Written by: Paul Foster, Founder, CEO, OnePlan
Key Points For UK Venues And Events
- Protect Duty (Martyn’s Law) is UK legislation that requires public venues and events with 200+ capacity to use proportionate counter-terrorism security measures from April 2027.
- The law creates two compliance tiers: Standard (200–799 people) with protection procedures, and Enhanced (800+ people) with added physical security measures and formal documentation.
- Organizations must confirm if they are in scope, assess terrorism risks, create response plans, train staff, and notify the Security Industry Authority within set timeframes.
- Non-compliance can lead to fines up to £18 million for enhanced tier venues, daily penalties of £50,000, and potential criminal liability for senior individuals.
- OnePlan provides to-scale site planning tools that support Protect Duty compliance. Book a demo today to see how accurate mapping and documentation can streamline your preparation.
What Is Protect Duty (Martyn’s Law)?
Protect Duty, also known as Martyn’s Law, is UK counter-terrorism legislation that requires public venues and events to use proportionate protective security measures to keep people safe from terrorist attacks. The legislation is formally titled the Terrorism (Protection of Premises) Act 2025 and received Royal Assent on 3 April 2025.
The Act is named in memory of Martyn Hett, one of 22 people killed in the Manchester Arena attack on 22 May 2017. His mother, Figen Murray OBE, led a national campaign for the law, including a 200-mile walk from Manchester to Downing Street in May 2024. The Act implements recommendations from the Manchester Arena Inquiry, which identified serious gaps in how public venues prepared for and responded to terrorist threats.
Important distinction: Protect Duty in the UK refers to counter-terrorism obligations for venues and events. It is separate from the US mental health concept of “duty to protect,” which relates to therapists’ confidentiality obligations under the Tarasoff doctrine. This article focuses only on the UK counter-terrorism legislation.
Why The UK Introduced Protect Duty
The Manchester Arena attack exposed critical weaknesses in UK public venue security. The Manchester Arena Inquiry highlighted “missed opportunities” to prevent the attack and recommended that “a Protect Duty should be enacted into law by primary legislation.” Volume 1 of the Inquiry, published in June 2021, described a “blind spot” in video surveillance at the Arena that allowed the bomber to loiter undetected.
Since 2017, the UK has experienced 15 terror attacks and 39 disrupted plots. The law sets consistent security standards across public venues and events to reduce vulnerability and improve response capabilities. Home Secretary statements confirm that the legislation “delivers upon the lessons from the Manchester Arena Inquiry to keep people safe.”
Where Protect Duty Applies In Practice
Protect Duty applies to publicly accessible premises and events across the UK where it is reasonably expected that 200 or more people could be present at the same time. Typical examples include:
- Music festivals, concerts, and cultural events
- Sports events and stadiums
- Shopping centers, retail venues, and restaurants
- Hotels, entertainment venues, and visitor attractions
- Places of worship (capped at standard tier regardless of capacity)
- Transport hubs and public buildings
Capacity thresholds carry the most weight. As the statutory guidance explains, a modest village hall that hosts events for 250 people falls within scope. A large warehouse with twelve staff does not fall within scope. The responsible person is usually the individual or organization that controls the premises or event. Local government authorities, event organizers, and venue operators often share responsibility for compliance.
To see how OnePlan can help you map your venue and plan for compliance, book a short demo today.
Protect Duty Tiers And What They Require
Protect Duty creates two tiers based on expected capacity. The table below summarizes the key requirements at each tier, based on the Home Office enhanced duty factsheet and ProtectUK guidance.
| Requirement | Standard Tier (200–799) | Enhanced Tier (800+) |
|---|---|---|
| Public protection procedures | Required | Required |
| Public protection measures | Not required | Required |
| Documented risk assessment | Not required | Required |
| SIA notification | Required | Required |
| Designated senior individual | Not required | Required |
Standard Tier (200–799 people): This tier requires appropriate public protection procedures covering evacuation, invacuation, lockdown, and communication. These are procedural requirements such as staff training, clear response plans, and communication protocols. Physical security measures are not mandated at this tier.
Enhanced Tier (800+ people): This tier includes all standard tier requirements and adds further obligations. Public protection measures fall into four categories:
- Monitoring the premises and vicinity, such as security patrols and CCTV
- Controlling movement of individuals, such as zoned access and screening
- Physical safety and security, such as vehicle security barriers
- Security of information, including how sensitive plans and data are stored
Enhanced tier organizations must also document all procedures and measures, notify the Security Industry Authority (SIA), and appoint a senior individual responsible for compliance. Senior individuals at enhanced-tier organizations face personal criminal liability where breaches involve consent, connivance, or neglect.
Step-By-Step Protect Duty Compliance Checklist
The Home Office statutory guidance was published on 15 April 2026 to give organizations time to prepare before commencement. Use this roadmap as a practical starting point:
- Confirm if you are in scope. Calculate your maximum expected capacity using the official methodology in the statutory guidance.
- Identify your tier. Decide whether your premises or event falls into the standard tier (200–799) or the enhanced tier (800+).
- Carry out a terrorism risk assessment. Identify vulnerabilities that relate specifically to your venue or event layout and operations.
- Develop public protection procedures. Document evacuation, invacuation, lockdown, and communication plans in clear, practical language.
- For enhanced tier, implement protective measures. Consider CCTV, bag search policies, vehicle barriers, and monitoring procedures that match your risk profile.
- Train your staff. Make sure all team members understand response procedures. Free training is available through ProtectUK, including ACT Awareness and SCaN e-learning.
- Create accurate, to-scale site plans. Show entry and exit points, crowd areas, security infrastructure, and evacuation routes on a single plan.
