Martyn’s Law and Access Control: What UK Premises Need to Know

Martyn’s Law is set to change how thousands of UK businesses, venues and public premises prepare for terrorist attacks and other serious security incidents.

Formally known as the Terrorism (Protection of Premises) Act 2025, the law was introduced following the Manchester Arena attack in May 2017. It is named after Martyn Hett, one of the 22 people killed in the attack, and follows years of campaigning by his mother, Figen Murray OBE.

The Act received Royal Assent on 3 April 2025. It is expected to come into force in spring 2027, although the exact commencement date will be confirmed by Parliament. Until then, organisations are not legally required to comply, but the implementation period gives those likely to fall within scope time to review their premises, responsibilities and emergency procedures.

For many premises, the main requirement will be better planning and staff awareness. Larger venues will have additional responsibilities that may include physical security, monitoring and measures controlling how people move into, out of and around a building.

Access control can support those arrangements, but it is important to be clear: no maglock, keypad, electric strike or security system makes a building “Martyn’s Law compliant” by itself.

What is Martyn’s Law?

Martyn’s Law is intended to improve protective security and organisational preparedness across England, Scotland, Wales and Northern Ireland.

It requires the people or organisations responsible for certain publicly accessible premises to prepare for a possible terrorist attack and take steps that could reduce the risk of physical harm.

The legislation introduces two levels of responsibility:

• The standard tier, generally covering qualifying premises where between 200 and 799 people may reasonably be expected to be present at the same time.

• The enhanced tier, generally covering qualifying premises where 800 or more people may reasonably be expected to be present.

Staff are included when assessing the number of people reasonably expected to be present. This is not necessarily the same as the building’s maximum theoretical or fire-safety capacity. Organisations need to consider the greatest number of people reasonably expected to be present at the same time, from time to time.

Qualifying public events with 800 or more people can also fall within the enhanced requirements. For an event to qualify, it must meet several conditions, including being open to the public and having entry conditions that are checked, such as ticket inspections.

Which premises could be affected?

The Act does not apply to every workplace or commercial building. A premises must satisfy the legal scope requirements, including its use and the number of people reasonably expected to be present.

The uses listed in the Act include:

• Shops and retail premises

• Restaurants, pubs and other food-and-drink premises

• Entertainment and leisure venues

• Sports grounds

• Hotels

• Visitor attractions

• Museums, galleries and libraries

• Places of worship

• Healthcare premises

• Childcare and education settings

• Public authority buildings

• Certain transport premises

The responsible person will usually be the individual, business or organisation that controls the premises for its relevant use. In a shopping centre, shared building or premises occupied by several organisations, more than one party may need to co-operate and co-ordinate.

The Government’s Martyn’s Law premises scope guidance provides more detail for organisations assessing whether they are likely to be included.

What will standard-tier premises need to do?

The standard tier generally applies where between 200 and 799 people, including staff, may reasonably be expected to be present at the same time.

The responsible person will be required to notify the Security Industry Authority, which will act as the regulator. They must also ensure that appropriate public protection procedures are in place, so far as reasonably practicable.

These procedures cover four areas:

Evacuation

Evacuation means moving people out of the premises, or away from part of it, to avoid an identified danger.

Plans should consider the available escape routes, who has authority to initiate an evacuation and how staff and visitors will be directed. Existing fire-evacuation arrangements may provide a useful starting point, but the safest response to a terrorist attack will not always be the same as the response to a fire.

Invacuation

Invacuation involves moving people to a safer location within the premises. This could include bringing people inside when a threat is outside or moving occupants away from a vulnerable entrance, window or public-facing area.

The chosen location and method will depend on the building, the nature of the threat and the number and needs of the people present.

Lockdown

Lockdown is the process of securing premises to prevent or restrict people entering or leaving. It could involve locking particular doors, closing shutters or using available barriers.

A lockdown procedure needs to be practical. Staff should understand who can initiate it, which areas are affected, how doors behave and how people will still escape if remaining in the building becomes unsafe.

