Terrorism (Protection of Premises) Act 2025

The Terrorism (Protection of Premises) Act (also known as ‘Martyn’s Law’) received Royal Assent on 3 April 2025. However, the government has announced that it intends for there to be an implementation period of at least 24 months before the Act comes into force. This is to allow time for those responsible for premises and events caught by the legislation to ‘plan and prepare appropriately’ and for the Security Industry Authority (SIA) to establish its new regulatory function in relation to the Act.

The government states that the Act delivers on its manifesto commitment to ‘strengthen the security of public premises and events’. In this article we take a look at the details of the Act.

Explanatory notes and several government factsheets accompany the Act and these highlight that the aim of the Act is ‘to improve protective security and organisational preparedness across the UK by requiring that those responsible for certain premises and events consider how they would respond to a terrorist attack’. At certain larger premises and events, appropriate steps to reduce vulnerability to terrorist attacks must also be considered. The SIA will take on a new regulatory function to ensure compliance with the new regime and provide advice. There are a range of penalties and criminal sanctions included in the legislation for a failure to comply.

The government also notes that whilst ‘those that fall within scope of the Act may wish to begin considering the requirements, they should note that guidance will be published in due course. This guidance will assist in understanding the requirements set out in the legislation. The guidance is being designed to be easy to follow, needing neither particular expertise nor the use of third-party products or services’.

What does the Act do?

Once in force the Act will require persons responsible for ‘qualifying premises’ or a ‘qualifying event’ to take steps to reduce:

• the risk of physical harm to individuals arising from acts of terrorism, and
• for larger qualifying premises and all qualifying events, their vulnerability to acts of terrorism.

When will it apply?

Premises will be ‘qualifying premises’ and caught by the Act if:

• The premises consist of:

  • a building;
  • or a building and other land.

  A "building" will include part of a building or a group of buildings.

  In relation to ‘part of a building’ the government gives an example of a large factory with a shop. The guidance notes private workspaces are not in scope but states the shop as part of the building may be in scope if it meets the ‘qualifying premises’ criteria.

• The premises are wholly or mainly used for one or more uses specified in the Act. Uses include, where the use is principally for visiting members of the public - retail, food and drink for consumption on the premises; entertainment and leisure activities, halls including conference centres and venues for hire for events, libraries, museums and galleries. The Act also covers premises used for visitor attractions, hotels, hostels and holiday parks, bus stations and railway stations, certain sports grounds, healthcare settings, and various educational settings – the Act contains further details on all uses). The government has noted there will also be further guidance published to help determine the principal use where the property has more than one use.

• It is reasonable to expect that from time to time, 200 or more individuals may be present on the premises at the same time in connection with one or more of the specified uses. A factsheet has been issued with guidance on how this figure is to be calculated.

• The premises are not ‘excluded premises’. Excluded premises include parliaments and devolved governments. There are also exclusions, subject to conditions, for certain parks, gardens, sports grounds and other open air premises used for recreation, exercise or leisure. Specified transport settings which are already subject to existing legislative requirements such as airports are also excluded.

Under the Act ‘qualifying premises’ are then either treated as:

• enhanced duty premises if it is reasonable to expect that from time to time 800 or more individuals may be present on the premises at the same time in connection with one or more of the specified uses; or
• standard duty premises in other cases or they are specifically designated as such under the Act.

This is an important distinction as there are additional requirements on those responsible for ‘enhanced duty premises’.

Additional requirements will also apply to those responsible for ‘qualifying events’. An event will be a qualifying event if:

• The premises where the event is held are not enhanced duty premises and do not form part of enhanced duty premises. For example on open land or within a building which is not already covered by the Act.
• Members of the public will have access to the premises for the purpose of attending the event.
• It is reasonable to expect that at some point during the event 800 or more individuals may be present on the premises at the same time in connection with their use for the event.
• Measures will be in place to secure or check that members of the public who wish to access the premises for the purpose of attending the event
  • have paid to do so,
  • have tickets or passes allowing access, or
  • are members or guests of a club, association or similar body, and
• The event is not an excluded event under the Act.

