The Terrorism (Protection of Premises) Act 2025—more commonly known as Martyn’s Law—will introduce new legal responsibilities for organisations responsible for certain publicly accessible premises and events.
Named in memory of Martyn Hett, one of the 22 people killed in the Manchester Arena attack, the legislation aims to ensure businesses are better prepared to protect employees, visitors and members of the public in the event of a terrorist incident.
Although Martyn’s Law is not yet in force, the Government has published statutory guidance and confirmed an implementation period of at least 24 months from Royal Assent on 3 April 2025. Organisations likely to fall within its scope should use this time to understand their responsibilities and begin preparing. Government guidance makes clear that businesses may wish to start considering the requirements before the legislation formally commences.
Which organisations will be affected?
Martyn’s Law does not automatically apply to every corporate office or workplace. It principally applies to qualifying premises used for activities listed within the Act, where members of the public may be present.
The legislation establishes two principal tiers:
- The standard tier applies to qualifying premises where between 200 and 799 people, including employees, may reasonably be expected to be present at the same time.
- The enhanced tier generally applies where 800 or more people may be present at the same time.
Qualifying public events attended by 800 or more people may also come within the enhanced requirements where entry controls are in place.
Corporate groups operating shops, hotels, leisure facilities, conference venues, healthcare environments, visitor attractions or other publicly accessible locations should therefore assess each site individually. A single organisation may be responsible for several premises, but the risks and necessary procedures may differ from one location to another.
Why businesses should act now
Preparing for Martyn’s Law should not be viewed simply as another compliance exercise. At its heart, the legislation is about ensuring organisations can respond quickly and effectively when lives may be at risk.
Businesses need to consider how they would:
- Evacuate people away from danger.
- Move people to a safer area within the premises—known as invacuation.
- Lock down all or part of a building.
- Communicate clear and timely information during an incident.
For enhanced-tier premises and qualifying events, organisations will also need to consider appropriate measures to reduce their vulnerability to attack and limit the risk of physical harm.
This requires more than producing a written policy. Businesses must understand who is on their premises, control how different areas are accessed and ensure that accurate information is available to those managing an emergency.
Knowing who is on site
One of the greatest challenges during any emergency is establishing who is actually present.
Employees may work across different locations, while contractors, agency workers and visitors may arrive and leave throughout the day. Paper visitor books and disconnected systems can quickly become inaccurate, particularly across large or multi-building sites.
Ceequel Visitor Management System provides a controlled and auditable process for managing visitors and contractors. Visitors can be pre-registered before arrival, issued with appropriate site information and recorded as they enter and leave.
Contractor documentation—including RAMS, Public Liability Insurance and other compliance records—can also be managed within the system, helping organisations strengthen their wider site-control processes.
Controlling access across the organisation
Ceequel Access Control allows businesses to manage who can enter particular buildings, rooms and controlled areas.
Access permissions can be defined by person, department, role, location or time of day. Lost cards and fobs can be cancelled immediately, temporary permissions can expire automatically, and facial recognition templates can be removed from connected devices centrally.
For organisations with multiple locations, access policies can be managed from a central point while still allowing authorised local administration. This helps create consistency across a corporate estate without ignoring the individual operational requirements of each site.
When planning for Martyn’s Law, access control can also form part of a wider strategy for evacuation, invacuation and lockdown. Depending upon the organisation’s agreed procedures and system configuration, doors and controlled areas can be managed to help direct people away from danger or prevent access to higher-risk areas.
Providing accurate emergency attendance information
Ceequel Fire Register brings employee, visitor and contractor attendance information together to provide an accurate, real-time view of who is believed to be on site.
The system can identify which building or area an individual last entered and provide emergency information to authorised personnel. Photographs can also assist with identification, while mobile access allows information to remain available away from a fixed reception desk or computer.
Although originally designed to support fire evacuation, accurate attendance information can form an important part of broader emergency preparedness. Knowing who may still be inside a building, who has arrived as a visitor and where people were last recorded can support a more informed response.
Bringing systems and procedures together
No single piece of software can make an organisation compliant with Martyn’s Law. Legal responsibility remains with the organisation or individual responsible for the qualifying premises or event.
Technology can, however, provide the visibility, control and evidence needed to support well-designed procedures.
By integrating Ceequel Access Control, Ceequel Visitor Management System and Ceequel Fire Register, organisations can create a more joined-up approach to:
- Managing employees, visitors and contractors.
- Controlling access to buildings and restricted areas.
- Maintaining real-time attendance information.
- Supporting evacuation, invacuation and lockdown procedures.
- Managing multiple locations through a central system.
- Demonstrating that security and emergency processes have been properly considered.
Preparation should begin before the deadline
Martyn’s Law represents an important change in how organisations approach public protection. Those that begin preparing now will have time to assess their premises, identify weaknesses, review responsibilities and test their procedures properly.
The objective should not be to do the minimum necessary to satisfy legislation. It should be to create an environment in which employees, visitors, contractors and members of the public are better protected—and where those responsible for managing an emergency have accurate information when every second matters.
Ceequel can assist organisations on that journey by bringing access control, visitor management and real-time emergency attendance information together within one integrated platform.