Preparing for Martyn's Law: a practical guide for charities

The Terrorism (Protection of Premises) Act 2025, aka Martyn's Law, will affect both landowning charities which open their premises to the public, and charities which hold events on others' land. Although the Act became law on 3 April this year, it has yet to come into force: the Government has said there will be "at least" a two-year implementation period, to give the Security Industry Authority (SIA) chance to establish its new function, and for statutory guidance to be published.  

What should charities consider now, to ensure they are ready when the Act does come into force?

What does the Act do?

The Act puts a new duty on those 'responsible persons' who are either in charge of certain premises to which the public have access, or in charge of events open to the public, to consider how they would respond to a terrorist attack and put in place appropriate measures and procedures to limit the harm such an attack might cause. The premises covered by the Act are wide-ranging and include shops, schools, and tourist attractions, as well as museums, galleries, conference centres and exhibition halls. Offices and private residential accommodation are not covered (because they are not open to the public), but hotels are.   

The Act creates two tiers of duty: standard and enhanced. Where it is reasonable to expect at least 200 individuals to be present on the premises at any one time, the standard tier will apply (the Act does not apply to premises smaller than that). Where it is reasonable to expect 800 or more individuals, the enhanced tier will apply. In the case of standalone events (including purely open-air events) the Act will only apply where 800 or more individuals are expected to be present at once (it does not catch events under that size) – also, express permission must be required to attend, regardless of whether a fee is charged. 

Where premises fall within the standard tier, the responsible person must notify the SIA of their premises, and put in place 'reasonable and appropriate' 'public protection procedures', such as plans for how to evacuate or invacuate the premises (ie moving people to a safe place within the premises), how to lock them down and how to communicate with those present. The guidance to the Act is clear that this does not extend to making physical alterations to the premises or purchasing special equipment. Where the premises fall within the enhanced tier, or it is a qualifying event, the responsible person must comply with the standard tier requirements, as well as the additional enhanced tier duties. Enhanced tier duties include taking appropriate 'public protection measures' to reduce the vulnerability of the premises or event to terrorism and reducing the risk of physical harm if an attack were to occur. Example measures include monitoring the site and installing safety glass. Enhanced duty premises or events must also document compliance and file that with the SIA.

What will the new law mean for charities in practice?

How to count to 200

Given the importance of attendance numbers, how do you work out how many people it is reasonable to expect? The Act’s accompanying factsheet states that any reasonable method can be used, such as safe occupancy numbers for fire safety, or historic attendance data. If you don’t have them, or they'd create a misleading impression, any other reasonable method can be used. Don't forget, however, that even if there are normally fewer than 200 individuals on site, if it is reasonable to expect there may be 200 or more on site, even if only occasionally – such as for annual fundraisers or meetings – this is sufficient to bring the premises within scope. A one-off event at which there are unexpectedly 250 individuals won't matter: it is what it is reasonable to expect, if only occasionally, that is key.

What if I am still not sure?

Charities owning premises or running events at the fringes of capacity bands will want to pay close attention to capacity to avoid incorrect labelling. Where there is doubt, the Act provides that a tribunal application can be made to determine whether premises are caught and which tier applies.

What is a 'premises'?

For the purposes of the Act, 'premises' includes not just the main building, but also all related buildings and ancillary land, where they are all used (wholly or mainly) for the same purpose. A stately home, open to the public, together with its gardens, cafes and car parks, will all form one premises – and all be subject to the Act's requirements. And although a qualifying 'premises' for the purposes of the Act must include at least one building, a qualifying event need not include any buildings at all.

Who is a responsible person?

The responsible person is the person with control of the premises for the relevant use, or event, and who that is will be a question of fact in each case. For the stately home above, it will probably be the landowner. But if the same home is owned by a charity, but its day-to-day operations are run by a third party (perhaps because it is 'trading'), the compliance burden may sit with the operator, or belong jointly to both parties, depending on how the relationship is structured. Alternatively, the home may be owned by the charity, but the grounds and car parks owned by family trustees. Either way, where you have multiple parties, the Act requires all those involved to cooperate to ensure the duty is complied with. Tribunal applications can also be made to determine who is responsible and whether they are required to cooperate with another.

Why schools and places of worship are special

Although the Act does not single out charities, schools and places of worship do get special treatment. In those two cases, the premises and any event held on them will only ever be subject to standard tier requirements regardless of size. Read our article Martyn's Law – a practical guide for schools for further information for schools.

Keeping a sense of perspective

This Act comes with teeth. The SIA can impose a range of civil sanctions to address non-compliance, as well as criminal offences for the most serious breaches. Whilst that may sound alarming, it should be remembered the Act places a premium on the fact that measures and procedures must be proportionate: the larger and better resourced a venue is, the more will be expected of it (and the reverse). Measures and procedures must also be practical and appropriate to the premises or event in question: where a premises only has one room, there is no need to consider how to invacuate.

Although further detail is awaited in guidance, the shape of the new duty is clear. Charities with premises that may be subject to the Act should use the time during this implementation phase to prepare: familiarising themselves with the Act's concepts and requirements, reviewing their own premises and events, and considering what measures and procedures need to be put in place. Finally, until such time as the new law beds in and industry 'norms' are established, allowance should be made for the additional time and cost to comply with it.  

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.

© Farrer & Co LLP, October 2025