Communication

Staff, visitors and contractors may need clear instructions during an incident. The communication procedure should establish how an alert will be raised, who will contact the emergency services and how instructions will reach people in different areas.

For standard-tier premises, the focus is predominantly on proportionate procedures and staff preparedness. The legislation does not automatically require physical building alterations or the purchase of new security equipment.

What are the enhanced-tier requirements?

Enhanced-tier premises and qualifying events will have the same responsibilities for notification and public protection procedures, but they will also have additional duties.

Where the responsible person is a company or organisation, it must designate a senior individual to oversee compliance. The responsible person must document its public protection procedures and measures and provide the required information to the SIA.

Enhanced-tier premises must consider reasonably practicable measures across four broad areas:

1. Monitoring the premises, event and immediate surroundings.

2. Controlling movement into, out of and within the premises.

3. Protecting the physical safety and security of the premises.

4. Protecting sensitive security information.

Depending on the premises and its assessment, relevant measures might include CCTV, searches, doors, shutters, controlled zones or screening arrangements. These are examples rather than a compulsory shopping list. Each organisation must decide what is appropriate and reasonably practicable for its particular risks, resources and building.

The enhanced-duty requirements published by the Home Office explain these responsibilities in more detail.

How can access control support Martyn’s Law planning?

Electronic access control can support a wider security plan by controlling who can enter particular areas and how doors respond during an incident.

Organisations reviewing their premises may want to consider:

• Which entrances are normally open to the public.

• Which doors separate public and staff-only areas.

• Whether sensitive or operational areas are properly protected.

• How quickly selected entrances can be secured.

• Whether the status of important doors can be monitored.

• What happens to electronic locks during a power failure.

• How authorised people can exit safely.

• How doors will operate during evacuation, invacuation and lockdown.

• Whether fire-safety and accessibility requirements are maintained.

Different doors require different locking arrangements. Our range of commercial access control products includes locking devices, door-release equipment, power supplies, keypads and supporting components for new systems and existing installations.

The correct arrangement must always be selected around the door, its use, the escape strategy and the wider security design.

Maglocks and lockdown arrangements

Electromagnetic locks, commonly known as maglocks, are widely used on access-controlled doors. They can provide controlled locking without requiring a conventional mechanical bolt to move into the frame.

Depending on the design, maglocks may be used on internal doors, entrance doors, gates and double-door arrangements. Monitored models can also provide door or lock-status information to a compatible control system.

Our maglocks and magnetic door locks include slimline, monitored, heavy-duty, double-door and external models. Different brackets and mounting arrangements are required depending on the door construction and opening direction.

For further information, read our guide to selecting the right maglock, brackets and accessories.

Maglocks should not simply be fitted to every doorway as a lockdown measure. Their operation must be considered alongside emergency release, fire safety, evacuation and accessibility. Securing a door against entry must not create an unacceptable risk to people who need to leave.

Electric strikes and controlled entry

An electric strike works alongside a compatible mechanical lock or latch to provide controlled door release.

Electric strikes can be useful where a conventional-looking door and mechanical locking arrangement are preferred. Depending on the selected hardware and system design, they may be used for controlled entry into staff areas, offices, healthcare environments and other restricted spaces.

The choice between fail-safe and fail-secure operation is particularly important. The correct selection depends on the door’s purpose, escape requirements, fire strategy and what should happen if power is lost.

View our range of electric strikes for access control doors.

Keypads, readers and controlled zones

Where a premises is divided into public, staff and restricted areas, access control credentials can help manage movement between zones.

A keypad or fob-reader system can allow authorised staff to enter controlled areas while restricting general public access. More advanced systems may provide timed permissions, central control or event records, depending on the equipment selected.

Access permissions should be reviewed regularly. Departed employees, lost fobs, shared codes and outdated user records can all weaken an otherwise well-designed system.

Emergency door release and safe exit

Lockdown and evacuation arrangements must be considered together. A door that helps restrict unauthorised entry must still operate safely when people need to escape.

