Martyn’s Law Across Sectors
The Terrorism (Protection of Premises) Act applies to a wide range of premises and events where 200 or more people may be present at any one time. Duty holders may need to demonstrate they’ve implemented public protection procedures to reduce the risk of physical harm, in the event of a terrorist attack on their premises.
Do your premises fall within scope?
For premises to fall within scope, they must be wholly or mainly used for one or more of the uses that are set out in Schedule 1 to the Terrorism (Protection of Premises) Act 2025. This means a variety of sectors and premises that fall within these could qualify; from public transport to public health. See below for some of the other categories of use, as set out in Schedule 1 to the Act.
Do your premises fall into these categories of use? If so, you could be within scope.
- health care
- public education
- bus stations, railway stations etc
- aerodromes
- childcare
For the full list of categories of use; as set out in Schedule 1 to the Act, refer to this list.
What do businesses need to know?
The Terrorism (Protection of Premises) Act (2025) (also known as Martyn’s Law and previously known as the Protect Duty) became law on 3 April 2025. This means qualifying businesses are required to have public protection procedures in place – so far as is reasonably practicable – to reduce the risk of physical harm, if a terror incident occurs at, or near, the premises.
If you fall under the ‘categories of use’ section as outlined in Schedule 1 of the Act, premises are in scope where it is reasonable to expect 200 or more individuals (including staff) to be present from time to time.
If that threshold is reached consistently, and/or during peak times for shopping centres and retail sites (for example: Christmas, weekend or sales), even if this is only once a year the premises are likely to fall within scope.
What public protection procedures need to be in place?
- Evacuation – safely moving people out of the premises
- Invacuation – moving people into safer areas within the premises
- Lockdown – securing premises to restrict entry or movement
- Communication – alerting people and giving clear safety instructions
These must be tailored to the premises’s size, layout, and range of uses, and implemented so far as is reasonably practicable.
The procedures need to be communicated to relevant staff and volunteers and if inspected all qualifying premises will need to show evidence of these procedures – including proof these have been communicated to staff.
What do businesses need to do now?
The Act received Royal Assent in April 2025 and the government has said it will publish statutory guidance as early as Spring 2026. Qualifying premises will have a grace period of two years (from April 2025) to implement and demonstrate public protection procedures.
A new regulatory function within the Security Industry Authority (SIA) will oversee compliance, including compliance notices, monetary penalties, and restriction notices.
While qualifying premises await further guidance, they can take the opportunity to prepare now before the Act is enforced.
Steps to prepare:
- Understand how the legislation applies to premises
- Review existing safeguarding and emergency communication plans
- Identify any gaps in documentation, governance or training
- Put in place terrorism specific invacuation, evacuation, lockdown and communication procedures
Who is responsible for qualifying premises?
The responsible person is the individual or legal entity with control of the premises in connection with its principal Schedule 1 use.
Where multiple Schedule 1 uses exist, responsibility sits with the person controlling the principal use. ‘Person’ meaning the individual or entity that is legally responsible for running the premises.
The responsible person must notify the SIA when they become responsible for a qualifying premises or event.
Standard and Enhanced Tiers
The Act creates two levels of duty – standard tier and enhanced tier – based on numbers of individuals expected on the site, at any one time, from time to time:
- Standard tier: 200-799 individuals
- Enhanced tier: 800 or more individuals
Typically, smaller venues are in scope within the Standard tier threshold.
Under the Enhanced tier additional requirements include the need for responsible persons to implement appropriate and reasonably practicable measures to:
- Reduce vulnerability to terrorist attacks
- Reduce the risk of physical harm if an attack occurs
A Senior Individual must be formally accountable for compliance, providing strategic oversight.
Measures may include monitoring (e.g. CCTV), movement control (e.g. access management and searches), physical security (e.g. hostile vehicle mitigation, safety glazing), and information security (e.g. protection of sensitive layouts).
A site-specific written record must document the measures in place and the risk-based rationale. It must be kept up to date and provided to the Security Industry Authority within 30 days of any change.
How can PROVA help?
PROVA Risk provides a single, scalable platform for compliance under the Terrorism (Protection of Premises) Act – regardless of sector, size, or complexity.
The platform guides users step by step through the Reasonably Practicable Test, automatically generates site-specific plans, and stores the audit evidence needed to demonstrate compliance.
For multi-site operators, we deliver portfolio oversight, ensuring consistent, defensible standards across diverse locations – from offices and entertainment venues to transport, healthcare, and manufacturing facilities.
The platform is dynamic, adapting as threats evolve and legislation changes – helping organisations stay safe, compliant, and audit-ready without the cost or complexity of traditional consultant-led approaches.
The act recognises that not all sites have the same resources, that is why compliance is based on what is ‘reasonably practicable’ a concept found in Health and Safety legislation.
This is why we’re here; to help you understand what is proportionate in protecting the communities you serve.
We provide a simple, cost-effective, defensible, solution that puts you in control.
You receive:
- An assessment of what is reasonably practicable given the nature of your site, your resources and the cost time and effort of putting in place public protection procedures
- An automated plan builder enabling you to simply and quickly build your evac, invac, lockdown and communications plans that are tailored to your site
- An automated, animated, training function so that your plans can be easily communicated to all relevant staff and volunteers
- A secure overview of all training, drills, and assessments providing the evidence you need, if inspected, to show compliance
- A single dashboard for oversight and consistency across your estates
- An dynamic platform that automatically updates itself to align with the current terror threat and any changes to the legislation