Terrorism (Protection of Premises) Act 2025

Martyn's Law:
What It Means for Your Building

The Terrorism (Protection of Premises) Act 2025 creates statutory security obligations for thousands of UK schools and public venues. Its requirements are expected to commence from 2027, with the final date to be confirmed. Here is what you need to know and what you need to do.

Expected Commencement
From 2027
No commencement date has been fixed. The Government has committed to at least 24 months from Royal Assent, and venues in scope should be ready before the requirements take effect.
Standard Tier: 200 to 799 people, including staff, reasonably expected
Enhanced Tier: 800 or more. Schools are always Standard Tier
Qualifying events (800 or more) are in scope as well as premises
Named Responsible Person required
SIA is the regulator; notification required in both tiers
Track the latest commencement status →
Background

What is Martyn's Law?

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025. It is named after Martyn Hett, who was among the 22 people killed in the Manchester Arena attack in May 2017. Martyn's mother, Figen Murray, campaigned for over six years to make the law a reality.

The Act creates statutory obligations for venues and events above a certain capacity to notify the Security Industry Authority and have public protection procedures in place, with public protection measures added for the largest venues. It places these obligations on the responsible person for the premises, who holds accountability for compliance.

Before the Act, guidance on protective security for public venues was advisory, not mandatory. Martyn's Law changes that. Once its requirements commence, expected from 2027, non-compliance can result in compliance notices, financial penalties, and in the event of an incident, significantly increased exposure for the responsible person.

Why It Matters for Schools

Schools are among the most likely venues to fall within Martyn's Law scope. Almost every secondary school in England will be in scope once staff and pupils are counted together, and so will many primaries. Whatever its size, a school sits in the Standard Tier: education settings are never in the Enhanced Tier.

Why It Matters for Public Sector

Councils, NHS trusts, civic halls, libraries, leisure centres and managed public spaces are very often in scope. Premises where 200 or more people, including staff, may reasonably be expected are within scope, and qualifying events such as Christmas markets and civic gatherings are too where 800 or more may be present.

Compliance Tiers

Standard Tier or Enhanced Tier?

Your obligations depend on which tier your venue falls into. Capacity is measured as the maximum number of persons who could reasonably be present at any one time — not just your usual attendance.

Standard Tier
200 to 799 people
Reasonably expected at the same time, including staff
Notify the Security Industry Authority (SIA) that the premises are in scope
Designate a named Responsible Person — a senior employee or officer, documented in writing
Produce written protective procedures covering lockdown, evacuation, shelter-in-place and communication
Ensure all staff who regularly work at the venue are aware of those procedures
Undertake ongoing monitoring to ensure procedures remain effective
Procedures must reflect your actual technical capability — not aspirational processes you cannot execute
Every school in scope falls into the Standard Tier, whatever its capacity, along with most public venues. The Act requires no physical security infrastructure at this tier; the procedures you document should match what your building and systems can actually do.
Enhanced Tier
800 or more people
Reasonably expected at the same time. Never applies to schools
All Standard Tier requirements, plus:
Have public protection measures in place so far as reasonably practicable, covering monitoring, movement of people, physical safety and security of information
Designate a senior individual accountable for compliance (the Act contains no qualified Security Manager requirement)
Document the public protection procedures and measures in place
Provide that document to the Security Industry Authority
Large civic halls, arenas, higher education institutions and other big public venues fall into the Enhanced Tier. Schools, sixth forms and colleges never do: early years, primary, secondary and further education settings remain Standard Tier whatever their size.
Who Is In Scope

The organisations most likely to be affected

If you are uncertain whether your organisation is in scope, our free assessment tool will tell you in under five minutes.

Schools and Academies
Almost all secondary schools and many primaries will be in scope once staff and pupils are counted together. Every school in scope is Standard Tier: education settings are never in the Enhanced Tier, whatever their size.
Multi-Academy Trusts
Every school in a MAT estate is assessed individually against the capacity threshold. A MAT with twenty schools may have twenty compliance obligations to manage — a strong argument for estate-wide security standardisation.
Councils and Civic Buildings
Town halls, civic centres, customer service buildings, council chambers and managed public spaces. Any civic building where 200 or more people, including staff, may reasonably be expected at the same time is in scope.
NHS and Healthcare
Hospitals, health centres, mental health facilities and community health buildings. Healthcare settings carry additional complexity around lone worker protection and patient access management.
Libraries and Community Centres
Public libraries, leisure centres, community halls and arts venues managed by local authorities or community organisations. Often overlooked, but regularly in scope for events even when daily footfall is low.
Temporary and Recurring Events
Christmas markets, civic ceremonies, outdoor festivals and other qualifying events are in scope where 800 or more people may be present. Event-based obligations can apply even when the permanent building does not reach the premises threshold.
What You Need

The six things every in-scope venue must have

For a more detailed checklist including plain-English tests you can apply today, read our article on the 12-point readiness checklist.

