Lawbite: Real estate reinvented - Navigating the new norms under the Terrorism (Protection of Premises) Act

Summary

On 3 April 2025, the Terrorism (Protection of Premises) Act 2025 (the Act) received Royal Assent having first been introduced to Parliament on 12 September 2024. The Act, known as ‘Martyn’s Law’, in tribute of Martyn Hett who was killed alongside 21 others in the 2017 Manchester Arena attack, aims to improve public safety by imposing a legal duty on those responsible for qualifying premises and events to implement measures that reduce the risk of harm during terrorist attacks.

The Act aims to protect those attending larger premises and events by improving protective security and organisation preparedness in response to terrorist attacks.

There isn’t yet an obligation to comply with the requirements of the Act. The Government has put in place a 24 month implementation period, during which time it has promised to publish statutory guidance to assist those responsible under the Act. Those responsible for premises and events in scope need to have understood their new obligations, and have planned and prepared appropriately in good time for the end of the implementation period.

The Security Industry Authority (SIA) has been confirmed as the new regulator, which will support enforcement of the new regime.

The Act has a wide reach and, as such, the development will be of interest to all UK property owners and occupiers with premises with a capacity of 200 or more people.

Which premises/events are affected?

The Act applies to those who control qualifying premises and events in UK that are fully or partly open to the public. This includes premises consisting of a building (and other land) whereby it is wholly or mainly used as a shop, restaurant, sports ground, library, museum, gallery, hall, hotel, place of worship, hospital, bus and railway station, school, college and university.

The Act establishes a tiered approach, linked to the number of individuals that can reasonably be expected to be present at the same time at the premises and event. This approach acknowledges that larger venues and events may be impacted to a greater extent by an attack and should be expected to do more.

Standard duty premises: 

Where 200 – 799 people may be present (including staff) those responsible will need to notify the SIA of their premises and, so far as is reasonably practicable, put in place public protection measures to be followed by staff. The objective being to reduce the risk of physical harm to individuals who may be present if any act of terrorism were to occur at the premises or event. There is no requirement to put in place physical measures. There is power in the Act to reduce the minimum number of people to be a qualifying premises from 200 to 100.

The standard duty only applies to premises. Events where fewer than 800 people can be reasonably expected to be present are out of scope.

Enhance duty premises/events:

Premises or events where 800 or more people (including staff) may be present are subject to the standard duty requirements and additional obligations which include measures relating to monitoring the premises and surrounding area for threats, documenting the protection procedures and measures and providing this to the SIA, and the physical safety and security of the premises.

Certain premises and events are expressly excluded from scope. These include certain parks, recreation grounds and open air premises used for recreation or leisure provided that attendance at these premises is not paid for or ticketed etc.

Who is responsible?

The person responsible for qualifying premises or events is the person who has control of the premises in connection with its use. Where premises are let, this will be the tenant. However, in some circumstances, for instance a shop within a shopping centre, the tenant and the property owner would each be responsible persons and must co-ordinate and co-operate in complying with the requirements imposed.

Where more than one person is responsible for a premises or an event they can act jointly in complying with a requirement imposed on them. Where more than one use is made of a premises or an event (e.g. a church that also has a creche), the responsible person will be the person in control of the principal use at the premises.

Consequences of non-compliance:

The SIA, as regulator, will enforce the regime, supporting, advising and guiding those responsible for premises and events in meeting the requirements of the legislation.

Penalties for non-compliance include substantial fines and criminal penalties. The SIA will have power to issue compliance notices, restrict venue operations for non-compliance, and levy financial penalties. Responsible persons that fail to comply run the risk of facing regulatory inspections and substantial fines, ranging from £5,000 to £18 million or 5% of global revenue for enhanced tier premises or events. Daily penalties may also be given for each day on which a contravention continues up to £50,000. Non-compliance with certain parts of the Act (for example failure to comply with a compliance notice) carry criminal penalties, including imprisonment.

What's next

• The 24 month implementation period will allow the SIA’s new function to be established and UK property owners and occupiers with premises in scope of the Act to put new procedures and measures in place
• It is hoped the guidance promised by the Government will assist those who fall in scope to comply with the requirements of the Act
• The First-Tier tribunal will have jurisdiction to determine various matters under the Act. For instance, whether premises are qualifying premises, whether an event is a qualifying event, whether they are enhanced duty premises and the relevant use of the premises

Listen to our latest podcast episode for an in-depth discussion on the new framework.