The factsheet on events notes that a qualifying event could occur within standard duty premises (an example is given of a pub which is usually a standard duty premises but hosts a one off event with over 800 attendees).

Examples are also given of what would constitute a ‘qualifying event’ these include a ‘music event that takes place in a park or field. The event is open to the public and will have over 800 individuals attending. Attendees must purchase a ticket in advance of the event, and staff will be checking that attendees have a ticket before they enter the event’.

What does the Act require?

The ‘responsible person’ must ensure that, in relation to qualifying premises or a qualifying event, so far as is reasonably practicable’ appropriate ‘public protection procedures’ are in place to reduce the risk of physical harm to individuals in the event of a terrorist attack. The accompanying fact sheet notes that four types of procedures that must be put on place are processes for evacuation, invacuation (bringing people into the premises or moving them to a safe part of the premises), lockdown and communication. Further government guidance will be provided.

In relation to enhanced duty premises and qualifying events, in addition to the above, the responsible person must also put in place ‘public protection measures’. The aim of these measures is to reduce the vulnerability of the premises or event to acts of terrorism and reduce the risk of physical harm being caused to individuals in the event of an attack. This will cover measures such as monitoring the premises, physical barriers, searching individuals and bags and considering what and how information is shared and with whom it is shared. Again the government notes it will provide comprehensive guidance. In relation to enhanced duty premises or qualifying events there will be obligations to document the procedures and measures in place and provide a copy to the SIA.

Who is the responsible person?

Unless specific provision is made in the Act, a person will be responsible for qualifying premises if the person has control of the premises in connection with the relevant use. The factsheet on the responsible person notes that this will usually be the premises operator.

In relation to qualifying events the responsible person will be the person who is in control of the premises at which the event is to be held in connection with their use for that event.

If a responsible person is not an individual then that entity must designate a senior individual (who is concerned with its management or control) who is responsible for ensuring compliance.

A person who becomes or ceases to be a responsible person will be required to notify the SIA.

A requirement to co-ordinate…

Where more than one person (including a company or organisation) is responsible for qualifying premises or a qualifying event the Act places a duty on those responsible persons to so far as reasonably practicable co-ordinate with each other in complying with the Act.

Equally, if qualifying premises form part of other qualifying premises there is again an obligation to co-ordinate in complying with the Act’s requirements. The example given in the guidance is a department store within a shopping centre the guidance notes that ‘the department store and the shopping centre must, as far as reasonably practicable, co-ordinate to ensure that they are individually, and cumulatively, compliant’.

and co-operate…

Obligations are also imposed on those who are not responsible for enhanced duty premises or a qualifying event but ‘have control to any other extent of the premises or the premises at which the event is to be held’. This may impact landlords of enhanced duty premises or spaces used for a qualifying event. The government factsheet provides examples where a responsible person is a leaseholder they may need to seek permission from the landlord for changes it wishes to make to the premises to comply with the Act.

First-Tier Tribunal

The First-Tier tribunal has jurisdiction to determine various matters under the Act. For example whether premises are qualifying premises, whether they are enhanced duty premises, whether an event is a qualifying event or what the relevant use of the premises is.

The Regulator and enforcement

The SIA will be the regulator in relation to the Act.

The Act places obligations on the SIA to prepare guidance about how it proposes to exercise its functions, to provide advice and guidance about the Acts requirements and to keep the effectiveness of the requirements under review. The Act gives the SIA various investigatory powers.

The Act gives the SIA the ability to serve various enforcement notices. This includes the option to serve a penalty notice. Where this relates to enhanced duty premises or a qualifying event the maximum amount for a non-compliance penalty is set at the greater of £18 million or 5% of the person's qualifying worldwide revenue for the person's most recent complete accounting period. Daily penalties are also applicable for contravention of certain notices.

There are also various criminal sanctions in relation to the Act.