Martyn’s Law Explained: What Businesses Need to Know

By Stephanie Thirlwell, Head of Insured Regulatory at rradar

As we step into a new year, many of us will find ourselves shopping, visiting busy centres, attending work events, or catching up with friends at the pub. It’s a time for connection, but also a moment to reflect on the importance of safety in the public spaces we cherish.

This focus on safety underpins the Terrorism (Protection of Premises) Bill, also known as Martyn’s Law, which was created in tribute to Martyn Hett, who sadly died in the 2017 Manchester Arena bombing. His mother, Figen Murray, and other activists campaigned for the law, believing that a lack of preparedness increased the scale of the tragedy.

The bill was introduced to Parliament on 12 September 2024 and is currently under Parliamentary scrutiny. This groundbreaking legislation aims to balance public protection against the risk of terrorist attacks with the cost to businesses of implementing security measures. As businesses navigate this new safety mandate, here’s a breakdown of how to begin to prepare for the new law that aims to protect public spaces effectively.

The purpose of Martyn’s Law

The current national threat level in the UK is substantial meaning a terrorist attack is likely. Alarmingly, there have been 15 terror attacks in the UK since 2017. Martyn’s Law is ultimately designed to keep people safer by raising the security standard in the UK.

Martyn’s Law creates a ‘protect’ duty for qualifying venues to ensure premises are better prepared for terrorist attacks. The bill aims to enhance public safety and reduce the risk of harm by requiring businesses to have a base level of security at venues and events and ensuring staff know what to do during a terrorist attack.

The impact on businesses

Businesses are currently required by legislation to consider their own health and safety risks. Martyn’s Law introduces a significant shift by imposing a duty of care in relation to third parties. In large spaces such as arenas, a coordinated strategy will be needed to cover all areas including the concourse. There should be ownership and responsibilities for the space with good communication between businesses to keep the public safe from harm in the space as a whole.

Previously, terrorist risks were largely seen as the responsibility of the Government or police. However, legislation like this is essential for ensuring consistency in approach. Businesses can no longer afford to take no action. The focus is on fostering a culture of safety to protect lives.

Who does Martyn’s Law apply to?

Martyn’s Law applies to qualifying premises in the UK that are responsible for publicly accessible locations. The premises must also have a physical boundary such as walls or fences or allow access by express permission, for example, via a ticketing system. Martyn’s Law will apply to venues like retail spaces, sports grounds, places of worship, and hotels.

There are two tiers qualifying premises can fall into, standard tier (capacity of 200-799) and enhanced tier (capacity of over 800). The law will also apply to temporary or one-off events such as festivals and Christmas fairs which are aplenty near the end of the year.

The ‘reasonably practicable’ standard

For both tiers, premises are expected to put preventative measures in place so far as ‘reasonably practicable’. This allows procedures and measures to be tailored to a specific venue or event, enabling duty holders to consider what is within their control, as well as what is appropriate.

Those in the standard tier can implement low-cost measures that don’t require physical changes to their venue, such as policies and procedures. However, for those in the enhanced tier, it is appropriate to invest in proper surveillance methods to monitor the premises and its immediate surrounding areas.

In depth dedicated guidance and support will be provided for all duty holders to ensure that those in scope know what to do and how to do it. The Bill is not yet law and its provisions are subject to change, however for businesses likely to fall in scope the following guidance can be considered at this time.

Guidance for Standard tier

Standard tier venues will need to appoint a ‘responsible person’ who should notify the regulator the Security Industry Authority (SIA) that their venue falls within the standard tier. They will need to understand and educate themselves on the different types of terrorist attacks and the risk of harm. From there, it’s vital that venues implement ‘appropriate and reasonably practicable’ public protection procedures and review these annually. Businesses should consider:

• Evacuation: The process of getting people out safely
• Invacuation: The process of bringing people safely into, or to safe parts of the venue
• Lockdown: The process of securing the premises to ensure entry of any attacker is restricted or prohibited
• Communication: How to alert people on the premises to move away from danger. All workers must be aware of the procedures so they can safely put them into practice

Guidance for Enhanced tier

Businesses in the enhanced tier must follow all the rules in the standard tier. In addition, they must maintain a security document, including an assessment of the terrorism risk and measures put in place to mitigate harm. They should share this with the regulator. This should be regularly refreshed and any updates shared.

If the ‘responsible person’ is a corporate body there must also be a ‘designated senior individual’ to oversee these responsibilities. Public protection measures should be tailored to specific events or the premises themselves. These measures may include the installation of CCTV, a bag search policy, or other strategies to ensure public safety.

Enhanced tier premises are also required to implement more advanced security measures. This includes monitoring and reporting suspicious behaviour, controlling access to reduce vulnerabilities, and strengthening physical structures to minimise the impact of potential attacks. They must also maintain a comprehensive security plan.

4 key things businesses can do now:

1) Learn about your ‘Protect Duty’ – The Act will require a ‘responsible person’ – arm yourself with knowledge. The ProtectUK website is an excellent source of information with bitesize training videos.

2) Conduct thorough risk assessments – consider the different types of terrorist attacks and best protection strategies, refreshing risk assessments regularly. Build Martyn’s Law planning into existing risk assessments such as those for fire and health and safety.

3) Train staff – vigilance is key – Build action plans into staff inductions and develop strategies for invacuation, evacuation, and lockdown strategies, ensuring clear communication during a potential incident.

4) Share information – Communicate with the local council and neighbouring businesses, and share ideas and guidance. For example, setting up WhatsApp groups with neighbouring businesses.

Martyn’s Law seeks to ensure everyone can safely enjoy public spaces, but its efficacy ultimately rests on the responsibility of business owners. Success lies in proactive risk management and fostering a culture of continuous learning, enabling businesses to prepare in advance and respond effectively when it matters most.