Terrorism (Protection of Premises) Act 2025

Martyn's Law:
What It Means for Your Building

The Terrorism (Protection of Premises) Act 2025 creates statutory security obligations for thousands of UK schools and public venues. Enforcement begins April 2027. Here is what you need to know and what you need to do.

Enforcement Deadline
1 April 2027
Schools and public venues in scope must be fully compliant by this date or face Security Industry Authority enforcement action.
100+ person capacity threshold for Standard Tier
800+ person capacity for Enhanced Tier
Applies to events as well as permanent buildings
Named Responsible Person required
SIA inspections and penalties from April 2027
Background

What is Martyn's Law?

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025. It is named after Martyn Hett, who was among the 22 people killed in the Manchester Arena attack in May 2017. Martyn's mother, Figen Murray, campaigned for over six years to make the law a reality.

The Act creates statutory obligations for venues and events above a certain capacity to have documented emergency procedures, trained staff, and — for larger venues — proportionate physical security measures. It places these obligations on a named Responsible Person who holds personal accountability for compliance.

Before the Act, guidance on protective security for public venues was advisory, not mandatory. Martyn's Law changes that. From 1 April 2027, non-compliance can result in improvement notices, financial penalties, and in the event of an incident, significantly increased exposure for the Responsible Person.

Why It Matters for Schools

Schools are among the most likely venues to fall within Martyn's Law scope. Almost every secondary school in England will be in scope based on their capacity during the school day. Many primary schools will be in scope during public events, productions, open evenings and lettings — even if their regular daily capacity is below the threshold.

Why It Matters for Public Sector

Councils, NHS trusts, civic halls, libraries, leisure centres and managed public spaces are almost universally in scope. Any managed event or permanent venue admitting 100 or more members of the public — including Christmas markets, civic ceremonies and community gatherings — is within scope, not just the permanent building.

Compliance Tiers

Standard Tier or Enhanced Tier?

Your obligations depend on which tier your venue falls into. Capacity is measured as the maximum number of persons who could reasonably be present at any one time — not just your usual attendance.

Standard Tier
100 to 799 persons
Maximum capacity at any one time, including events
Designate a named Responsible Person — a senior employee or officer, documented in writing
Produce written protective procedures covering lockdown, evacuation, shelter-in-place and communication
Ensure all staff who regularly work at the venue are aware of those procedures
Undertake ongoing monitoring to ensure procedures remain effective
Procedures must reflect your actual technical capability — not aspirational processes you cannot execute
Most primary schools, smaller secondary schools and smaller public venues fall into Standard Tier. The procedures you document must match what your building and systems can actually do.
Enhanced Tier
800 or more persons
Maximum capacity at any one time, including events
All Standard Tier requirements, plus:
Implement proportionate physical security measures appropriate to the premises and its activities
Engage a suitably qualified security professional in developing and reviewing plans
Document a formal security plan reviewed at least annually
Submit documentation to the Security Industry Authority inspectorate
Most large secondary schools, sixth forms, higher education institutions, civic halls and large public venues fall into Enhanced Tier. Physical security investment is a mandatory requirement, not a recommendation.
Who Is In Scope

The organisations most likely to be affected

If you are uncertain whether your organisation is in scope, our free assessment tool will tell you in under five minutes.

Schools and Academies
Almost all secondary schools will be in Standard or Enhanced Tier based on their daily capacity. Primary schools hosting public events, lettings or productions regularly cross the 100-person threshold for those events.
Multi-Academy Trusts
Every school in a MAT estate is assessed individually against the capacity threshold. A MAT with twenty schools may have twenty compliance obligations to manage — a strong argument for estate-wide security standardisation.
Councils and Civic Buildings
Town halls, civic centres, customer service buildings, council chambers and managed public spaces. Any civic building admitting 100+ members of the public — including for managed events — is in scope.
NHS and Healthcare
Hospitals, health centres, mental health facilities and community health buildings. Healthcare settings carry additional complexity around lone worker protection and patient access management.
Libraries and Community Centres
Public libraries, leisure centres, community halls and arts venues managed by local authorities or community organisations. Often overlooked, but regularly in scope for events even when daily footfall is low.
Temporary and Recurring Events
Christmas markets, civic ceremonies, outdoor festivals, open days and any other event admitting 100+ members of the public. Event-based obligations apply even when the permanent building does not reach the threshold.
What You Need

The six things every in-scope venue must have

For a more detailed checklist including plain-English tests you can apply today, read our article on the 12 physical security requirements.

