Martyn’s Law: key points for higher education providers

The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, introduces new duties on those responsible for publicly accessible premises and events. With statutory guidance now published, higher education providers should be working on their plans for how the regime will apply across their estates.

Background

Martyn’s Law follows the Manchester Arena attack in May 2017. The Act is named after Martyn Hett, one of the victims.  His mother, Figen Murray, has led a sustained and widely recognised campaign for improved protective security and preparedness in publicly accessible venues. The legislation is focused on improving preparedness and consistency, requiring organisations to consider how they would respond to a terrorist incident and take proportionate steps to reduce harm. The emphasis throughout is on reasonable, practical measures rather than creating high security environments.

Application to higher education

Universities and colleges are expressly within scope. The guidance recognises that higher education premises are often publicly accessible and frequently used for events, meaning they are treated in the same way as other in scope venues. Importantly, the regime applies at the level of individual premises or events. Different parts of a university estate may fall into different tiers depending on use and capacity. There is no single classification for an institution as a whole. This is particularly relevant for the sector, where estates often include a mix of teaching space, accommodation, public facing buildings, event venues and external sites.

The tiered approach

The Act introduces two tiers based on the number of people reasonably expected to be present at any one time, including staff.

Standard tier (200 to 799 people)

• For premises or events where between 200 and 799 people are expected, the duties are designed to be straightforward and low burden.
• Dutyholders must put in place proportionate public protection procedures, such as evacuation, lockdown and communication plans, and ensure staff are aware of them.
• The focus is on preparedness rather than physical security measures.

Enhanced tier (800 or more people)

• Where 800 or more people are expected, additional and more formal requirements apply.
• These include a documented risk assessment, a security plan, a designated senior individual and consideration of further protective security measures where reasonably practicable.
• For many providers, enhanced tier obligations are more likely to arise in relation to larger venues or events such as conferences and graduations.

Governance and regulation

The Security Industry Authority (SIA) will regulate the regime, with monitoring and enforcement powers including information requests, inspections and, in serious cases, financial penalties of up to £18 million or 5% of worldwide revenue.  Further detail on its approach is expected, but the current indication is that it will take a supportive, guidance-led role, particularly during the implementation period. The statutory guidance is central, and institutions will need to be able to demonstrate that their approach is reasoned, proportionate and informed by that guidance.

Practical steps to take now

Although the regime is not expected to be fully in force until around 2027, early preparation is encouraged. Key actions include:

• Review existing procedures: assess current emergency and security arrangements against the standard tier requirements
• Clarify governance: identify responsible individuals and ensure roles are clear across estates, security and events teams
• Map and assess risk: identify publicly accessible and high footfall areas and carry out proportionate risk based assessments
• Test scenarios: use simple scenario planning and tabletop exercises to identify gaps in procedures
• Build awareness: roll out consistent staff training, making use of free ProtectUK resources

Final thoughts

For higher education providers, the main challenge will be applying a proportionate but consistent approach across diverse estates, from open campus spaces to residential or event settings.

The direction of travel is clear. Institutions that prepare in advance will be better placed to embed practical, sustainable compliance well ahead of the implementation deadline.

Our content explained