Martyn's Law: What now?

For several years now, businesses and organisations have been hearing about Martyn’s Law.

There have been webinars, conferences, articles, briefings and online discussions. Many organisations have spent a considerable amount of time trying to understand what the legislation will mean for them.

That work has been important. But I think the conversation now needs to move on.

The Terrorism (Protection of Premises) Act became law in April 2025. On 15 April this year, the Home Office published its Section 27 statutory guidance. It is a substantial document at 129 pages, supported by further material, and my professional readout is that it is well considered and genuinely helpful. It gives businesses and premises that may be in scope considerably more detail about what the legislation requires and how they can work towards compliance.

We are still awaiting the final Section 12 guidance from the Security Industry Authority, which will explain how the SIA intends to carry out its role as regulator. That is expected in autumn.

But I don't think waiting for that document means organisations should wait to start the work.

Martyn's Law is expected to come into force in spring 2027, although the exact commencement date is still to be confirmed. The legislation itself has been passed and the Home Office guidance is available.

That's the question I keep coming back to now: not what Martyn's Law is, but what we're actually doing about it.

Why am I speaking about this now?

I haven't been particularly loud on LinkedIn about Martyn's Law over the last few years. That has been deliberate and let's just say there are plenty of loud voices in this space already.

I've preferred to spend my time doing the work.

For the past three years I have been working directly with businesses and organisations, including national brands and complex multi-site estates, thinking about what implementation will actually mean and how organisations can prepare. Going into the heart of businesses, walking the floor, and sitting with store or hotel managers is important. They sit at the operational heart of where good needs to exist.

That work has now moved very firmly into implementation. I am working with national retailers, hospitals, universities and colleges as they begin to scope their estates and work through what Martyn's Law will mean for them operationally.

And one thing I am hearing repeatedly is this:

We want to get on with it, but where do we start?

I don't think the problem is apathy. Most of the organisations I speak to genuinely want to engage and get this right. The difficulty is moving from understanding the legislation to actually doing something with it.

That is the space I think we now need to talk about.

Having a plan and being prepared are not necessarily the same thing

My own perspective on this comes from operational experience.

I spent 30 years in policing, including 13 years working in counter terrorism, initially in the West Midlands and subsequently within a national Protect and Prepare portfolio.

Part of my role involved organisational learning and conducting strategic debriefs following terrorist incidents.

My job wasn't to investigate those responsible for an attack. It was to help Counter Terrorism Policing, government and partner agencies understand what had happened operationally. What worked? What didn't? Where had processes or arrangements failed us? And, most importantly, what needed to change as a result?

We often hear after a serious incident that “lessons will be learned”.

One thing my experience taught me is that identifying a lesson isn't the same as learning it.

Learning only really happens when something changes as a result, whether that is policy, training, exercising, procedures, decision-making or operational practice.

I think there is an important parallel here with Martyn's Law.

Having a policy isn't necessarily the same as being prepared.

You can have very good documentation, but would the people working at the premises know what was expected of them if something actually happened?

Would the arrangements work?

Have you ever tested them?

Those are the questions that interest me.

Start with understanding your estate

For larger organisations, implementation isn't necessarily a simple question of whether the business is “in” or “out” of scope.

A national retailer, university, hospitality business or healthcare organisation may have a large estate containing very different types of premises, with different capacities and operating models. Some may fall within the Standard Tier and others within the Enhanced Tier.

So start by understanding what you actually have.

Which premises and events are likely to be in scope?

Which requirements are likely to apply?

Who is the Responsible Person?

Where Enhanced Tier premises or qualifying events are involved, who will undertake the Designated Senior Individual role?

Then look at what already exists.

What security and emergency procedures do you already have? How are they communicated? How are staff trained? When were the arrangements last tested? What evidence do you have that they work?

And where are the gaps?

For a large organisation, there is another challenge which shouldn't be underestimated: consistency.

If you have hundreds of premises, how will you know what has been completed at each one?

You'll also need to record the decisions you make, be able to evidence why particular measures were or weren't considered reasonably practicable, make sure your people understand what's expected of them, and give senior leaders genuine assurance that what exists on paper is actually understood at premises level.

These aren't questions that require organisations to wait until commencement. They are questions that can be worked through now.

So where do you go for help?

Businesses have choices.

You can do the work internally. The Section 27 guidance is there to help you and there is a significant amount of free information available through ProtectUK. For organisations with the right internal capability, that may be the appropriate route.

There are also institutes, national bodies and sector organisations producing useful information for their members.

You may decide you need external consultancy support. If you do, my advice would be to carry out your due diligence.

Ask about experience. Ask about qualifications. Ask what the person has actually delivered. Satisfy yourself that the person advising your organisation has the competence to do so.

There are also digital platforms being developed to support organisations through implementation. Again, do your due diligence and understand exactly what the product does.

Technology can support a Responsible Person to work through requirements, record decisions and maintain an evidence trail. What it cannot do is take accountability away from the person on whom the legislation places it.

For some organisations the answer will probably be a combination of internal capability, external expertise and technology.

There isn't one answer that will suit everybody.

What I wouldn't recommend is doing nothing

The final SIA guidance will give organisations further information about the regulatory approach and should, of course, be considered when it is published.

But there is already plenty that organisations can be doing.

Understand your estate, work out where responsibility actually sits, and get clear on which parts of the legislation are likely to apply to you.

Look properly at the procedures and measures you already have, identify the gaps, and talk to the people who will actually have to implement them. Think about training, test your assumptions, and start considering how you will record the decisions you make and demonstrate what you have done.

The purpose of Martyn's Law isn't to create another compliance folder.

It exists because people should be better protected and premises better prepared if a terrorist attack occurs.

So if I were sitting with a business today, I wouldn't open by asking whether they're compliant. I'd ask something more practical: if something happened at one of their premises tomorrow, would their people know what to do?

If you can't yet answer that confidently, I think that is a very good place to start.

About the author

Danielle Grant - Director of Counter Terrorism & Protective Security, Global Consortium Group (GCG)

Danielle spent 30 years in policing, including 13 years in Counter Terrorism Policing and a national leadership role within Protect & Prepare. She now works with organisations across retail, leisure & hospitality, healthcare, and education on the practical implementation of Martyn’s Law.