What is Martyn's Law?
Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025. It is named after Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017, and it follows a long campaign by his mother, Figen Murray.
The law asks the people responsible for busy premises to think through, in advance, how they would keep people safe if a terrorist attack happened on site or nearby. For schools it is a planning duty. It sits comfortably alongside the safeguarding and emergency planning work schools already do.
The regulator is the Security Industry Authority (SIA).
Does Martyn's Law apply to my school?
The Act applies to premises where it is reasonable to expect 200 or more people to be present at the same time, from time to time. Pupils, staff and visitors all count, so the number on site can rise well above a normal school day during performances, sports days, parents' evenings and open events.
That means a smaller school can be in scope. A primary with 150 pupils and staff on a normal day is in scope if its nativity or sports day brings 250 people on site. The responsible person should work out the largest number of people the school can expect at any one time, and keep a note of how that figure was reached.
A school that can never expect 200 or more people on site at once falls outside the Act. The four procedures are still good practice, and the Department for Education encourages every school to have them.
Every school in scope sits in the standard tier, whatever its size. The enhanced tier, which applies to venues of 800 or more, does not apply to schools. That includes large secondary schools and further education settings.
Martyn's Law applies across the UK. The Department for Education guidance referred to here is written for schools in England. Schools in Scotland, Wales and Northern Ireland are covered by the same Act and should also look at guidance from their own education department.
When does it start?
The Act is expected to come into force in spring 2027. The exact date is still to be confirmed by Government, and the statutory guidance commits to at least 24 months between Royal Assent and commencement.
The SIA is due to publish its final guidance this autumn. We will review this guide when it does.
Who is responsible?
The law places the duty on the "responsible person". In a school, that is not the headteacher or the business manager personally. According to the Department for Education it is:
- the governing body, for a maintained school
- the academy trust, for an academy or free school
- the proprietor, for an independent school
In practice the headteacher or school business manager usually does the work, under a delegation from the governing body or trust. It is worth recording the delegation in the minutes of a governors' or trust meeting, so it is clear who is accountable and who is doing the day-to-day work.
You may see articles saying the local authority is the responsible person for maintained schools. The Department for Education's guidance does not say that.
What do schools have to do?
The standard tier has two duties: notify the SIA, and have appropriate public protection procedures in place, so far as is reasonably practicable. For a school that means four procedures:
- Evacuation: getting everyone out of the building and to a safe distance, when the building itself is the danger.
- Invacuation: bringing everyone inside and away from windows and entrances, when the danger is outside.
- Lockdown: securing people where they are, when a threat is inside the building.
- Communication: alerting everyone on site quickly, with signals staff cannot mistake for each other, and keeping parents and the emergency services informed.
Invacuation and lockdown are the two most often confused. A simple way to hold them apart: in an invacuation everyone moves inward and the building protects them; in a lockdown nobody moves and the room protects them.
Write your procedures down
Written procedures are how a school makes sure every member of staff, including supply staff and new starters, knows what to do. They are also the clearest way to show the SIA what you have in place if it inspects. The SIA is itself publishing templates to help standard tier premises write their procedures down.
Notifying the SIA
Every school in scope must notify the SIA within three months of the law coming into force. You will be asked for:
- the name and address of the responsible person
- contact details for anyone else with a duty to co-ordinate
- the greatest number of people reasonably expected on site at one time, and how you worked that out
Notification will be made through a GOV.UK portal, due to open in 2027. If something changes afterwards, such as the responsible person's details, the SIA must be told within 28 days.
Notifying the SIA is not the same as submitting your procedures for approval. Schools do not send their procedures to the SIA. Our article on notifying the SIA covers this in more detail.
Will the SIA inspect schools?
It can. The SIA takes a risk-based approach and will typically give at least 72 hours' notice of an inspection. It looks at whether a school has taken reasonable steps to comply, taking its circumstances into account. The SIA has said it intends to regulate in a supportive and proportionate way.
What you do not need to do
The standard tier is about procedures. A school does not need to:
- install CCTV, access control or other security equipment
- employ security staff or carry out bag searches
- make changes to its buildings
- send staff on an accredited counter-terrorism course
- carry out a formal terrorism risk assessment
Our article on six common Martyn's Law misconceptions covers the claims that most often make the duty sound bigger than it is.
A sensible order to get it done
- Work out the largest number of people you can reasonably expect on site at once, including visitors at events, and note how you counted.
- Agree who the responsible person is and who will do the work, at your next governors' or trust meeting, and minute it.
- Put your four procedures in place for your own site: your buildings, your entrances, your alarm or bell system, your staff.
- Brief all staff, including supply staff, and practise the procedures.
- Set a date to review them, and review them whenever your site or staffing changes.
- Notify the SIA when the portal opens.
Common questions
Do staff need Martyn's Law training?
There is no mandated training or accredited course at the standard tier. Staff do need to know what each procedure means and what to do, so a clear briefing and a practice are what matter.
Do we need a terrorism risk assessment?
No. There is no formal terrorism risk assessment duty at the standard tier. You do need to work out how many people are reasonably expected on site at once.
Does Martyn's Law cover school events?
Events held on school premises, such as sports days, performances and open evenings, fall under the school's standard tier duty, even if a large audience attends. Your procedures should work on those days as well as on a normal school day. On off-site trips, the duty for the venue sits with that venue's own responsible person.
What are the penalties?
The SIA can issue compliance notices and, where these are not acted on, penalties. For standard tier premises the maximum penalty is £10,000, with a further daily penalty of up to £500 where a breach continues.
Where can I read the official guidance?
- Terrorism (Protection of Premises) Act 2025, legislation.gov.uk
- How Martyn's Law will affect education settings, Department for Education
- Understanding Martyn's Law and the SIA's role as regulator, SIA
- Terrorism (Protection of Premises) Act 2025: statutory guidance, Home Office
How BridgePacks helps
BridgePacks was built by LionbridgePR, a senior-led crisis communications agency that has helped organisations including easyJet, Oliver Bonas and Dorchester Hotels prepare for the worst. The questions and the wording come from two years of crisis workshops with more than 150 UK headteachers.
You answer a short online questionnaire about your school, and BridgePacks produces your four procedures in four editable Word documents, written for your site. Where something is not yet in place, the documents say so plainly and add it to your action list. If you would like to see one first, we will send you a sample pack.
