TL;DR
Martyn’s Law is about protective security and immediate incident response to terrorism. A Business Continuity Plan (BCP) is about keeping the organisation running after any disruption. They connect, but they are not the same. Update your BCP to handle the impacts that a terrorism incident could create (loss of site, loss of people, reputational pressure), and make sure your emergency/venue response plan hands off cleanly to crisis management and continuity. The law is not yet in force; there will be at least a 24‑month implementation period from April 2025 and statutory guidance will follow.
Sources: Home Office factsheet; ProtectUK overview; legal commentary from Eversheds Sutherland and FTB Chambers.
Home Office | ProtectUK | Eversheds Sutherland | FTB Chambers
Quick background: what Martyn’s Law is (and is not)
Martyn’s Law, formally the Terrorism (Protection of Premises) Act 2025, aims to improve protective security and organisational preparedness at publicly accessible premises and qualifying events. It requires those responsible to consider how they would respond to a terrorist attack, and for larger venues to take proportionate steps to reduce vulnerability. The Act received Royal Assent on 3 April 2025; the government has signalled an implementation period of at least 24 months before it comes into force, with statutory guidance to be published to help duty‑holders comply. A new regulatory function within the Security Industry Authority (SIA) will support, advise and enforce.
Sources: Home Office factsheet, ProtectUK.
The regime is tiered by expected capacity. Current explanations from legal commentators indicate a standard duty for premises of roughly 200–799 capacity and an enhanced duty at 800+ for premises/events that are wholly or mainly open to the public, with private gatherings excluded. Always check final statutory guidance for definitive thresholds and scope.
Sources: Eversheds Sutherland, Home Office factsheet.
The misconception: “Isn’t this a BCP problem?”
It’s understandable that people conflate Martyn’s Law with continuity. Both sit under the resilience umbrella and both may be triggered by the same event. But their purposes are different.
- Martyn’s Law: ensure a suitable immediate response to a terrorist incident (for example evacuation, invacuation, lockdown, staff awareness and coordination).
- Business Continuity: keep the business operating when an incident of any type crosses your risk thresholds, focusing on recovery and continuity of services.
In other words, Martyn’s Law covers the moment of attack and the immediate aftermath in terms of life safety and protective security. BCP covers how you operate once that immediate phase stabilises.
Sources: Home Office factsheet, ProtectUK.
How the two interact in practice
A terrorism incident can create continuity impacts, but not always. Your BCP should care about the effects, not the cause. Typical effects that may flow from a Martyn’s Law‑type incident include:
- Loss of access to a venue (damage, police cordon, HSE restrictions).
- Loss or unavailability of staff (injury, trauma, absence).
- Reputational and stakeholder pressure requiring sustained crisis communications.
- Legal, insurance or contractual pressures that affect how and where you operate.
Treat the terrorism incident as a cause that could trigger one or more of these effects; plan continuity around the effects.
Five practical updates to align your BCP with Martyn’s Law
1) Understand the effects you might face
Your security risk assessment may consider attack scenarios such as attacks at ingress/egress points, queues, inside event spaces, on perimeters, or coordinated multi‑site activity. For continuity purposes, translate these into operational impacts: loss of site, loss of people, regulatory constraints, and reputational pressure.
2) Decide whether and how such incidents threaten your ability to operate
Ask practical questions. If the primary venue is inaccessible for weeks, where do you go? If 20% of your events team is traumatised and unavailable, how do you deliver? If public scrutiny is intense, who leads messaging and with what sign‑off cadence? Categorise impacts into a handful of continuity scenarios rather than trying to plan for every plot variant.
3) Build recovery strategies that are incident‑agnostic
For each impact scenario, define how you will continue operations: alternative venues and suppliers, remote or hybrid delivery models, scaled‑down service menus, staff substitution and surge arrangements, and structured support for affected employees (including psychological support and phased return).
4) Create a clean hand‑off from emergency response to continuity
Document who owns immediate response at the venue, what they must do (evacuation, invacuation, lockdown), who they notify, and when the situation escalates to crisis management and BCP. Keep roles and decision rights crystal‑clear so protective security, crisis leadership and continuity complement each other rather than clash.
5) Prepare, test and embed
Train staff, practise evacuation/invacuation/lockdown, and run exercises that test leadership decisions, relocation, communications, managing misinformation, media pressure and staff wellbeing. Include suppliers and partners so that your recovery plan works beyond your four walls.
Roles and boundaries that stop you tripping over yourself
- Protective security: preventing and responding to malicious threats (the core of Martyn’s Law).
- Emergency response: life safety actions on the ground.
- Crisis management: leadership, coordination and messaging.
- Business continuity: operational recovery and service delivery.
Define a single chain of command that all plans reference. This is the simplest way to avoid duplicated or conflicting playbooks during a high‑stress incident.
Cost and proportionality
The Act is designed to be proportionate. Government communications emphasise practical, accessible steps and upcoming statutory guidance to help duty‑holders comply without necessarily purchasing specialist services. Focus on clarity of roles, rehearsed procedures and targeted training first.
Don’t overlook trauma support
After any violent incident, people come first. Plan for trauma‑informed support, liaison with families, phased return‑to‑work, and the reality that some staff may not be able to return to the same roles quickly, if at all. This is not just humane; it is essential to continuity.
Realistic exercising that goes beyond the immediate incident
Design table‑top and live exercises that simulate:
- Multi‑week site loss and alternative venue activation.
- Senior leader unavailability.
- Media pressure and social media misinformation.
- High call volumes from customers and partners.
- Staff trauma, turnover and recruitment constraints.
- Insurance, regulatory and contractual consequences.
Test the organisation’s ability to cope, not the attacker’s tactics.
Quick checklist
- Map terrorism‑related security scenarios to operational impacts your BCP cares about.
- Define a clean hand‑off from emergency response to crisis and continuity.
- Pre‑agree relocation, staffing and supplier options for extended site loss.
- Prepare trauma‑informed people plans and communications lines to take.
- Exercise end‑to‑end with real decision‑makers and external partners.
- Keep an eye on forthcoming statutory guidance and regulator updates.
FAQs
Is Martyn’s Law in force today?
No. The Act received Royal Assent on 3 April 2025, with an implementation period of at least 24 months before commencement. Statutory guidance will be published during that period.
Who regulates it?
A new function within the Security Industry Authority (SIA) will act as the regulator, supporting, advising and enforcing proportionately.
Which premises and events are in scope?
The Act applies to certain publicly accessible premises and ticketed events; private gatherings are excluded. Scope is tiered by expected capacity, with standard and enhanced duties aligned to venue size. Always consult the latest guidance for definitive thresholds and inclusions.
Does Martyn’s Law replace my fire, health and safety or BCP requirements?
No. It adds counter‑terrorism preparedness alongside your existing safety and resilience obligations. Integrate plans, but keep their purposes distinct.
Final thought
Think of Martyn’s Law as your immediate protective response capability, and your BCP as your recovery and continuity capability. Both matter. Both should be rehearsed. But they solve different problems. Keep them aligned and you will protect people better and recover faster.
