What the Terrorism (Protection of Premises) Act 2025 Means for Your Business

In a world where public safety is increasingly under the spotlight, the Terrorism (Protection of Premises) Act 2025 marks a significant shift in how businesses prepare for potential threats.

Building on existing Health and Safety regulations, this new legislation introduces critical responsibilities for venues and organisations to help safeguard the public against terrorism. In this article, our team explores what’s changing and what it means for you.

What additional duties does the Act include?

The Act introduces a mandatory public protection duty for organisations responsible for certain types of premises or events based on size and use. It places terrorism preparedness on an equal legal footing with Health & Safety, creating a new duty of care to protect individuals from acts of terrorism. Those responsible for certain premises and events must take appropriate action to reduce the risk of harm to their workers and the public.

Is this the same as Martyn’s Law?

Yes, the Act is commonly known as Martyn’s Law in tribute to Martyn Hett, who was killed in the Manchester Arena attack.

How do I know if it applies to my business?

Your business is potentially in scope if you use your premises mainly for purposes listed in Schedule 1 of the Act, namely:

• shops etc.
• food and drink
• entertainment and leisure activities
• sports grounds
• libraries, museums and galleries
• halls etc.
• visitor attractions
• hotels etc.
• places of worship
• health care
• bus stations, railway stations etc.
• aerodromes
• childcare
• primary and secondary education, further education
• higher education public authorities

(Note that whether a business falls under Schedule 1 is determined by the main use of the premises; for example, the garden of a stately home may qualify if it is mainly used as a visitor attraction rather than as a private garden.)

If your business falls under any of these descriptions, you need to consider if it also fits in one of these two categories:

• Premises where 200 or more people may be present (standard duty)
• Premises where 800 or more people may be present, or if they are responsible for organising an event where 800+ people are expected to attend (enhanced duty)

If so, then the Act will apply to your business.

Who is responsible for compliance?

The ‘responsible person’ is the individual or organisation legally required to comply with the duties set out in the Act, identified based on who has control over qualifying premises or events in relation to their use. While this could be an individual, it is more commonly a business or organisation.

Premises

The responsible person is typically the operator or tenant who controls the premises for a Schedule 1 use; for example, a business leasing a space for retail purposes is the responsible person for that shop. If a premises has multiple uses, the responsible person is whoever controls the main or principal use.

Events

The responsible person is the entity that takes control of the premises for the purposes of hosting the event; for example, if a company hosts a concert in a park and assumes operational control of that area, it becomes the responsible person.

The responsible person is legally required to ensure full compliance with the Act's requirements for public protection, procedures, and preparedness.

What are the Act’s requirements?

As mentioned above, there are two levels of duty, depending on the number of people in the premises or at the event:  The number of people onsite accounts for everyone and includes staff, volunteers etc.

Standard duty, for 200-799 people

The responsible person must notify the Security Industry Association (SIA) and put in place public protection procedures (e.g. evacuation, lockdown, and staff guidance). The focus is on simple, low-cost actions including training and procedures. No physical security changes are required.

Enhanced duty, for 800+ people

In addition to standard duties, the responsible person must implement public protection measures (e.g. monitoring, vulnerability reduction); document all procedures, including a risk assessment, and submit them to the SIA; and appoint a senior individual to ensure compliance (if an organisation). These duties reflect the higher risk profile and require more formal planning and oversight.

What are the penalties for non-compliance?

The SIA will be the regulator, with functions relating to inspections and enforcement as well as providing guidance and advice to promote compliance.

Civil penalties:

• Up to £10,000 (standard duty premises)
• Up to £18 million or 5% of global turnover (enhanced duty)

Criminal offences for:

• Obstructing or impersonating inspectors
• Failing to comply with notices
• Providing false information

How long do we have before the Act comes into force?

The Act received Royal Assent on 3 April 2025. The implementation period is expected to be at least 24 months, allowing time for those responsible to prepare appropriately to meet the requirements of the Act by the time it comes into force.

Where can I get more information?

Links for further reading:

https://www.legislation.gov.uk/ukpga/2025/10/introduction
https://homeofficemedia.blog.gov.uk/2025/04/03/martyns-law-factsheet/

What should I do next?

We recommend considering the following actions:

• Review Health & Safety audits and risk assessments to include terrorism preparedness
• Update staff training
• Update risk registers and business continuity plans
• Update fire safety plans

(Note that a large publicly accessible building or hotel near to an event may be used as an evacuation point and become a secondary target, so businesses do not need to be holding an event themselves.)

How can Stallard Kane help?

We can help you assess your current level of preparedness and plan for full compliance. For further information please contact healthandsafety@skaltd.co.uk