New statutory obligations for public venues

On Thursday 3^rd April the Terrorism (Protection of Premises) Act 2025 (the “Act”), commonly referred to as “Martyn’s Law”, received Royal Assent. The Act is expected to be implemented within the next 24 months.

The legislation was coined as Martyn’s Law in tribute to Martyn Hett – one of the victims of the Manchester Arena terrorist attack in May 2017.

Martyn’s Law was devised to improve the security and organisational readiness of large venues and/or arenas to be better prepared and protected in the event of terrorist attacks.

Overview

The legislation requires persons responsible for (1) qualifying premises or (2) a qualifying event to take steps to mitigate the risk of or harm caused by a terrorist attack. The persons responsible are those persons who have control of the premises in connection with its use or the event being held at the premises.

If, for example, a festival is to be held on public grounds owned by a local authority and that local authority maintains control of the site for the purposes of the festival then the local authority will be the responsible person for the purposes of the Act (even if the local authority contracted third party organisations to run the security for the festival).

Qualifying premises and qualifying events

A premises will be a ‘qualifying premises’ for the purposes of the Act if:

• The premises consists of at least one building…and…
• That building is wholly or mainly used for one or more uses specified in Schedule 1 of the Act (the list is extensive and includes restaurants, sports grounds, shops as detailed below*) and…
• It is reasonable to expect that at least 200 individuals may be present occasionally…and…
• The building is not an excluded building under Schedule 2 of the Act (see summarised list below**)

Responsible persons of qualifying premises must follow ‘standard duty’ requirements. Owners of qualifying premises where the expected attendance is 800 or more individuals must follow the ‘enhanced duty’ requirements.

An event will be a ‘qualifying event’ for the purposes of the Act, if it satisfies the following criteria:

• The event must take place at qualifying premises
• The qualifying premises must be accessible to the public for the purpose of the event
• It is reasonable to expect at least 800 individuals present
• There will be measures to check entry conditions (e.g. ticket checks)
• The event is not an excluded event (per Schedule 2 Part 2 of the Act)

Standard and enhanced duties

Standard duties obligate the responsible person to:

1. Notify the Security Industry Authority (SIA – the state regulator for private security); and
2. Have in place appropriate public protection procedures.

Public protection procedures are those that should be followed by people working at the premises if an act of terrorism were to occur at the premises, or in the immediate vicinity.

This includes procedures relating to evacuation, invacuation (moving people to a safe place), locking down the premises, and communicating with individuals on the premises.

Guidance suggests that requirements for standard duty premises are centred around low-cost activities – e.g. there is no necessity to put in place physical measures.

Enhanced duties are those that apply in addition to the standard duties. The person responsible for enhanced duties at qualifying events will additionally be required to have in place appropriate public protection measures that could be expected to reduce both:

• The vulnerability of the premises or event to an act of terrorism; and
• The risk of physical harm being caused to individuals if an attack was to occur there or nearby.

Enhanced dutyholders will also need to document the public protection procedures and measures in place, or proposed to be put in place, and provide this document to the SIA.

Where the responsible person is not an individual (e.g. a company or body), they must designate a senior individual with responsibility for ensuring that the responsible person complies with these requirements.

Non-compliance

Penalties for failure to comply with the Act can be severe and reflect the seriousness of the public protection duties the Act seeks to impose on responsible persons.

The regulator (SIA) can issue financial penalties commensurate to the breach, as well as criminal liability with the following offences set out at sections 24 to 26 of the Act: offence of failure to comply with compliance notice or restriction notice, offence of providing false or misleading information, offence committed by a body.

Actions for responsible persons

The core question for owners of commercial freehold and/or leasehold land hosting Qualifying Events will be whether they maintain any degree of ‘control’ over the land whether during events or in the day-to-day running of buildings.

Even if security and/or counterterrorism planning is delegated to other parties, regulators are likely to expect oversight from the legal controller of the premises.

Prior to the Act coming into force, premises owners should take pre-emptive steps to audit their property and land portfolio by:

– Conducting a key assessment to determine whether they retain control of the premises under Martyn’s Law;

– Reviewing existing leases and contractual arrangements for venues and premises that will be caught by the legislation;

– Undertaking risk assessments and plans where required – updating documentation, campus or management policies or site guidance;

– Ensuring any contractual arrangements and operational arrangements are updated and routinely reviewed to ensure statutory compliance.

Considerations

As Martyn’s Law comes into force, landowners and organisations can no longer afford to treat venue security as a discretionary concern. The introduction of legally enforceable duties marks a fundamental shift in how both public and private entities must approach risk management and public safety.

Those with control over relevant premises or events must now assess their exposure, review operational responsibilities, and implement robust compliance frameworks. Our team is well placed to advise clients across the commercial and public sectors on the legal, contractual, and practical implications of the Act — and we strongly encourage early action to ensure readiness, reduce risk, and demonstrate a clear commitment to public safety responsibilities.

Further statutory guidance is expected to be published by the Home Office to outline compliance guidelines.

*Schedule 1 Premises: shops, restaurants, entertainment or leisure centres, sports grounds, libraries museums and galleries, exhibition or conference centres, visitor attractions (tourists/cultural/historic locations), hotels (including hostels and holiday parks), places of worship, hospitals, bus and railways stations, aerodromes, nurseries, schools, universities, public buildings

**Schedule 2 Excluded Premises: parliament buildings, outdoor recreation grounds or open-air premises or places specifically subject to transport security

James Mallery-Nelson is a Senior Associate at Sharpe Pritchard LLP.

This article is for general awareness only and does not constitute legal or professional advice. The law may have changed since this page was first published. If you would like further advice and assistance in relation to any issue raised in this article, please contact us by telephone or email enquiries@sharpepritchard.co.uk.