Martyn's Law is the Terrorism (Protection of Premises) Act 2025. It places duties on those responsible for certain publicly accessible premises to prepare for the possibility of a terrorist attack. It works on two tiers set by how many people may be present at the same time: a standard tier for premises where 200 to 799 individuals may be present, and an enhanced tier for premises where 800 or more may be present. The regulator is the Security Industry Authority.
This guide explains who is in scope, what each tier actually requires, and, because we are a security systems installer, where physical security equipment does and does not fit into the picture. That last point matters more than it might seem: for most premises that fall in scope, Martyn's Law does not require you to buy anything at all.
Where the Law Stands Right Now
The Act received Royal Assent on 3 April 2025. The Government published statutory guidance in April 2026, and further provisions have been commenced since, including those that set up the Security Industry Authority's role as regulator.
The duties on premises are not yet in force, and no date has been announced for when they will be. The Government has committed to an implementation period of at least 24 months following Royal Assent before the requirements for those in scope come into force, and the statutory guidance says that further details will be provided on commencement.
This is worth being precise about, because various dates are circulating. You may have seen a specific deadline quoted. At the time of writing, no such deadline exists in law. What exists is a commitment to a minimum implementation period and a clear signal that enforcement will not begin before 2027. The sensible reading is that there is time to prepare properly, and that you should not treat any date you have seen as a statutory cut-off, nor let a supplier use one to create urgency.
Is Your Premises in Scope?
Two things have to be true for the Act to apply. First, the premises must be used for one of a defined list of qualifying uses set out in the legislation, which covers a broad range of publicly accessible buildings. Second, it must be reasonable to expect that a threshold number of individuals may be present at the same time, from time to time.
- Fewer than 200 individuals: not in scope. No duties apply under the Act.
- 200 to 799 individuals: standard tier.
- 800 or more individuals: enhanced tier.
There is an important exception. Places of worship, childcare premises, and certain educational premises remain in the standard tier even where 800 or more individuals may be present. A parish hall or a school does not move into the enhanced tier simply because of its capacity.
The capacity figure is about how many people may be present, not how many are usually there on a quiet Tuesday. If you are unsure whether your use is on the qualifying list, or how to arrive at a defensible capacity figure, the statutory guidance is the place to start. That determination is yours to make, and it is not something a security installer can make for you.
Standard Tier: 200 to 799 Individuals
If your premises falls into the standard tier, the responsible person has two duties.
- Notify the Security Industry Authority that you are the responsible person for the premises.
- Put appropriate public protection procedures in place, so far as is reasonably practicable.
The procedures are expected to address four things, as appropriate to the premises:
- Evacuation: getting people out of the premises.
- Invacuation: moving people to a safer place within the premises, which is sometimes the right answer when the threat is outside.
- Lockdown: securing the premises to restrict entry, such as locking doors and closing shutters.
- Communication: alerting people on the premises to the danger and telling them what to do.
There is no requirement at standard tier to install security equipment. The statutory guidance describes the standard tier requirements as centred on simple, low-cost activities, with the cost relating primarily to time spent rather than to capital expenditure. This is a planning and staff-awareness exercise. If a supplier tells you that standard tier compliance requires a new system, that is a sales position rather than a statement of the law.
Enhanced Tier: 800 or More Individuals
Enhanced tier premises must do everything the standard tier requires, and then three things more.
- Put appropriate public protection measures in place, so far as is reasonably practicable. Where procedures are about what people do, measures are about what is in place at the premises to reduce its vulnerability to an attack and the risk of physical harm if one occurs.
- Document the procedures and measures and provide that documentation to the Security Industry Authority, including an assessment of how they reduce vulnerability and risk.
- Designate a senior individual, where the responsible person is an organisation, to ensure compliance.
The Four Categories of Public Protection Measure
The statutory guidance groups measures into four categories. This is the part of the Act where physical security systems become relevant, so it is worth setting out clearly.
| Category | What it addresses | Examples given in the guidance |
|---|---|---|
| Monitoring | Detecting suspicious activity in and around the premises | Security patrols, searches of individuals, CCTV |
| Movement control | Controlling who can move into and around the premises | Doors, shutters, zoned access, screening of individuals |
| Physical safety and security | Reducing physical harm to people at the premises | Vehicle security barriers and other hostile vehicle mitigation |
| Information security | Restricting access to operational and design information | Limiting who can see plans and operational detail that would assist an attacker |
Everything in the Act is qualified by what is reasonably practicable. That means proportionate: balancing how effective a measure would be against its cost and the difficulty of putting it in place. It is not a requirement to install the maximum amount of equipment that money can buy, and a small enhanced tier venue is not expected to adopt the same measures as a major stadium.
Where Physical Security Systems Actually Fit
Of the four categories, two involve equipment of the kind a security systems installer provides. Monitoring names CCTV. Movement control names doors, shutters and zoned access, which in practice means access control, door entry and electronic locking. The other two categories are largely about site design, traffic management and information handling, and they are not our field.
