The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, is expected to come into force in Spring 2027.
Named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack, Martyn’s Law aims to make people safer by ensuring premises and events are better prepared and protected in the event of a terrorist attack.
This landmark legislation exists because of the tireless efforts of Martyn’s mother, Figen Murray OBE, and her campaign team. This legacy should make everyone safer at premises and events.
We are working with the Home Office to build awareness of the incoming legislation, the requirements for those in scope and the way in which we intend to operate. Here is what healthcare professionals need to do to prepare.
Establish whether you are in scope
Under Schedule 1 of the Act, healthcare premises are included in Martyn’s Law. This means if your healthcare premises is publicly accessible and can reasonably be expected to have more than 200 people on the premises (including staff and visitors) at any time, your premises are likely in scope.
In the legislation, a “hospital” means “any institution for the reception and treatment of persons suffering from illness, any maternity home, and any institution for the reception and treatment of persons during convalescence or persons requiring medical rehabilitation.” This means larger community health hubs and clinics, outpatient facilities and specialist medical facilities may be in scope and, for the purposes of the legislation, qualify as hospitals.
The Home Office guidance is available to help you identify if your facility is in scope, and what you must do if it is. There are helpful flowcharts for premises to follow on ProtectUK, which provides free advice and guidance to help organisations improve their response to the risk of terrorism.
Determine which tier of requirements you should follow
If you are in scope, the Home Office guidance will help you identify which tier your healthcare setting is in. The two tests for premises are: what the premises are wholly or mainly used for, and how many people are expected to be present at the busiest times.
There are two tests for what premises are
If it is reasonably expected that between 200-799 people, including staff, will be present at the busiest times, the premises is likely to be in the standard tier. If at least 800 people will be present, it is likely to be in the enhanced tier.
Understand what will be expected
If you are in scope, you will have to notify the SIA who the responsible person is for your premises once the law comes into effect in Spring 2027.
If your premises is in the standard tier, when the Act comes into force, you will be expected to have appropriate public protection procedures in place to reduce the risk of physical harm if an attack were to occur there or in the immediate vicinity.
If your premises is in the enhanced tier, you will also need measures in place to reduce the risk of harm from, and vulnerability to, an attack. You will be expected to document the public protection procedures and measures, assess how they reduce risk of physical harm and vulnerability of the premises or event, and then send this document to us.
Now is the time to start thinking about the right procedures and/or measures for your premises.
Public protection procedures should be a set of actions, or a plan, that staff at qualifying premises can take to reduce the risk of harm if they suspect an act of terrorism is occurring or is about to occur. The four public protection procedures stated in the Act are:
- Evacuation
- Invacuation
- Lockdown
- Communication
Those in the enhanced tier will also need to consider:
- Monitoring (using tools like CCTV)
- Movement (of individuals into, out of and within the premises)
- Physical security (like security barriers)
- Security of information – ensuring information about the premises is not widely available and accessible to those who may use it to plan a terrorist attack
The focus is on identifying what procedures and measures are appropriate for your premises or event, and then putting those into place effectively as far as is reasonably practicable. Where good protective security measures and preparedness procedures already exist, these will be solid foundations.
Identify the responsible person
Every premises or event that falls within the scope of the legislation must have a designated responsible person. The responsible person is the individual, organisation or company with control of the qualifying premises for the purpose for which it is in scope.
You have “control of the premises” if you typically:
- are in possession of the premises at the time
- have the right and ability to make decisions about its management and use
For hospitals, the person responsible for the premises is:
- where the hospital is operated by an NHS trust, NHS foundation trust or Health and Social Care trust, that trust
- where the hospital is operated by a Health Board or Special Health Board, that Board
- in any other case, the governing body of the hospital
Get ready to notify the SIA
When Martyn’s Law comes into force, all those in scope will be legally required to notify us about their premises or event.
At this point (expected to be Spring 2027), the notification portal will become available. We will confirm the exact date in good time.
For now, you should start to think about what measures you have in place and what you might need to do differently to make sure you are compliant with the act. There’s lots of useful material on counter terrorism measures you could adopt on Protect UK.
If you would like updates from the SIA or to volunteer to help test our systems and processes, you can sign up.
