Terrorism (Protection of Premises) Act 2025
Martyn's Law, in plain English
If your premises can hold 200 people or more, you almost certainly have new statutory duties. This page explains what they are, which tier you fall into, and what you will need to be able to show.
Where it came from
The Act is named for Martyn Hett, who was killed in the Manchester Arena attack in 2017. It received Royal Assent in April 2025, and the statutory guidance was published in April 2026. Enforcement is expected from spring 2027, and the implementation period exists so premises can get ready — not so they can wait.
Who is in scope
The Act works on reasonably expected capacity — how many people could be present, not how many usually are. That catches a lot of organisations who do not think of themselves as venues: village halls, churches, sports clubs, visitor attractions, larger shops, places of education and worship.
Standard tier — 200 to 799
Roughly 155,000 premises. You must have public protection procedures: what people do in an evacuation, an invacuation, a lockdown, and how you communicate. Procedures, awareness and record-keeping — not physical works.
Enhanced tier — 800+
Roughly 25,000 premises. Everything above, plus public protection measures — reducing vulnerability and the risk of physical harm — a documented assessment, a designated responsible person, and notification to the regulator.
What you will actually be asked for
Enforcement will not be a conversation about intent. It will be a request to see things, and the organisations that struggle will be the ones who did the work and cannot produce the evidence:
- Your procedures, in a version you approved — with a date, an author and a named approver, not a Word file called procedures-FINAL-v3-actual.docx.
- That your people know them. Who was told, when, and what they confirmed they had read — including casual and agency staff who were on shift last summer.
- That you rehearse. Drill dates, who took part, what went wrong and what you did about it.
- That findings get closed. Raised, owned, dated, done — and checked by somebody other than the person who did it.
- For enhanced tier: the assessment and the measures, and that the regulator was notified.
How DutyHub handles it
You answer a short set of questions about the premises. DutyHub works out your tier, seeds the duties that actually apply to you, and gives you the four procedure templates to adapt and approve. Staff get a link — no account — to read and confirm. Drills and reviews carry their own dates and chase themselves. When an inspector asks, the evidence pack is one click, with an index and a manifest of exactly which versions it contained.
Fire safety runs on the same machinery and the same register, which is why most premises take both together: the drills, the procedures and the staff records overlap almost completely.
An honest note about what this is
DutyHub is record-keeping and process management. It does not make your premises compliant and it is not endorsed by the Home Office, the SIA or any regulator. What it does is make sure the things you are required to do have been done, are in date, and can be produced.