Martyn’s Law is now a reality, and your restaurant could be subject to its new legal requirements. Do you know whether your venue falls within the scope of the legislation, what duties it imposes, and the specific steps required to achieve compliance? These are critical questions every restaurant owner and operator should be addressing today.
The Security Industry Authority (SIA) is anticipated to begin enforcing the law as early as April 2027. Crucially, venues subject to Martyn’s Law must be fully compliant before this regulatory enforcement commences.
To ensure these safety duties are met, Martyn’s Law grants the SIA robust enforcement powers. If your restaurant falls short, the financial penalties for non-compliance can be severe: up to £10,000 for Standard Tier restaurants and up to £18m or 5% of qualifying worldwide revenue for Enhanced Tier venues. In the most serious cases - such as knowingly submitting false or misleading information or failing to comply with formal enforcement notices at enhanced duty premises or events - operators can even face criminal prosecution.
Achieving compliance is not an overnight task. Accurately determining your scope, assessing your current security procedures, addressing any operational gaps, and thoroughly documenting this process will take considerable time. For restaurants affected by the Act, the window to prepare is now. Acting early provides you the best chance to ensure your venue remains secure, legally compliant, and ready for enforcement without the stress of a last-minute rush.
Why do we have Martyn’s Law?
On 22 May 2017, a terrorist attack at the Manchester Arena tragically claimed the lives of 22 people. The subsequent public inquiry concluded that operators of public-facing venues and events needed to do more to protect individuals on their premises. It recommended that previously optional security practices be mandated by law to establish a baseline standard of public protection at venues such as restaurants.
Following the tireless campaigning of numerous individuals, including Figen Murray, mother of Martyn Hett, after whom the legislation is colloquially named, the Terrorism (Protection of Premises) Act 2025 was officially passed into law in April 2025.
What is Martyn’s Law?
Under Martyn’s Law, restaurants that, among other qualifying criteria, reasonably expect 200 or more people to be present at their premises at the same time (including staff) will be classified as ‘qualifying premises’.
For restaurants expecting between 200 and 799 individuals (including staff), the venue will fall into the Standard Tier. This means the individual or organisation in control of the premises, legally defined as the ‘Responsible Person’, must notify the SIA of their status. Crucially, you are legally required to establish and maintain four core Public Protection Procedures: evacuation, invacuation, lockdown, and communication.
Do you know whether your restaurant currently has the appropriate public protection procedures in place, what immediate actions you must take to establish them if not, and whether you have gathered and documented all the specific details the SIA will require for your formal notification? Every restaurant affected by the Act should be considering these essential questions today.
If your restaurant, among other qualifying criteria, occasionally or regularly expects 800 or more people to be present at the same time (including staff), it will likely be classified as an Enhanced Tier premises. In addition to Public Protection Procedures, enhanced venues must implement further ‘Public Protection Measures’. The Act does not prescribe a rigid checklist of specific measures you must implement. Instead, it outlines four broad categories: monitoring, physical security, the movement of people, and information security. The law requires you to implement measures within these categories that are ‘reasonably practicable’ for your specific site, balancing the security benefit against the cost and operational impact.
Finally, restaurants in the Enhanced Tier face stricter administrative requirements. If the Responsible Person is an organisation, they must designate a “senior individual” at the executive level to take responsibility for compliance. Furthermore, you must maintain a formal compliance document. This must include an effectiveness statement detailing exactly how your procedures reduce the risk of physical harm to the public, and how your implemented measures reduce the restaurant’s overall vulnerability to a terrorist attack.
Do you know whether your current security measures are appropriate and where your safety gaps lie? Have you determined what additional measures are “reasonably practicable” for your venue to address them? Have you formally documented exactly how your procedures and measures will reduce both the venue’s vulnerability to an attack and the risk of harm to the public?
If your restaurant falls into the Enhanced Tier, you should consider addressing these critical questions today. Taking proactive steps allows you to be fully prepared for the enforcement of Martyn’s Law.
While navigating these changes can feel daunting, getting started early provides the foundation needed to make the confident decisions necessary for compliance. Comprehensive support is available: the Home Office has published detailed statutory guidance complete with illustrative examples, while ProtectUK and the National Protective Security Authority offer valuable security resources.
James Chennells is Martyn’s Law regulatory lead at United Outcomes, a global leader in risk management.