Three things are worth understanding before anyone spends money.
Equipment alone does not discharge the duty. The duty is to have appropriate procedures, and at enhanced tier appropriate measures, assessed as suitable for that specific premises and documented. A camera that nobody is monitoring, and that appears in no procedure, does not help you and will not satisfy the regulator. The procedures come first and the equipment supports them.
You may already have most of what you need. A great many premises in the enhanced tier already have CCTV and some form of access control, installed years ago for ordinary crime prevention reasons. The useful question is usually not "what should we buy" but "does what we already have still work, and does it cover what we think it covers". Cameras drift out of position, recorders fill up, retention settings get left at whatever the installer set on commissioning, and door controllers develop faults that get worked around rather than fixed.
Coverage is not the same as image quality. A camera positioned to show that someone was present is doing a different job from one positioned to identify who they were. If CCTV is going to serve as a monitoring measure, it is worth checking that the coverage and the image quality actually match the purpose you are claiming for it in your documentation.
If You Already Have CCTV or Access Control
For most enhanced tier premises the practical starting point is a review of the existing systems rather than a new installation. That means checking camera positions and fields of view against the areas you actually want monitored, confirming that recording and retention are configured as intended, testing that access control zoning still reflects how the building is used, and repairing anything that has been failing quietly.
One point that is easy to miss: installing more CCTV for Martyn's Law does not change your data protection obligations. CCTV that captures identifiable people is personal data under UK GDPR, and the Information Commissioner's Office expectations on signage, retention, access requests and camera positioning apply exactly as before. If anything, expanding a system is the moment those obligations are most likely to be breached. Our guide to business CCTV and ICO compliance covers what that involves in practice.
It is also worth checking that lockdown procedures and fire evacuation procedures do not contradict each other. A procedure that locks doors and a fire alarm system that releases them are both correct in their own terms, and the interaction between them needs to be deliberate rather than discovered during an incident. If you are reviewing fire arrangements at the same time, our guide to business fire risk assessments is a useful companion.
What J&L Security Can and Cannot Help With
We think it is worth being explicit about this, because Martyn's Law has attracted a good deal of marketing that blurs the line between installing equipment and providing compliance advice.
What we do:
- Install, service and maintain CCTV systems, including reviewing whether an existing system covers what you believe it covers
- Install and maintain access control, door entry and electronic locking, including zoned access for restricted areas
- Install and maintain intruder alarm systems
- Design, install, commission and service fire alarm systems to BS 5839. J&L Security is BAFE accredited for the installation and maintenance of fire alarms
- Carry out a free survey of existing systems and tell you honestly what is working and what is not
What we do not do:
- Determine whether your premises is in scope, or which tier it falls into
- Carry out terrorism risk assessments
- Write your public protection procedures, or the documented assessment that enhanced tier premises must provide to the Security Industry Authority
- Make your notification to the Security Industry Authority
- Act as a counter-terrorism or security consultancy
J&L Security is a security systems installer and maintainer, accredited by SSAIB for security systems and by BAFE for fire alarm installation and maintenance. We are not a security consultancy and we do not offer compliance services under the Act. If you need help with the assessment, the procedures or the notification, that is work for a specialist consultant or for your own management team, and the Government's statutory guidance and the ProtectUK service are the right starting points.
Practical Steps to Take Now
- Establish your capacity figure. How many individuals may reasonably be expected to be present at the same time, from time to time. This determines everything else.
- Check whether your use is a qualifying use under the Act, using the statutory guidance.
- Identify the responsible person. For an organisation, this also means deciding who the designated senior individual will be if you are in the enhanced tier.
- Start on procedures. Evacuation, invacuation, lockdown and communication, written down and known to staff. This is the substance of the duty for standard tier premises and the foundation for enhanced tier ones.
- Enhanced tier only: consider measures and documentation. Work out what is reasonably practicable for your premises and be able to explain why.
- Audit what you already have. Before buying anything, find out whether the existing CCTV, access control and locking actually work and cover the right areas.
- Watch for the commencement date rather than working to a date you have seen quoted.
Get a Survey of Your Existing Systems
If you operate premises in Essex or Greater London and want an honest assessment of whether your existing CCTV, access control or door entry systems are doing what you think they are doing, we offer a free site survey. We will tell you what is working, what needs repair, and where coverage falls short. We will not tell you that you need to buy something in order to comply with a law that does not require it.
Contact us or call 0204 538 5925 or 0208 220 4770. We cover all of Essex and Greater London.
This article is general guidance based on the Terrorism (Protection of Premises) Act 2025 and the Government's statutory guidance published in April 2026. It is not legal advice, and it is not a substitute for the statutory guidance itself. The implementation timetable may change. For advice on your specific premises, consult a qualified security or legal professional.