- Record your approach. Enhanced tier premises must keep a written compliance document and provide it to the SIA within 30 days of any revision.
- Notify the SIA. Qualifying premises must submit their initial notification within three months of the commencement day. Qualifying events must notify within 14 days of the event first being publicized.
- Review regularly. Update your plans as your venue, events, or risk profile change.
Accurate site planning sits at the heart of compliance. You need to-scale maps that show crowd capacities, security infrastructure placement, evacuation routes, and communication zones in one clear view. OnePlan gives you that visual foundation and keeps it easy to update.
Key Dates And Current Status Of Protect Duty
The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. The implementation period is at least 24 months, so substantive requirements will not commence before April 2027. The Security Industry Authority (SIA) will act as the regulator.
Implementation is rolling out in stages:
- The Commencement No. 1 Regulations brought section 27 (guidance) into force on 10 April 2026.
- The Commencement No. 2 Regulations, made on 10 June 2026, brought the SIA’s guidance functions into force on 15 June 2026.
- The Home Office published statutory guidance on 15 April 2026.
Organizations in scope now have a clear timeline and official guidance. Early preparation allows you to spread costs, test procedures, and refine plans before the law takes effect.
Penalties For Ignoring Protect Duty
The SIA will enforce Protect Duty using a range of powers:
- Standard tier breaches: Fines up to £10,000
- Enhanced tier breaches: Fines up to £18 million or 5% of worldwide revenue (whichever is greater)
- Daily penalties: Up to £50,000 per day for continuing non-compliance
- Restriction notices: Powers to prevent a venue opening or an event proceeding
- Personal liability: Criminal liability for senior individuals at enhanced-tier organizations where breaches involve consent, connivance, or neglect
These sanctions sit alongside wider consequences such as reputational damage, insurance complications, and increased risk to public safety. In extreme cases, unsafe environments may not be allowed to operate, which can lead to event cancellation or venue closure until compliant.
How OnePlan Supports Your Protect Duty Planning
OnePlan provides a visual, to-scale way to plan event sites and venues, and it works well for documenting your Protect Duty approach. These features connect directly to the steps in your compliance checklist:
- To-scale site plans: Create accurate maps that show entry and exit points, crowd areas, security infrastructure, and evacuation routes on live satellite or street maps. These plans support your risk assessment and your written procedures.
- Crowd capacity calculator: Outline any area and instantly calculate safe standing capacity. This directly supports your tier determination and helps you evidence how you calculated capacity.
- Bill of Quantities: Automatically generate inventory lists for security infrastructure such as barriers, fencing, and CCTV positions. These lists feed into your public protection measures and budget planning.
- Real-time collaboration: Share one live plan with security teams, local authorities, and Safety Advisory Groups. Everyone works from the same version, which reduces confusion and speeds up approvals.
- Exportable documentation: Produce professional, high-resolution maps for permits, SIA submissions, and stakeholder presentations. This keeps your documentation consistent and easy to share.
OnePlan has powered 200,000 events in 150 countries, from community festivals to the Paris 2024 Olympic Games. Silverstone uses OnePlan to plan the Formula 1 British Grand Prix and achieved a 13x return on investment. The Tour of Britain reduced site visits by 75% and saved more than 300 hours each year.
Ready to streamline your Protect Duty documentation and site planning? Book a 15 minute demo to see OnePlan’s tools in action.
Frequently Asked Questions About Protect Duty
What Does Protect Duty Aim To Achieve?
Protect Duty aims to improve public safety by requiring venues and events to use proportionate protective security measures against terrorist attacks. The objective is preparedness and public protection, with a focus on reducing harm if an attack occurs. The legislation concentrates on practical procedures and measures so staff know how to respond and can reduce the risk of physical harm.
How Do I Work Out My Venue’s Capacity For Protect Duty?
You calculate capacity by using the methodology in the statutory guidance, which considers the maximum number of people reasonably expected at one time. This includes ticketed attendance, staff, contractors, and others on site. Once you have that figure, you can see whether you fall into the standard tier or enhanced tier and plan your procedures and measures accordingly.
What Is The Difference Between A Qualifying Premises And A Qualifying Event?
A qualifying premises is a fixed location, such as a stadium, arena, shopping centre, or visitor attraction that meets the capacity threshold. A qualifying event is a specific activity or gathering, such as a festival or concert, that meets the threshold even if it uses temporary infrastructure. Both must follow the relevant tier requirements, but events also have specific notification timelines.
How Do The Tiers Work In Practice?
The standard tier covers premises and events with an expected capacity of 200–799 people and focuses on public protection procedures. The enhanced tier covers 800 or more people and adds physical measures, documentation, and a designated senior individual. The earlier “Protect Duty Tiers” section above explains these requirements in more detail.
Where Can I Find Official Guidance On Protect Duty?
Official guidance is available in the Home Office statutory guidance and on ProtectUK. These sources explain scope, capacity calculations, tier requirements, and examples of proportionate measures. They also provide free training resources that you can use when planning staff training and exercises.
Conclusion: Start Preparing For Protect Duty Today
Protect Duty represents the most significant change in UK public venue security legislation in over 20 years. With commencement expected by April 2027, organizations that start preparing now, using accurate and collaborative site planning tools, will comply more confidently and cost-effectively.
OnePlan gives you practical tools to document your Protect Duty approach, including to-scale site plans, standing crowd capacity calculations, security infrastructure inventories, and stakeholder collaboration in one browser-based platform. Always follow the guidance of your local authorities, Safety Advisory Group, and the SIA when making compliance decisions.