An introduction to Martyn’s Law

Thanks to the subsequent campaigning by the victims’ families, led by Figen Murray, the mother of Martyn Hett, one of the victims, the government has set out details of a new Protect Duty – which will now be known as Martyn’s Law in tribute to her son.

In May 2023, the government published the Terrorism (Protection of Premises) Draft Bill for pre-legislative scrutiny. Between February and March 2024, the government carried out a consultation process on the Bill and was in the process of reviewing the results when the general election was called in May 2024.

What is in the Bill?

The Bill imposes requirements in relation to certain premises and events to increase their preparedness for, and protection from, a terrorist attack by requiring them to take proportionate steps, depending on the size and nature of the activities that take place at the premises. This is known as the Protect Duty.

This is not a new piece of health and safety legislation, but will sit beside other duties owed by occupiers of premises under health and safety, fire safety and building safety regulation as well as sector specific requirements for security and safety as for example in educational establishments.

Who will be in scope? 

To be in scope:

  • Premises and events must be accessible to the public.
  • Premises must be used for a purpose listed in the Bill (e.g. entertainment and leisure, retail, food and drink).
  • Premises must have a capacity of 100 or more individuals.
  • Premises may be a building or outdoor location which has an identifiable physical boundary and access by express permission – for example, farms with ticketed access, fields where festivals are held, and even community sports grounds.

Provision is made in the Bill for temporary events such as festivals that have express permission to enter and a capacity of 800 or more individuals.

The types of duty

We mentioned a Protect Duty earlier, and there are two types of duty, a Standard Duty and an Enhanced Duty, depending on the size of the business.

The Standard Tier

  • Premises with a maximum capacity of 100-799 individuals, e.g. many retail stores, village halls, bars, restaurants and theatres

The standard tier is estimated to cover approximately 280,000 premises with retail and hospitality making up 65% of that number, places of worship 16% and schools 11%.

It is expected places of worship will always be Standard Tier irrespective of size (unless a fee is charged for entry) as will premises used for childcare, primary and secondary education (but not higher education as universities tend to have more publicly accessible areas).

Standard tier businesses are required to notify the regulator (see below) of their responsibility. They must have in place procedural measures to reduce so far as reasonably practicable, the risk of physical harm to individuals at the premises in the event of an attack.

However, the consultation concluded by the government in March 2024 referred to above suggests that the duties imposed on standard tier premises will be less onerous than for enhanced tier businesses:

  • there will be no duty to undertake a detailed terrorism evaluation assessment
  • there will be no requirement to ensure that staff receive specific training .

However, the government does expect that all staff be instructed and be aware of the required procedural measures.

The Enhanced Tier:  

  • Premises with a capacity of 800 or more individuals, e.g. large shopping centres, concert halls and sports stadiums.

The enhanced tier also includes certain temporary events with equivalent capacity, such as festivals.

Requirements for enhanced tier are more significant as naturally the risk is greater. Those responsible for Enhanced Tier premises must have security measures in place to mitigate the risk of a terror attack occurring and to protect – as far as reasonably practicable – from any physical harm. This may mean the installation of physical security measures if considered reasonable when assessing the risk.

All Enhanced Tier businesses are expected to have in place:

  1. Risk Assessment Process
  2. A Security Plan – reasonably practicable mitigating security measures (that are recorded and auditable) for example, exterior lighting controls, security and search procedures or screening.

They will also need to complete a structured terrorism risk evaluation document.

Calculating capacity   

Businesses will be required to accurately calculate capacity. The Government will produce a capacity calculator and venues will also be expected to use ticketing to establish – or restrict – capacity.

Issues relating to village halls  

Concern has been raised as to what the measures in the Bill mean for village halls and the village fete. These premises are often run by volunteers who don’t necessarily have the knowledge to put strategies in place for a terror attack. This formed part of the recent second consultation, although the outcome of that consultation is yet to be published. The government recognises that this issue has to be addressed before the legislation gains royal assent.

How far does the risk assessment extend?

The assessment of risk not only expects a review of your own business but also consideration of possible attacks on sites in the immediate vicinity, and how it might affect your business.

Businesses should therefore look at neighbouring premises and whether they are a greater target. They should consider co-ordination with neighbouring businesses, possibly via messaging platforms or other channels.


A list of obligations is laid out in the Bill, with certain requirements for certain businesses.

Registration: the responsible person must notify the regulator of any qualifying public premises or qualifying event.

Evaluation and assessment of terrorism risk: in standard duty cases, the responsible person must complete a standard terrorism assessment and periodically revise it. Enhanced duty cases must complete a fuller terrorism risk assessment and qualifying events must complete this three months before the event, or as soon as reasonably practicable.

The responsible person should ensure all workers are properly trained and there should be a designated senior officer who is responsible for the co-ordination of risk assessments and preparation of security plans. Security plans should also be passed to the regulator.

Co-operation: where the requirements mean co-operation with a third party, the Bill would provide a mechanism to serve a co-operation notice.

What enforcement measures could we expect to see? 

The Regulator

The Bill creates a new regulator (not yet announced) with the power:

  • to investigate or enforce;
  • appoint inspectors;
  • require the provision of information by notice;
  • apply for a warrant to enter premises, or enter without a warrant on at least 72 hours’ notice.

Enforcement: Notices and Restrictions  

  • Contravention notices can be issued; these can include a requirement to rectify the contravention
  • The regulator could restrict a qualifying event or use of an enhanced duty venue if there are reasonable grounds for believing there is a contravention and that it was necessary to protect the public from terrorism

Monetary penalties  

  • The regulator can issue a penalty notice to someone who has failed to meet the requirement imposed by the Bill.
  • The maximum amount for standard duty premises would be £10,000. The maximum for an enhanced duty premises or qualifying event would be £18 million or 5% of worldwide revenue, whichever was greater.

Criminal Offence  

The Bill creates new criminal offences of:

  • failing to comply with a contravention or restriction notice (for enhanced tier only)
  • providing false or misleading information to the regulator in relation to a requirement imposed by the Bill
  • certain office holders could be held personally liable if the offence was committed with their consent or connivance, or was attributable to their negligence


  • Imprisonment for a term not exceeding the general limit in a Magistrates’ Court or a fine (or both); 6 months/ unlimited fine at present

However, as can be imagined, questions still remain.

  • Exactly what amounts to ‘measures that could be expected to reduce, insofar as reasonably practicable, the risk of physical harm to individuals at the premises in the event of an attack’?
  • Who will carry out risk assessments?
  • Is specialist assessment of the potential for attack needed?
  • How do new obligations interact with existing obligations under health & safety law?

The government makes it clear that the regulator will be expected to issue guidance to assist in compliance.

There will be 18-24 months between royal assent (expected this year, although see below) and implementation of the legislation to allow for planning and preparedness.  We expect guidance to be issued to clarify the scope of duties.

When to start? 

In short, now. Businesses should start to build their Protect Duty into existing regulatory compliance plans and risk assessments, policies and procedures without delay.

What does the election mean for the Bill?

Although the Bill was not passed before the announcement of the general election and the dissolution of Parliament, the leaders of both main parties have committed to doing so following the election, although the summer recess may delay matters. What is almost certain is that the Bill will be passed this year, and so businesses should prepare for its introduction.