Martyn's Law: What's the latest and what steps should businesses be taking?

The world watched in horror in May 2017 as a terrorist attack at Manchester Arena claimed 22 lives.

In response to tireless campaigning from the parents of one of the victims, Martyn Hett, the UK Government will legislate to impose a specific duty on the operators of premises and events that attract significant numbers of people, to identify and mitigate the threat posed by terrorist activity.


This 'Protect Duty', which will be introduced by The Terrorism (Protection of Premises) Bill is more commonly known as "Martyn's Law."

The Bill will establish a tiered model for premises, linked to the activity that takes place at premises (or at an event) - and its capacity.

Larger premises will fall within the 'Enhanced Tier.' A further consultation on what 'Standard Tier' businesses will need to do has just been published.

There is some way to go before the scope of any "Protect Duty" is finalised however, and before guidance is issued about how affected businesses may ensure compliance.

In our view, it is sensible for retailers to now consider the capacity of their premises and in particular the capacity of publicly accessible areas, including where there is outdoor seating.

However, retailers should be wary of any business purporting to offer training and advice on "how to comply with Martyn's Law." The Home Office would acknowledge that we are not at the stage where the regulatory framework is sufficiently clear for such training to serve a useful purpose.

The latest developments, and a fuller analysis of relevant considerations, is set out below following a useful discussion briefing with the Home Office and the British Retail Consortium (BRC) in recent weeks.


Retailers will likely be familiar with the outline details:

To be in scope:

  • Premises and events must be accessible to the public.
  • Premises must be used for a purpose listed in the Bill (e.g., entertainment and leisure, retail, food and drink).
  • Have a capacity of 100 or more individuals.
  • Premises may be a building or outdoor locations which have a readily identifiable physical boundary and access by express permission.
  • Provision is made in the Bill for temporary events such as festivals that have express permission to enter and a capacity of 800 or more individuals.

The Bill will establish a tiered model, linked to the activity that takes place at premises or at an event and its capacity:

This tier will see additional requirements placed on high-capacity venues in recognition of the potential catastrophic consequences of a successful attack. This will apply to premises and events with a capacity of 800 or more individuals, for example, live music premises or events, theatres, and department stores. Those responsible for an enhanced duty premises or qualifying public events must:

  • Notify the regulator of their premises or event.
  • Take ‘reasonably practicable’ measures that will reduce the risk of a terrorist attack occurring or physical harm being caused. The reasonably practicable test is utilised in other regulatory regimes e.g., Health and Safety, and will enable organisations to tailor their approach to the nature of the premises, and their activities and resources.
  • Keep and maintain a security document, aided by an assessment of the terrorism risk, which must also be provided to the regulator.
  • If the responsible person is a body corporate, they must appoint an individual as the designated senior individual for the premise or event.

The Government states that it does not wish the regulatory burden to overpower businesses or be disproportionate. To be in scope the premises must have a capacity of between 100 and 799. The link to the newly published consultation can be found here.

Please note the consultation will end on 18th March 2024.

A notable feature here is the requirement in the Draft Bill for Standard Tier premises to complete a standardised template have been scaled back: now such premises are required to have “reasonably practicable” procedures in place, were an attack to occur.

Similarly, the requirement for businesses operating in the standard tier to provide specific training is no longer applicable.  However, providing meaningful training on workplace risk is part and parcel of discharging current health and safety duties.  It seems likely to us that workplace training will have to evolve to incorporate the risk of terrorist activity for in-scope businesses.

So, what is the latest?

At a recent meeting organised by the British Retail Consortium with the Home Office team responsible for deciding how capacity will be calculated, we learned the following:

  • The Home Office will (and has now) published a six-week consultation looking at the Standard Tier.
  • At the end of the consultation period the Home Office will consider any responses and will then take the bill through Parliament to become law.
  • The Government will publish Regulations about capacity calculations at the point the Bill receives Royal Assent and becomes law.

It is therefore going to take some time before the scope of any Protect Duty is finalised.

The Home Office is proceeding on the basis that the calculation for the ‘100’ or ‘800 plus figure will be:

  • Determined by reference to who has access to the public areas (so not a staff canteen for example).
  • However, the staff would be included in the calculation if they were able to access these publicly accessible areas too.  One retailer explained they were counting the number of covers in the cafe and adding in a notional figure for staff because at any one time they estimate that this number of staff are serving customers seated at the tables.
  • Determined by figures produced in accordance with existing regulatory requirements such as fire regulations would permit 100-800 plus in publicly accessible areas, rather than on the basis of any “peak flow” numbers or even average capacity.

  • People in queues (to get into particular premises) will not be included in the calculation because queuing is considered a transitory activity.
  • Car parks are likely to be excluded because they too are considered transitory.
  • Outdoor seating areas would be included because consumption of food or drink at a table is a far less transitory activity.

  • Premises that may attract large numbers of customers are operating within a larger centre that certainly would have the capacity to attract more than 800 people.  So, on whom is the Protect Duty imposed?
  • The Home Office is working on the basis that the relevant person here is the person in control of the shopping centre operation rather than individual retailers operating within the shopping centre.  However, the Home Office is looking to introduce wording into any regulations on capacity calculations to mandate operators of smaller units within the shopping centre to cooperate with the person preparing risk mitigations regardless of any such duty that may already be included in a lease (for example).

Going forward

There is some way to go before the scope of any "Protect Duty" is finalised and before definitive Guidance is issued about how in scope businesses may be able to comply with such a duty.

What to do

We would advise retailers to actively consider the capacity of their premises and in particular the capacity of publicly accessible areas and whether there is any outdoor seating at the premises. Consider too the number of staff on duty at any one time and who work 'on the shop floor.'

Also consider the nature and extent of any existing health and safety policies that may address counter terrorism.

Contact us, or the Home Office directly with any questions you may have, or if you would like to share with them details about your business that might cause you difficulty if the Home Office determines that 'maximum capacity in accordance with Regulations' is the way capacity will be calculated here.

What you will not need to do

Given there is still a long way to go before Martyn's Law becomes law with associated guidance on how to comply, retailers should be wary of any business purporting to offer training and advice on "how to comply with Martyn's Law."

The Home Office would acknowledge that we are not at the stage where the regulatory framework is sufficiently clear that training on how to prepare for Martyn's Law would serve any meaningful purpose.

Key contacts