Martyn's Law (Protect Duty)

Who does it apply to?

The Act creates a two-tier system based on premises or event capacity:

• Standard Tier (200–799 capacity): You must carry out basic terrorism protection procedures — essentially, thinking about what you would do if an attack happened and making sure staff or volunteers know the plan.

• Enhanced Tier (800+ capacity): In addition to the standard procedures, you must put in place reasonably practicable measures to reduce vulnerability to, and the impact of, a terrorist attack. This could include things like physical barriers, CCTV considerations, and more detailed security planning.

Capacity is based on the maximum number of people who could be on the premises or at the event at any one time, including staff and volunteers — not just ticket-holders.

What do you actually need to do?

For Standard Tier events (200–799):

• Carry out a 'standard terrorism evaluation' — think about the type of attack that could happen and what your response would be.
• Have a written plan that staff or volunteers can follow.
• Make sure the people working at your event know what to do (e.g. evacuation routes, lockdown procedures, how to alert emergency services).

For Enhanced Tier events (800+):

• Everything in the standard tier, plus:
• Carry out an 'enhanced terrorism evaluation' with more detailed risk assessment.
• Put in place 'reasonably practicable' protective measures — the Act does not prescribe a specific checklist, but you should think about access control, hostile vehicle mitigation, communication systems, and staff training.
• Appoint a designated senior person responsible for compliance.

When does it come into force?

The Act received Royal Assent in 2023, but the duties do not come into effect immediately. The government has indicated a phased implementation, with Enhanced Tier duties expected first, followed by Standard Tier. Exact commencement dates are set by secondary legislation — keep an eye on GOV.UK announcements and your local authority for updates.

There will be a transition period to give businesses and event organisers time to prepare.

What happens if you do not comply?

A new regulator (or the Security Industry Authority in an expanded role) will oversee compliance. Penalties for non-compliance could include:

• Compliance notices requiring you to take specific steps.
• Restriction notices limiting activities until you comply.
• Civil penalties (fines) — the amounts are expected to be set by secondary legislation.

The aim is to support compliance rather than punish, but persistent or serious failures could lead to significant consequences.

Practical tips for craft fair hosts

• Count your capacity honestly — include stallholders, staff, volunteers, and expected visitors.
• Start with a simple plan: evacuation routes, who calls 999, where people should gather.
• Brief your team on the day. A five-minute chat before the event opens can make a real difference.
• Think about your venue layout — are there bottlenecks? Can people leave quickly?
• You do not need to hire private security for a Standard Tier event, but you do need to have thought about the risks and have a plan.
• Keep a written record of what you did — this is your evidence of compliance.