Martyn’s Law – Terrorism (Protection of Premises) Act 2025 and new legal duties for Scottish premises

The incoming Terrorism (Protection of Premises) Act 2025 calls for improved security measures and emergency response procedures. Caroline Loudon highlights what it means for Scottish venues and events.

Momentum is growing in all sectors as preparations continue in anticipation of the implementation date of the Terrorism (Protection of Premises) Act 2025 – more commonly known as Martyn’s Law. Indeed, King Charles is currently recruiting a new security chief to safeguard the royal estates in Scotland and ensure compliance with “protective security and legislative obligations”.

Martyn’s Law, named in memory of Martyn Hett, who was one of the 22 people killed in the horrific attack at Manchester Arena in 2017, is one of the most significant developments in UK anti-terrorism law in the past 20 years. It follows important pieces of legislation such as the Terrorism Act 2020; Anti-Terrorism, Crime and Security Act 2001; Counter-Terrorism and Security Act 2015; and National Security Act 2023.

The 2025 Act introduces a new statutory duty on those responsible for qualifying public premises and events to implement proportionate security measures aimed at mitigating the risk and impact of terrorist attacks.

With the countdown to implementation now officially ‘on’ (the Act received royal assent on 3 April 2025 and enforcement is expected by April 2027), all publicly accessible venues and events should now be mapping their obligations and integrating Martyn’s Law compliance into existing health and safety frameworks.

The law will apply across the UK, including in Scotland, and will compel thousands of venues to act in preparedness, upscaling their security and emergency response procedures. In-scope premises are named in Schedule 1 of the Act and include premises used wholly or mainly for one or more of the following: retail and hospitality; entertainment and leisure; places of worship; education and faith; healthcare and public services; transport and infrastructure; and community and event spaces.

Further to the ‘types’ of premises and activities that will trigger Martyn’s Law, premises must consist of at least one building, have capacity of 200 or more people and be publicly accessible. Oversight of compliance will be provided by the Security Industry Authority (SIA), which will act as the regulator across the entire UK. 

Navigating the tiered compliance structure

The 2025 Act does not require all venues to take equal action, with further measures expected of larger venues.

Premises can be divided into two categories, based on the capacity of the venue or the event – standard tier and enhanced tier. However, it is also worth noting that, given the broad scope of the Act, even venues not traditionally considered high-risk – such as community halls or small theatres – are likely to fall within its remit.

Standard tier encompasses those venues that might reasonably expect to host between 200 and 799 individuals. These premises will need to identify the person ‘in control’ of the venue and notify the SIA of their identity. This should be followed by a thorough review of public protection procedures, including evacuation, invacuation, lockdown and communication protocols. A security plan must be created and basic terrorism protection training undertaken by staff. If these procedures do not exist, or lack any detail, this must be rectified immediately to ensure they are reasonably practicable and proportionate to the risk.

For ‘tier 1’ premises (standard tier), physical security measures are not mandated. This will be good news for smaller premises, ensuring that compliance remains accessible. If, however, it is determined that physical security measures might be beneficial to the venue’s overall security measures, they should not be dismissed out of hand.

For larger premises (‘tier 2’ or enhanced tier), which can expect to host more than 800 individuals, requirements are more stringent. Not only will they be required to comply with all the standard tier measures, they will also be compelled to implement public protection measures to reduce vulnerability and physical harm. These measures might include physical security (such as CCTV and bag checks), monitoring and movement control, and information security. All these additional measures must be documented and shared with the SIA.

Legal duties and enforcement

Ultimately, the 2025 Act demands that the buck stops with a premises’ designated ‘responsible person’ (defined as the individual or entity with control over the premises or event). In Scotland, this person could include venue operators, event organisers, tenants with operational control or local authorities responsible for managing public spaces.

If a venue is found to be neglecting its new duties, as required by the Act, then this person will ultimately be the one in breach of their statutory duty of care.

This could potentially result in regulatory enforcement, including compliance notices, financial penalties and potential criminal liability for serious breaches. The SIA will have investigatory powers and will issue guidance to support compliance during the 24-month implementation period, which is currently underway and expected to conclude in early 2027.

Actions to take now

With the implementation period officially underway, there are several immediate steps that qualifying Scottish premises should be taking now.

These include:

• Conducting risk assessments tailored to the premises and activities
• Training staff in emergency procedures and counter-terrorism awareness
• Reviewing contracts and leases to clarify responsibility for compliance
• Engaging with the SIA and sector-specific guidance as it becomes available

Conclusion

Martyn’s Law represents a paradigm shift in public safety legislation with responsibility for protections against terrorism moving to being venue specific, on a much wider basis. For Scottish premises, the legal duties are clear: prepare, protect and respond. While the 2025 Act seeks to balance security with proportionality, its implementation will require careful legal and operational planning. As statutory guidance emerges, legal practitioners must remain vigilant in advising clients on their evolving obligations under this landmark legislation.

Written by Caroline Loudon, Partner, TLT