Martyn's Law: A Plain English Guide for UK Hospitality Venues

Chris Brown

04 Feb 2026 — 8 min read

Author: Chris Brown
Published:04/02/2026
Last Updated: 04/02/2026
Reading Time: 10 minutes

On the evening of 22 May 2017, over 14,000 people gathered at Manchester Arena to watch Ariana Grande perform. At 22:31, as families began collecting their children from the foyer, a suicide bomber detonated an improvised explosive device. Twenty-two people were killed. Over a thousand were injured. The youngest victim was eight years old.

One of those killed was Martyn Hett, a 29-year-old from Stockport. He was standing just four metres from the blast.

In the years that followed, Martyn's mother, Figen Murray, channelled her grief into a campaign that would change UK law. She launched a petition in 2019. She met ministers. She was awarded an OBE. In May 2024, she walked 200 miles from the spot where her son died to the door of 10 Downing Street, arriving on the seventh anniversary of his death.

On 3 April 2025, the Terrorism (Protection of Premises) Act received Royal Assent. It is known as Martyn's Law, in tribute to her son.

This article explains what it means for your venue.

What Is Martyn's Law?

Martyn's Law creates a legal duty for certain publicly accessible venues to prepare for and respond to terrorist attacks. It does not assume attacks are likely at your establishment. It requires you to have thought about what you would do if one occurred.

The Manchester Arena Inquiry and the London Bridge Inquests both found that clearer guidance and legal responsibilities could have saved lives. Martyn's Law is the legislative response.

The law applies across the UK and is expected to come into force in April 2027, following a 24-month implementation period. The Security Industry Authority (SIA) will act as the regulator.

Does It Apply to Your Venue?

The law uses a tiered approach based on capacity.

Standard Tier: Venues where it is reasonable to expect between 200 and 799 people to be present at the same time, from time to time.

Enhanced Tier: Venues where it is reasonable to expect 800 or more people to be present at the same time, from time to time.

Out of scope: Venues with a maximum capacity below 200 people.

The capacity figure includes everyone on site: customers, staff, contractors, and visitors. You can calculate it using methods already familiar to you, such as fire safety occupancy limits or historical attendance records.

The legislation covers specific types of premises listed in Schedule 1 of the Act. For hospitality, this includes:

Restaurants, cafes, and other food and drink establishments (where consumption is primarily on the premises)
Pubs and bars
Nightclubs
Hotels
Entertainment venues
Visitor attractions

Beer gardens, hotel grounds used for dining, and other associated outdoor areas count as part of the premises.

If your venue has a capacity of 200 or more and falls within one of these categories, you are in scope.

What Standard Tier Venues Must Do

If your venue falls within the Standard Tier (200 to 799 capacity), the requirements are designed to be simple and low-cost. The Government has been explicit that compliance should not require expensive consultants or specialist products.

1. Register with the Regulator

You must notify the Security Industry Authority that you are responsible for qualifying premises. This will likely involve an online registration process. You must also notify them when you cease to be the responsible person.

2. Appoint a Responsible Person

Every qualifying premises must have a designated Responsible Person. This is the individual or organisation that has control of the premises in connection with its qualifying use. For a pub, this is typically the landlord. For a restaurant, it is usually the owner or operator.

3. Develop Public Protection Procedures

You must put in place procedures that could reasonably be expected to reduce the risk of physical harm to individuals if a terrorist attack occurred at or near your premises. These are commonly referred to as the "four procedures":

Evacuation: How you would move people out of the building quickly and safely
Invacuation: How you would move people to a safer location inside the building if leaving is not safe
Lockdown: How you would secure the premises to prevent a threat from entering
Communication: How you would alert staff and customers, and how you would contact emergency services

These procedures must be appropriate to your premises. What is reasonable for a small restaurant differs from what is reasonable for a large hotel.

4. Train Your Staff

Staff must be aware of the procedures and know what to do. The Government provides free training through ProtectUK, including an online module called Action Counters Terrorism (ACT).

Important: Standard Tier venues are not required to install physical security measures such as CCTV, barriers, or security staff. The focus is on procedural readiness, not infrastructure.

What Enhanced Tier Venues Must Do

If your venue falls within the Enhanced Tier (800 or more capacity), you must meet all the Standard Tier requirements plus additional obligations.

1. Appoint a Designated Senior Individual (DSI)

In addition to the Responsible Person, you must appoint someone with high-level management responsibility, such as a director or partner, to oversee compliance.

2. Implement Public Protection Measures

Beyond procedures, you must put in place measures that could reasonably be expected to reduce the vulnerability of your premises to a terrorist attack. These might include:

Bag search policies
CCTV or other monitoring
Security staff
Vehicle access controls
Physical barriers or protective glazing

What is appropriate depends on your specific circumstances. The legislation uses the phrase "so far as reasonably practicable," a standard borrowed from health and safety law.