01
A named Responsible Person
A senior employee or officer whose name, role and accountability are documented in writing. Cannot be vacant, acting or held by a non-employee.
02
Written protective procedures
A document setting out what staff do in response to a terrorist attack or serious security incident. Must be specific to your site, not a generic template. Must reflect your actual technical capability.
03
A tested lockdown capability
Staff who know the lockdown signal and what to do. Doors that can be locked quickly. A way to communicate with all staff simultaneously. Tested and practised at least once in the previous twelve months.
04
Staff awareness training
Every member of staff regularly on site must be aware of your protective procedures — not just senior leadership. Training must be documented.
05
Controlled and monitored entrance
A physical capability to control who enters the premises — not just observe. Visitor identity logging. CCTV covering public-facing entry and exit points.
06
Governor or board sign-off and annual review
Procedures formally approved at governance level and minuted. Annual review documented. The accountability must sit at the right level, not just with the headteacher or facilities manager.
Free Assessment

Find out where you stand in 5 minutes

Our Martyn's Law Readiness Assessment determines your tier, identifies your compliance gaps, and generates a downloadable report you can take to your governors. No registration.

Run Free Assessment →
Free Site Survey

Get an expert assessment

We visit your site, assess your current security provision against Martyn's Law requirements, and give you a written report. Free, no obligation.

Request a Survey →
Full Checklist

12 things you need in place

Our detailed article covers every physical security requirement with a plain-English test for each one.

Read the Checklist →
How Fyrfly Helps
Free Compliance Assessment
Our free Martyn's Law Readiness Assessment tool determines your tier and generates a personalised compliance report in five minutes. No registration, no obligation.
Free Site Survey
We visit your site, assess your current provision against Martyn's Law requirements, and give you a written report — regardless of whether you proceed with us.
Physical Security Installation
CCTV covering entry and exit points, access control for visitor management, tested lockdown capability, and 24/7 monitoring — the physical infrastructure your procedures need to be based on.
Martyn's Law Compliance Document
A site-specific compliance document produced as part of every installation, confirming how the installed systems address your Standard or Enhanced Tier obligations. Suitable for SIA inspection and governor approval.
Annual Compliance Review
As part of our maintenance contracts, we conduct an annual review of your Martyn's Law compliance position and update your documentation accordingly.
Subcontracting for Compliance Projects
If you have a lead contractor or compliance consultant managing your Martyn's Law programme, we operate as a specialist delivery partner — under your identity, with full documentation.

Martyn's Law is our primary specialism.

We built our free assessment tool, our article library, and our compliance documentation process around Martyn's Law from the outset. It is not a product we adapted from commercial security — it is the reason we built the business the way we did.

Every installation we carry out produces a site-specific Martyn's Law compliance document. Every maintenance contract includes an annual compliance review. Every free site survey assesses your Martyn's Law position as its primary output.

Run Free Compliance Assessment →
Free Tools

Free Martyn's Law resources

All free, no registration required, no data stored.

Martyn's Law Readiness Assessment
Determines your tier, identifies your compliance gaps, and generates a downloadable readiness report in five minutes. Used by headteachers, business managers and facilities directors.
Run Assessment →
Lockdown Procedure Generator
Generates a complete DfE-compliant lockdown procedure as a print-ready PDF. Based on the official Department for Education lockdown template. Suitable for governor approval.
Generate Procedure →
Compliance Checker
Step-by-step compliance assessment against Martyn's Law, DfE guidance, KCSiE and UK GDPR. Identifies gaps and generates a prioritised action plan.
Run Compliance Check →
Further Reading

Martyn's Law articles and guides

Start Now

Do not leave this until 2027

Procurement, installation and documentation all take time. Schools and public venues that start their compliance programme now have the best chance of meeting the April 2027 deadline without a rushed or inadequate response.