What does the leisure and hospitality sector need to know?
The Terrorism (Protection of Premises) Act (2025) (also known as Martyn’s Law and previously known as the Protect Duty) became law on 3 April 2025. This means qualifying premises are required to have public protection procedures in place – so far as is reasonably practicable – to reduce the risk of physical harm, if a terror incident occurs at, or near, the premises.
Leisure and hospitality falls under the ‘categories of use’ section; as outlined in Schedule 1 of the Act – (food and drink, entertainment and leisure activities, and visitor attractions). Premises are in scope where it is reasonable to expect 200 or more individuals (including staff) to be present from time to time.
If that threshold is reached consistently (for example, visitors utilising the venue to watch a major music or sporting event), the premises is likely to fall within scope.
Therefore, it is likely that many premises within the leisure and hospitality sector will fall within scope.
What public protection procedures need to be in place?
- Evacuation – safely moving people out of the premises
- Invacuation – moving people into safer areas within the premises
- Lockdown – securing premises to restrict entry or movement
- Communication – alerting people and giving clear safety instructions
These must be tailored to the building’s size, layout, and range of uses, and implemented so far as is reasonably practicable.
The procedures need to be communicated to relevant staff and volunteers and if inspected all qualifying premises will need to show evidence of these procedures – including proof these have been communicated to staff.
What does the leisure and hospitality sector need to do now?
The Act received Royal Assent in April 2025 and the government has said it will publish statutory guidance as early as Spring 2026. Qualifying premises will have a grace period of two years (from April 2025) to implement and demonstrate public protection procedures.
A new regulatory function within the Security Industry Authority (SIA) will oversee compliance, including compliance notices, monetary penalties, and restriction notices.
While qualifying premises await further guidance, they can take the opportunity to prepare now before the Act is enforced.
Steps to prepare:
- Understand how the legislation applies to premises
- Review existing safeguarding and emergency communication plans
- Identify any gaps in documentation, governance or training
- Put in place terrorism specific invacuation, evacuation, lockdown and communication procedures
Who is responsible for qualifying premises?
The responsible person is the individual or legal entity with control of the premises in connection with its principal Schedule 1 use.
Where multiple Schedule 1 uses exist (e.g., food and drink at a visitor attraction), responsibility sits with the person controlling the principal use. ‘Person’ meaning the individual or entity that is legally responsible for running the premises.
The responsible person must notify the SIA when they become responsible for a qualifying premises or event.
Standard and Enhanced Tiers
Leisure and hospitality premises under The Terrorism (Protection of Premises) Act (2025)
The Act creates two levels of duty – standard tier and enhanced tier – based on numbers of individuals expected on the site, at any one time, from time to time:
- Standard tier: 200-799 individuals
- Enhanced tier: 800 or more individuals
Under the Enhanced tier additional requirements include the need for responsible persons to implement appropriate and reasonably practicable measures to:
- Reduce vulnerability to terrorist attacks
- Reduce the risk of physical harm if an attack occurs
A Senior Individual must be formally accountable for compliance, providing strategic oversight.
Measures may include monitoring (e.g. CCTV), movement control (e.g. access management and searches), physical security (e.g. hostile vehicle mitigation, safety glazing), and information security (e.g. protection of sensitive layouts).
A site-specific written record must document the measures in place and the risk-based rationale. It must be kept up to date and provided to the Security Industry Authority within 30 days of any change.
How can PROVA help?
The act recognises that not all sites have the same resources, that is why compliance is based on what is ‘reasonably practicable’ a concept found in Health and Safety legislation.
This is why we’re here; to help you understand what is proportionate in protecting the communities you serve. We provide a simple, cost-effective, defensible, solution that puts you in control.
You receive:
- An assessment of what is reasonably practicable given the nature of your site, your resources and the cost time and effort of putting in place public protection procedures
- An automated plan builder enabling you to simply and quickly build your evac, invac, lockdown and communications plans that are tailored to your site.
- An automated, animated, training function so that your plans can be easily communicated to all relevant staff and volunteers
- A secure overview of all training, drills, and assessments providing the evidence you need, if inspected, to show compliance.
- A single dashboard for oversight and consistency across your estates
- An dynamic platform that automatically updates itself to align with the current terror threat and any changes to the legislation