Martyn's Law: What It Means for Venues and What You Should Be Doing Now

The Terrorism (Protection of Premises) Act 2025 — known as Martyn's Law after Martyn Hett, who was killed in the Manchester Arena attack in 2017 — received Royal Assent on 3 April 2025. After years of campaigning by Figen Murray and extensive parliamentary debate, the legislation is now real. Most venues that host members of the public will be required to comply within an 18-month implementation period from the date the statutory guidance is published.

This article is written for venue operators, facilities managers, and business owners who need to understand what the law actually requires of them — without the scaremongering that has accompanied some of the commentary on this legislation.

Who does it apply to?

The Act creates two tiers based on venue capacity. Standard duty applies to premises with a capacity of 200 or more people. Enhanced duty applies to premises with a capacity of 800 or more. There is also a separate tier for public events held at locations not normally used as venues — a street festival or outdoor market, for instance.

Standard duty venues must complete a terrorism evaluation of their premises and put in place reasonably practicable public protection procedures — what the legislation calls 'Martyn's Law procedures.' These cover how you would alert people to a terrorist attack, how you would lock down or evacuate the premises, and how you would communicate with emergency services.

Enhanced duty venues face more extensive requirements. In addition to the above, they must assess terrorism risks, develop a security plan, and implement appropriate security measures. This is where physical security — CCTV, access control, perimeter protection — becomes directly relevant to compliance.

What counts as a 'qualifying premises'?

The legislation covers premises used for a range of purposes, including retail, entertainment and leisure, hospitality, places of worship, education, healthcare, and public transport. If your premises are used by members of the public and can hold 200 or more people in the course of their normal operation, you are likely to be in scope.

Capacity is calculated based on the maximum number of people that can reasonably be present at any one time — not just ticketed or seated capacity. A standing venue or a shopping centre concourse will be assessed differently to a theatre with fixed seating. The regulator (the Security Industry Authority will oversee compliance) will publish guidance on how capacity is to be calculated.

What does a proportionate security response look like?

The legislation deliberately avoids being prescriptive about specific technology. It requires proportionate measures, not a particular brand of camera or access control system. What is proportionate for a 250-capacity music venue in Coventry will be different to what is expected of a 2,000-capacity arena.

For most standard duty venues, a proportionate response will involve reviewing your existing CCTV coverage to ensure you can monitor your entrance areas, identify individuals of concern, and provide footage to police if required. It will involve having a clear documented procedure for lockdown and evacuation, and ensuring relevant staff are trained to act on it. It will involve knowing how to contact the police quickly and communicate with them about a developing situation.

For enhanced duty venues, the expectation is higher. A formal security plan, a named responsible person, regular review of the plan, and physical security measures that address the specific risks of the site and the activities taking place there. This is closer to the kind of security planning that large venues and event operators already carry out — Martyn's Law formalises and extends that expectation.

CCTV and access control under Martyn's Law

Neither the Act nor the draft guidance specifies that premises must have CCTV. But CCTV is the most practical tool available for the monitoring requirements that the legislation implies — keeping an eye on entry points, identifying unusual behaviour, and providing a record that can assist a response or investigation. For any venue that does not currently have CCTV, this is a good moment to address that.

Access control is particularly relevant for enhanced duty venues. The ability to lock down specific entry points quickly, to restrict access to backstage or back-of-house areas, and to issue time-limited credentials to contractors and event staff — these are all capabilities that a modern access control system provides and that contribute directly to the security plan that enhanced duty venues must maintain.

For venues that already have CCTV and access control, the immediate action is to review coverage and ensure it is fit for purpose. Cameras should cover all entry and exit points. Access control should be operational on all doors that are not intended to be publicly accessible. Event logs should be retained for a reasonable period — we would suggest a minimum of 30 days, though your legal adviser may suggest longer given the evidential context of terrorism investigations.

What to do before the implementation deadline

The 18-month implementation period has not yet started — it begins when the statutory guidance is published, which is expected later in 2025. But that does not mean there is nothing to do now. Venues that are in scope should start with a gap analysis: what do you currently have in place, what does the legislation require, and what is the gap between the two.

We carry out free security surveys for commercial venues across Coventry and the Midlands. A survey will give you a clear picture of your current CCTV and access control provision, identify coverage gaps, and help you put together a specification for any work required before the implementation deadline. Getting a survey done now means you have time to plan and budget properly, rather than rushing to comply at the last minute.

Martyn's Law is not going away and the penalties for non-compliance once the implementation period has passed will be significant. The right time to start thinking about it is before those penalties apply.