The Terrorism (Protection of Premises) Act — known as Martyn's Law — has passed into statute, creating a legal duty for venue operators and public organisations to take proportionate steps to protect the public from terrorist attack. For schools, local authorities, NHS estates, and councils managing public venues, this represents a genuinely new compliance obligation. This guide sets out what the law requires, which organisations are affected, and what practical steps look like.
Martyn's Law is named in memory of Martyn Hett, who was killed in the 2017 Manchester Arena attack. The legislation was developed in response to a sustained campaign by his mother, Figen Murray, and reflects a determination that organisations responsible for public spaces should take an active role in preparing for and mitigating the impact of a terrorist incident, rather than leaving preparedness to chance.
The core principle is straightforward: organisations that invite the public onto their premises have a responsibility to take reasonable and proportionate measures to protect those people from the foreseeable risk of a terrorist attack. The law creates a statutory duty where previously only guidance existed.
The Act creates two tiers of obligation based on venue capacity. The Standard Duty applies to venues with a capacity of 200 to 799 people. The Enhanced Duty applies to venues with a capacity of 800 or more. Schools, colleges, council buildings, leisure centres, libraries, and NHS premises may fall into either tier depending on their maximum capacity.
Local authorities and councils managing multiple public venues need to assess each venue individually. A council managing a town hall with a capacity of 900 and a community meeting room with a capacity of 150 has one Enhanced Duty venue and one Standard Duty venue, each with different requirements.
The Standard Duty focuses primarily on procedural preparedness: having plans in place, training staff on what to do in the event of an attack, and ensuring evacuation and lockdown procedures are workable and communicated. The Enhanced Duty adds requirements for documented risk assessment, physical security measures, and more formal security planning.
For most schools and smaller public venues, the Standard Duty is the relevant tier. It requires the responsible person to put in place documented procedures for responding to a terrorist incident — evacuation plans, lockdown procedures, and communication protocols that staff are aware of and have been trained on.
The Standard Duty does not prescribe specific technology or physical measures. It requires that procedures are proportionate to the foreseeable risk and that staff know what those procedures are. A school with a documented lockdown procedure, regular drills, and all staff briefed on the evacuation plan is meeting the spirit of the requirement.
For larger venues falling under the Enhanced Duty, a formal security plan is required — covering the specific threats assessed as relevant, the physical and technological measures in place to address them, and the procedures for response. This plan must be regularly reviewed and updated.
Physical security measures — access control at entry points, CCTV coverage of public areas, intruder detection — are relevant to Enhanced Duty compliance insofar as they support the venue's ability to detect and respond to a threat. The law does not prescribe specific systems, but a venue without any physical security measures will struggle to demonstrate it has taken reasonable steps.
We work with schools, councils, and public sector organisations to review their security posture against the Protect Duty requirements — identifying gaps in both procedures and physical measures and helping to address them.
Get in Touch →