Martyn's Law, formally the Terrorism (Protection of Premises) Act 2025, received Royal Assent on 3 April 2025. It is named after Martyn Hett, who was killed in the Manchester Arena attack in 2017. Its duties on premises are not in force yet. Government has said there will be an implementation period of at least two years, and the duties are currently expected to apply from around spring 2027. The exact date will be set by regulations, so check gov.uk for the latest.
Which premises are in scope?
The Act applies to premises that the public can access, that are used for certain purposes (including retail, food and drink, entertainment, sport, education, health and many public services) and where 200 or more people are reasonably expected to be present at the same time. There are two tiers:
- Standard tier: premises expecting 200 to 799 people at once.
- Enhanced tier: premises expecting 800 or more, and certain qualifying events.
Early years settings, schools and further education colleges sit in the standard tier whatever their size. Many council buildings, libraries, leisure centres, colleges and larger offices open to the public are likely to be in scope.
What the standard tier asks for
The person responsible for the premises must tell the regulator, the Security Industry Authority (SIA), about the premises and put in place "public protection procedures". These are about what staff would do if an attack happened, and they cover four things:
- Evacuation: getting people out safely.
- Invacuation: bringing people into a safer part of the building.
- Lockdown: securing the premises to stop an attacker getting in.
- Communication: alerting people on site and keeping them informed.
The standard tier doesn't require you to buy equipment or install physical measures. The cost is mainly staff time: thinking the procedures through, writing them down and training people.
What the enhanced tier adds
Enhanced tier premises and events must also put in place measures for monitoring, controlling movement and physical security, document them, and send that document to the SIA. Where the responsible person is a company, a senior individual must be designated as responsible for compliance.
No product does this for you
The Home Office has been clear that no specialist product is needed to comply, and it has warned organisations to be wary of anything sold as a "Martyn's Law compliance solution". The duties are about your own procedures and training. That includes visitor sign-in software, ours included.
Where knowing who's on site helps
None of the procedures mention visitor logs. But every one of them works better when the people running it know who is actually in the building:
- Evacuation: staff can be counted from rotas, but visitors and contractors are the gap. A current list of who has signed in, and not out, lets you check everyone has left.
- Invacuation and lockdown: knowing how many visitors are on site, and who they are, helps you make sure nobody is left in an unsafe area.
- Communication: if your privacy notice covers it, a visitor's mobile number gives you a way to reach someone who has become separated.
A practical readiness checklist
- Work out your expected occupancy and which tier you're likely to be in.
- Read the Home Office statutory guidance and the SIA's material on gov.uk.
- Draft your four public protection procedures and decide who does what.
- Decide how you'll account for visitors and contractors in each scenario.
- Train staff, then test it with a drill.
- Check your visitor privacy notice covers safety and security uses.
An accurate, live picture of who is on your premises is one practical piece of being ready. It isn't the whole of it, and it isn't a certificate of anything. For the day-to-day version of the same problem, read fire evacuation roll call.
This article is general information, not legal advice. Facts are correct as of the date shown. Check gov.uk for the current position.