The Terrorism (Protection of Premises) Act 2025 — known as Martyn’s Law — received Royal Assent on 3 April 2025. It’s named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017. His mother, Figen Murray, campaigned for years to make it law.
It’s now on the books. Full implementation is expected in Spring 2027, which gives venues roughly two years to get ready. That window sounds generous. It isn’t. The groundwork — procedures, documentation, staff training, and audit evidence — takes time to build properly.
This post explains what the law requires, who it applies to, and how TPR Max can help you get compliant without adding a mountain of admin.
Who does it apply to?
Any publicly accessible premises where 200 or more people can reasonably be expected to be present at the same time falls within scope. That covers a wide range of venues: hospitality and retail spaces, entertainment and leisure venues, places of worship, healthcare settings, education campuses, transport hubs, and community event spaces.
The law splits those venues into two tiers.
Standard tier covers venues with a capacity of 200 to 799 people. Requirements here are focused on having appropriate procedures in place — for evacuation, invacuation (sheltering in place), and lockdown — and ensuring staff know what to do. No significant physical measures are required. You do need to register with the Security Industry Authority (SIA).
Enhanced tier covers venues with a capacity of 800 or more. On top of everything in the standard tier, enhanced venues must document their procedures formally and submit that documentation to the SIA. They also need to appoint a designated senior individual who takes responsibility for security. Physical protective measures — things like CCTV, bag search policies, and access control — may be required where they’re reasonably practicable.
If you’re uncertain which tier you fall into, the SIA will provide guidance. But if your venue regularly holds more than 200 people, you should be planning now.
What does compliance actually look like?
There’s no single checklist that covers every venue — the legislation uses “so far as reasonably practicable” throughout, which gives some flexibility. But the core obligations are clear.
You need documented procedures for what happens when there’s an attack or a threat. That means evacuation routes, lockdown protocols, and invacuation plans. You need to know who is responsible for making decisions in an emergency. You need staff to have received appropriate training — including Run, Hide, Tell awareness. And you need to be able to demonstrate all of this to a regulator if they come asking.
For enhanced tier venues, there’s an additional layer: physical measures appropriate to your premises and the risks you face. Visitor management and access control sit firmly in this category. If you can’t account for who is on your site during an incident, you have a problem — both practically and on paper.
The SIA has published statutory guidance as of April 2026, and enforcement will follow once the Act comes into full force. Non-compliance can result in compliance notices, financial penalties, and restriction notices. The reputational damage of being found unprepared after an incident is harder to quantify, but equally real.
How TPR Max helps
TPR Max was built for organisations that take site safety seriously. The platform already handles visitor management, contractor compliance, and emergency mustering — all of which map directly onto Martyn’s Law obligations. We’ve also built a dedicated Martyn’s Law compliance module into the platform.
Here’s what that looks like in practice.
Terrorism preparedness checklist. A structured checklist built specifically for the Protect Duty, covering the key requirements venues in scope need to demonstrate. It gives you a clear view of where you are and what still needs attention.
Evacuation and lockdown procedure documentation. Store your procedures inside TPR Max so they’re accessible, dated, and auditable. No more hunting through shared drives for the right version of a document before a drill — or worse, before an incident.
Designated Security Supervisor tracking. Record who holds the responsible role, when their appointment was made, and any associated documentation. For enhanced tier venues, this is a specific legal requirement.
SIA provider records. Log your contracted security providers and keep their details up to date in one place. Useful for audits and for your own operational records.
Run, Hide, Tell staff training tracker. Log which staff members have completed terrorism awareness training, when they completed it, and when it’s due for renewal. If the SIA asks for evidence of your training programme, you can produce it immediately.
Evidence log for compliance audits. A central record of your compliance activity — what’s been done, when, and by whom. Built for the moment someone external asks to see your paperwork.
And beyond the Martyn’s Law module specifically, TPR Max gives you things that matter just as much in practice. The emergency mustering system tells you in real time who is on your site and whether they’ve been accounted for — critical the moment an alarm goes off. The visitor and contractor management system means you know who entered your building, when, and why. The access control integration means you can lock down a site quickly when it matters.
These aren’t bolt-ons. They’re the core of what TPR Max does.
The sensible approach is to start now
Spring 2027 feels like a long way off. It isn’t, once you factor in the time it takes to get procedures written, reviewed, and signed off — and to get staff trained and documented. Venues that leave it until 2026 will be in a rush. Venues that leave it until 2027 will be non-compliant.
TPR Max comes with a 14-day free trial, no card required. You can have the Martyn’s Law module up and running within the same day you sign up.
If you want to understand whether your venue is in scope and what you’d need to do, we’re happy to talk through it. Get in touch at info@acsltd.eu or start your free trial at tprmax.com.
ACS Safety & Security Ltd supplies access control, CCTV, and TPR Max — a cloud-based platform for visitor, contractor, and staff management. For more information about Martyn’s Law, visit ProtectUK at protectuk.police.uk/martyns-law.