venue, sports facility, entertainment venue, community facility or another publicly accessible premises, now is a sensible time to establish your position.

A practical starting point is:

Martyn’s Law Preparation Checklist

1. Identify whether your premises or event may fall within scope.

2. Review your expected occupancy and how it changes during different activities.

3. Identify who is responsible for the premises.

4. Review existing emergency and security arrangements.

5. Consider evacuation, invacuation and lockdown procedures.

6. Review staff awareness and training.

7. Identify vulnerabilities and areas requiring improvement.

8. Test your procedures.

9. Record the work undertaken and actions identified.

10. Review and update your arrangements as guidance and implementation develop.

How Meraxes Secure can help

At Meraxes Secure, we believe protective security should be practical, proportionate and appropriate to the organisation.

Our approach is designed to help businesses understand their current position, identify vulnerabilities and develop practical improvements without creating unnecessary bureaucracy or adopting a disproportionate security model.

We can support organisations with areas including:

• Martyn’s Law readiness assessments

• Protective security reviews

• Premises assessments

• Security gap analysis

• Emergency preparedness

• Evacuation, invacuation and lockdown planning

• Staff security awareness

• Protective security policies and procedures

• Security maturity assessments

• Action planning and improvement programmes

Our aim is straightforward:

Protecting People. Places. Purpose.

Final thoughts

Martyn’s Law is now legislation, and the Home Office has published statutory guidance to help organisations understand what will be expected of them.

The implementation period provides businesses with valuable time to prepare.

The organisations that use that time effectively will have an opportunity to identify weaknesses, improve preparedness, train their people and build stronger protective security arrangements before the legal requirements come fully into force. (Home Office Media)

Do not wait for the legislation to become an immediate compliance problem.

Start by understanding your risk, your responsibilities and your current level of preparedness.

If you are unsure where your organisation stands, Meraxes Secure can help you take the first step.

Protecting People. Places. Purpose.

Meraxes Secure Ltd

Protective Security & Martyn’s Law Consultancy

Website: www.meraxessecure.co.uk