Martyn's Law is coming.
Have your records ready.

Yes. Protect Duty was the earlier working name. The public name is Martyn's Law, and the legislation is the Terrorism (Protection of Premises) Act 2025.

It applies if your premises is wholly or mainly used for a Schedule 1 use and 200 or more people, including staff, may reasonably be expected to be there at the same time, from time to time. Schedule 1 covers shops, food and drink, entertainment and leisure, sports grounds, halls, hotels, places of worship, education, healthcare, transport, visitor attractions, public authority buildings, and more. Your fire safety adviser, security adviser, or insurer can help you work out the answer, and our premises-type pages walk through how the count works for hotels, pubs, places of worship, and more. Duty Room keeps the assessment record and the evidence with the site.

Standard tier (200-799) is procedures, notification, and staff awareness. The procedures themselves: evacuation, invacuation, lockdown, and communication. Enhanced tier (800+) adds public protection measures across four areas (monitoring, movement, physical security, information security), a designated senior individual who manages the affairs of, or controls, the organisation (the responsible person, not a lower-level employee), and a tailored compliance document submitted to the SIA. Two premises types stay standard tier whatever their numbers: premises used principally as a place of worship, and premises used for childcare or primary, secondary or further education. Penalties differ too. Standard tier maxes at £10,000 plus £500 a day. Enhanced tier maxes at £18 million or 5% of qualifying worldwide revenue, plus £50,000 a day.

Once duties are commenced, notify the SIA when you become responsible for the premises and put the four public protection procedures in place: evacuation, invacuation, lockdown, and communication. Make sure your staff are aware of them and ready to implement them. Standard tier doesn't require physical measures or a formal terrorism risk assessment, and submits no compliance document to the SIA; the standard-tier filings are the notification and any later corrections to it. The Home Office estimates standard tier compliance at around £330 a year, mostly in staff time.

Everything in the standard tier, plus public protection measures across four areas (monitoring, movement, physical security, information security), a designated senior individual who manages the affairs of, or controls, the organisation (the responsible person, not a lower-level employee), and a tailored compliance document setting out an assessment of how your procedures and measures reduce vulnerability and harm. The document is submitted to the SIA, kept under review, and provided to the SIA within 30 days of any revision.

The Act received Royal Assent on 3 April 2025. Substantive duties are not yet in force. They will commence after 3 April 2027; the exact date has not been set, and the SIA says it is working toward spring 2027. The Home Office first published statutory guidance in April 2026, and the notification rules followed in July 2026. The SIA's consultation on its regulatory guidance closed on 12 June 2026, with the final version and consultation report planned for autumn 2026.

Not yet, and you can't: the portal isn't open. The deadlines are set, though. Premises responsible on commencement day get three months to notify. After that first window, becoming or ceasing to be responsible is a 28-day notification, and information that goes out of date must be corrected within 28 days. Qualifying events run on a 14-day clock. The SIA plans volunteer testing of the portal in early 2027. Our notification briefing sets out every deadline and the full data checklist.

More than a name and address. The July 2026 rules ask for every responsible person with their contact and registration details, anyone else with control of the premises, and who submits and on whose authority. They ask for the Schedule 1 use, the greatest number reasonably expected at the same time and how you calculated it, and the websites and social accounts that advertise the premises. Then the licensing details: your alcohol licence, temporary licences or notices, entertainment permissions, and sports-ground safety certificates, whether in force, applied for, or notified, with their dates and authorities. Gathering that once, and keeping it current, is most of the work.

Only by invitation. The SIA is running voluntary pilot inspections to test its approach before the duties commence; statutory inspections and enforcement can't begin until the law is in force. It has said it will typically give at least 72 hours' notice before an on-site inspection, and that inspections will check declared procedures are in proper use and familiar to the staff who rely on them. Our SIA inspection briefing covers what to expect.

The Home Office has said operators don't need to spend money on consultants to be compliant. Neither the Home Office, the SIA, nor the National Counter Terrorism Security Office endorses any third-party product. Duty Room is operational support: somewhere to keep the assessment, the procedures, the training records, and the drill log.

No. The Home Office's statutory guidance, published in April 2026, is what you follow. The SIA's regulatory guidance is due in final form in autumn 2026, and the SIA will publish notification portal instructions before commencement. ACT Awareness and SCaN, free from ProtectUK, are the most widely available training options; the statutory guidance does not mandate a specific programme. Duty Room helps you keep a record of what you've done.

It can. Insurers and brokers are publishing analyses of Martyn's Law and starting to ask policyholders about preparation. Pool Re's terrorism reinsurance scheme historically offered a premium discount for a security self-assessment, but that scheme (VSAT) closed on 31 March 2026; its replacement supports evidence-led conversations with insurers rather than an automatic discount. Either way, a clean record of procedures, training, and drills gives you something concrete to show at renewal, and to help defend a claim.

Invite them in and they see the same live view of records, tasks, and evidence. No extra cost.

Secure AWS data centres in the UK. Your data never leaves the country.

Everything. Your data is yours.