3. Document and Submit Your Procedures

You must document your public protection procedures and measures, including an assessment of how they reduce vulnerability and risk. This documentation must be submitted to the SIA.

What Happens If You Do Not Comply?

The SIA will have powers to inspect premises, issue compliance notices, and impose penalties.

For Standard Tier venues:

Fixed penalty: up to £10,000
Daily penalty for continued non-compliance: up to £500 per day

For Enhanced Tier venues:

Fixed penalty: up to £18 million or 5% of worldwide revenue, whichever is higher
Daily penalty for continued non-compliance: up to £50,000 per day

In serious cases, the SIA can issue restriction notices that could temporarily close a venue or prohibit an event from taking place.

Providing false or misleading information to the SIA, or obstructing an inspection, are criminal offences.

Timeline: What Happens When

3 April 2025: The Act received Royal Assent. It is now law, but not yet in force.

April 2025 to April 2027: Implementation period. The SIA will establish its regulatory function. The Home Office will publish statutory guidance. Venues should use this time to prepare.

April 2027 (expected): The Act comes into force. From this date, qualifying premises must comply.

The Government has deliberately built in a two-year runway. There is no requirement to comply until the legislation is activated, but the Home Office encourages venues to begin preparing now.

What the Government Says About Third-Party Services

The Home Office, the SIA, and the National Counter Terrorism Security Office have issued clear guidance on this point:

"Premises and events do not need to spend money on consultants to be compliant with the legislative requirements."

And:

"The Government's intent is that those responsible for premises and events in scope can comply with the Act without needing to buy specialist services."

This is worth noting. The Government has designed the Standard Tier requirements to be achievable without external help. Free resources are available through ProtectUK, including guidance documents, risk assessment templates, and online training.

If someone tells you that you cannot comply without buying their consultancy, training course, or product, that is not what the legislation says.

How to Calculate Your Capacity

The legislation does not prescribe a single method. You can use any reasonable approach, including:

Fire safety occupancy limits
Licensing conditions
Seating or standing capacity assessments
Historical attendance records
Transaction data

If you operate a pub with a fire capacity of 180 but regularly host live music nights that push attendance over 200, you may be in scope. If your hotel conference facility can accommodate 300 delegates, that facility is in scope even if the main hotel is not.

Be realistic. The question is not "what is our maximum ever recorded attendance?" but "is it reasonable to expect that 200 or more people will be present from time to time?"

Practical Steps to Take Now

1. Determine whether you are in scope

Calculate your premises capacity using one of the methods above. If you are below 200, you are not currently required to comply, though good practice still applies. If you are between 200 and 799, you are Standard Tier. If you are 800 or above, you are Enhanced Tier.

2. Identify your Responsible Person

This is the person or organisation with control of the premises. In most cases, it is obvious. In complex arrangements, such as a restaurant within a larger building, you may need to coordinate with the building operator.

3. Review your existing procedures

You likely already have fire evacuation procedures. Martyn's Law requires you to think about three additional scenarios: invacuation (sheltering in place), lockdown (securing the building), and communication (alerting people and contacting authorities).

4. Use the free resources available

ProtectUK provides guidance, templates, and training. The Home Office will publish statutory guidance before the Act comes into force. You do not need to start from scratch.

5. Train your staff

Awareness is the foundation. Staff do not need to become security experts, but they do need to know what to do and where to find the information.

A Note on Why This Matters

It would be easy to treat Martyn's Law as another compliance burden. Another piece of paperwork. Another thing to worry about.

But this law exists because 22 people went to a concert and never came home. Because a mother walked 200 miles to make sure something changed.

The requirements for Standard Tier venues are not onerous. Evacuation procedures. A lockdown plan. Staff who know what to do. These are things that could save lives, not just boxes to tick.

The deadline is April 2027. That feels distant. It is not. Preparing now, while there is time to do it properly, is the responsible approach.

How VenueLinQ Can Help

VenueLinQ is a platform that helps UK hospitality venues manage day-to-day compliance, including under Martyn's Law. It provides:

Procedure templates and a guided wizard to build your evacuation, invacuation, lockdown, and communication plans
Staff acknowledgement tracking that proves your team has read, understood, and signed off on procedures
Incident logging that creates the evidence trail inspectors will ask for
A compliance dashboard that shows you, at a glance, what is complete and what needs attention

The goal is not to sell you something you do not need. The Government is right that Standard Tier compliance can be achieved without buying products. But if you want your procedures documented, your training tracked, and your evidence in one place rather than scattered across folders and filing cabinets, that is what VenueLinQ does.

The founding member programme opens soon. If you would like early access and input into how the platform develops, you can join the waitlist at venuelinq.com.