Depending on the system and door design, this may involve suitable break-glass door-release devices, request-to-exit devices, correctly positioned controls and integration with other building systems.

Our range of exit buttons and door-release controls includes options for different access-controlled door arrangements.

The necessary release method should be established by the system designer, taking account of fire precautions, accessibility, door use and the agreed emergency procedures.

Power supplies and system resilience

An access control system depends on a suitable and correctly specified power supply.

When reviewing security arrangements, organisations should understand:

• Which doors rely on electrical power.

• What happens when mains power fails.

• Whether battery backup is provided.

• How long any backup is expected to operate.

• Whether faults are identified and reported.

• Who is responsible for testing and maintaining the system.

Our range of access control power supplies includes equipment for different locking and door-control applications. Voltage, current demand, battery capacity and the connected equipment must all be considered when specifying a power supply.

Preparing for Martyn’s Law

Businesses do not need to wait until commencement to start reviewing their arrangements. Early preparation does not necessarily mean purchasing new equipment. It begins with understanding the premises and how people would be protected during an incident.

A practical review could include:

1. Confirm whether the premises are likely to fall within scope.
   Review the building’s use and the number of staff, visitors and members of the public reasonably expected to be present.

2. Identify the responsible person.
   Establish which individual, company or organisation controls the premises for its relevant use.

3. Map the premises.
   Identify public entrances, escape routes, staff-only areas, vulnerable access points and potential invacuation locations.

4. Review the four public protection procedures.
   Consider evacuation, invacuation, lockdown and communication separately. One response may not be appropriate for every incident.

5. Check existing door and access-control equipment.
   Record how important doors lock, unlock and behave during power failure or emergency activation.

6. Speak with relevant specialists.
   Access-control, fire-safety and security professionals may all need to contribute where physical changes are being considered.

7. Make staff aware of the procedures.
   A written plan is of limited use if the people expected to carry it out do not understand it.

8. Test and review the arrangements.
   Premises, staff and risks change. Procedures should be reviewed following alterations, incidents, staffing changes or lessons learned during exercises.

9. Keep appropriate records.
   Enhanced-tier premises will have specific documentation requirements, while sensible records can also help standard-tier organisations demonstrate that their arrangements have been properly considered.

Common mistakes to avoid

One of the biggest mistakes would be treating Martyn’s Law as a requirement to buy a particular security product. The Government and SIA do not approve or endorse private products as “Martyn’s Law compliant”.

Other mistakes include:

• Assuming the Act only affects arenas and major stadiums.

• Using a building’s theoretical capacity without considering reasonable attendance.

• Preparing an evacuation plan but overlooking invacuation or lockdown.

• Installing additional locks without considering safe escape.

• Failing to include staff when assessing occupancy.

• Leaving emergency procedures in a folder without informing employees.

• Allowing door permissions, key codes or fob records to become outdated.

• Treating physical security, fire safety and accessibility as separate issues.

Good preparation brings these areas together rather than allowing one objective to undermine another.

Building a proportionate access control system

Every premises is different. A small shop, hospital, hotel, university building and entertainment venue will not need identical procedures or security equipment.

A proportionate system may use a combination of controlled doors, maglocks, electric strikes, keypads, door-release devices, monitoring and backup power. The components should be selected as part of the wider security and emergency plan, not in isolation.

Door Access Supplies provides access control components for installers, engineers, facilities teams and businesses across the UK. Our ranges cover locking equipment, release devices, power supplies and system accessories for both new installations and upgrades to existing doors. Use our Build Your Own Access Control System to only purchase the components you need.

Martyn’s Law creates a useful reason for organisations to examine how their premises actually operate during an emergency. The most effective preparation will come from clear procedures, trained staff and security equipment that supports the plan without compromising safe escape.

This article provides general information and is not legal, counter-terrorism, fire-safety or site-specific security advice. Organisations should consult the current Home Office statutory guidance, ProtectUK resources and appropriately competent professionals when assessing their responsibilities and premises.