01
A named Responsible Person
A senior employee or officer whose name, role and accountability are documented in writing. Cannot be vacant, acting or held by a non-employee.
02
Written protective procedures
A document setting out what staff do in response to a terrorist attack or serious security incident. Must be specific to your site, not a generic template. Must reflect your actual technical capability.
03
A tested lockdown capability
Staff who know the lockdown signal and what to do. Doors that can be locked quickly. A way to communicate with all staff simultaneously. Tested and practised at least once in the previous twelve months.
04
Staff awareness training
Every member of staff regularly on site must be aware of your protective procedures — not just senior leadership. Training must be documented.
05
Controlled and monitored entrance
Not required by the Act, but the measure that makes the required procedures workable: a physical capability to control who enters, visitor identity logging, and CCTV covering public-facing entry and exit points.
06
Governor or board sign-off and annual review
Procedures formally approved at governance level and minuted. Annual review documented. The accountability must sit at the right level, not just with the headteacher or facilities manager.
Free Assessment

Find out where you stand in 5 minutes

Our Martyn's Law Readiness Assessment determines your tier, identifies your compliance gaps, and generates a downloadable report you can take to your governors. No registration.

Run Free Assessment →
Free Site Survey

Get an expert assessment

We visit your site, assess your current security provision against Martyn's Law requirements, and give you a written report. Free, no obligation.

Request a Survey →
Full Checklist

12 things you need in place

Our detailed article covers every physical security requirement with a plain-English test for each one.

Read the Checklist →
How Fyrfly Helps
Free Compliance Assessment
Our free Martyn's Law Readiness Assessment tool determines your tier and generates a personalised compliance report in five minutes. No registration, no obligation.
Free Site Survey
We visit your site, assess your current provision against Martyn's Law requirements, and give you a written report — regardless of whether you proceed with us.
Physical Security Installation
CCTV covering entry and exit points, access control for visitor management, tested lockdown capability, and 24/7 monitoring — the physical infrastructure your procedures need to be based on.
Martyn's Law Compliance Document
A site-specific compliance document produced as part of every installation, confirming how the installed systems address your Standard or Enhanced Tier obligations. Suitable for SIA inspection and governor approval.
Annual Compliance Review
As part of our maintenance contracts, we conduct an annual review of your Martyn's Law compliance position and update your documentation accordingly.
Subcontracting for Compliance Projects
If you have a lead contractor or compliance consultant managing your Martyn's Law programme, we operate as a specialist delivery partner — under your identity, with full documentation.

Martyn's Law is our primary specialism.

We built our free assessment tool, our article library, and our compliance documentation process around Martyn's Law from the outset. It is not a product we adapted from commercial security — it is the reason we built the business the way we did.

Every installation we carry out produces a site-specific Martyn's Law compliance document. Every maintenance contract includes an annual compliance review. Every free site survey assesses your Martyn's Law position as its primary output.

Run Free Compliance Assessment →
Free Tools

Free Martyn's Law resources

All free, no registration required, no data stored.

Martyn's Law Readiness Assessment
Determines your tier, identifies your compliance gaps, and generates a downloadable readiness report in five minutes. Used by headteachers, business managers and facilities directors.
Run Assessment →
Lockdown Procedure Generator
Generates a complete DfE-compliant lockdown procedure as a print-ready PDF. Based on the official Department for Education lockdown template. Suitable for governor approval.
Generate Procedure →
Compliance Checker
Step-by-step compliance assessment against Martyn's Law, DfE guidance, KCSiE and UK GDPR. Identifies gaps and generates a prioritised action plan.
Run Compliance Check →
Further Reading

Martyn's Law articles and guides

Start Now

Do not wait for a commencement date

Procurement, installation and documentation all take time. Schools and public venues that start their compliance programme now have the best chance of being ready when the requirements commence, expected from 2027, without a rushed or inadequate response.