Written by: Paul Foster, Founder, CEO, OnePlan
Key Takeaways
- Protect Duty (Martyn’s Law) applies to UK venues expecting 200 or more people simultaneously, with enforcement beginning in spring 2027.
- Standard Tier venues (200–799 capacity) must complete risk assessments, develop public protection procedures, train staff, and document compliance.
- Enhanced Tier venues (800+ capacity) must add physical protective measures, formal compliance documents, and SIA notification.
- A to-scale site plan is essential for compliance, helping venues visualise security measures and demonstrate preparedness to the SIA.
- A to-scale digital planning tool such as OnePlan helps venues map risks, plan mitigations, and collaborate with stakeholders in one place.
Protect Duty (Martyn’s Law) Explained For Venue Operators
Protect Duty, officially the Terrorism (Protection of Premises) Act 2025, is a UK law requiring venues and events to improve preparedness for terrorist attacks. The Act applies across England, Wales, Scotland, and Northern Ireland to premises and events where 200 or more individuals, including staff, may reasonably be expected to be present at the same time.
The Security Industry Authority (SIA) is the regulator for the Act, with powers to issue compliance notices, restriction notices, and financial penalties. The Home Office published its statutory guidance on 15 April 2026, providing practical direction on what responsible persons must do to comply. The guidance explains that compliance does not require specialist services. Most venues can meet their obligations with proportionate, low-cost measures.
Standard And Enhanced Tiers: Match Your Venue To The Right Duties
Protect Duty establishes two tiers of obligations based on venue capacity. Identifying your tier gives you a clear starting point for planning.
Standard Tier Requirements (200–799 Capacity)
Standard Tier premises are those that can reasonably expect 200 to 799 individuals, including staff, to be present at the same time. Obligations focus on procedural preparedness:
- Conduct a terrorism risk assessment appropriate to your venue
- Implement public protection procedures covering evacuation, invacuation, lockdown, and communication
- Train staff to follow these procedures
- Document your procedures and training as evidence of compliance
Standard Tier requirements remain low-cost and proportionate. The Home Office guidance stresses that most venues can comply without purchasing specialist services.
Enhanced Tier Requirements (800+ Capacity)
Enhanced Tier premises are those that can reasonably expect 800 or more individuals at any one time. Obligations are more comprehensive:
- Conduct a detailed terrorism risk assessment
- Implement physical protective measures to reduce vulnerability and harm
- Develop detailed response procedures for evacuation, invacuation, lockdown, and communication
- Appoint a designated senior individual responsible for compliance
- Prepare a formal compliance document and submit it to the SIA
- Notify the SIA of your qualifying status
Step-By-Step Protect Duty Planning Process
Both tiers follow a similar planning structure. Use these steps as your practical roadmap.
Step 1: Conduct A Terrorism Risk Assessment
The Act assumes that a terrorist attack might occur anywhere, so requirements are not linked to the likelihood of an attack at specific premises. Focus your assessment on vulnerability and preparedness rather than probability.
Walk your venue and identify:
- Access points and entry or exit routes
- Crowded areas and potential choke points
- Vehicle approach routes and parking areas
- Concealment locations and blind spots
- Existing security measures and gaps
Enhanced Tier risk assessments must evaluate vulnerabilities including access points, crowd density areas, vehicle approach routes, and potential concealment locations, following methodologies aligned with Centre for the Protection of National Infrastructure (CPNI) guidance. Record every finding. This assessment forms the foundation of your entire compliance plan.
Step 2: Develop Public Protection Procedures
The four public protection procedures set out in the Act are evacuation, invacuation, lockdown, and communication. Write clear, venue-specific procedures for each:
- Evacuation: Moving people safely away from danger
- Invacuation: Moving people inside to a safe location
- Lockdown: Securing the premises to prevent entry
- Communication: Informing staff and attendees of what to do
Procedures must be reasonably practicable and tailored to the specific premises, rather than generic templates. Include pre-scripted announcements and clear role assignments for each scenario.
Step 3: Implement Physical Protective Measures
Standard Tier venues may identify physical measures through their risk assessment, even though these measures are not mandatory in the Act. For Enhanced Tier premises and qualifying events, the responsible person must consider what public protection measures are appropriate and reasonably practicable to reduce the risk of physical harm and to reduce vulnerability to terrorism.
Common measures include:
- CCTV coverage of entry points and crowded areas
- Vehicle barriers or stand-off distances
- Secure entry and exit points
- Search procedures and prohibited item policies
- Lockdown capabilities on doors and gates
Document every measure you implement, along with your reasoning for selecting it.
Step 4: Train Staff And Practise Procedures
Staff training turns written procedures into effective action during an incident. Staff should be trained, procedures practised, and records kept so compliance can be evidenced to the SIA.
To make your procedures work in practice, focus on four core tasks:
- Brief every staff member on your public protection procedures so expectations are clear
- Run regular practice sessions and drills so responses become familiar and confident
- Train staff to recognise and report suspicious behaviour to reduce response times
- Record all training and practice sessions so you can evidence compliance to the SIA
Step 5: Create A To-Scale Site Plan
A to-scale site plan sits at the heart of Protect Duty compliance. It helps you visualise security measures, spot vulnerabilities, and explain your plan to staff, Safety Advisory Groups, and the SIA. Hand-drawn diagrams or shapes dropped onto a PowerPoint slide do not accurately represent your venue and rarely withstand scrutiny. A plan that reflects reality gives you confidence and credible evidence.
Your site plan should show:
- Venue boundaries and perimeter
- Entry and exit points
- Crowd areas and standing capacities
- Location of barriers, CCTV, and security personnel
- Evacuation routes and assembly points
- Vehicle access and parking areas
This is where OnePlan helps you move quickly. OnePlan is a browser-based platform that lets you drag and drop to-scale objects onto a live satellite map, with no engineering degree required. You can place crowd barriers, fencing, CCTV points, and safe zones with accurate dimensions, then use the crowd capacity calculator to outline standing areas and instantly see safe density levels. Because the plan updates in real time, your security team, Safety Advisory Group, and venue management all work from the same current document.
For a 500-capacity Standard Tier venue, you can outline crowd areas and confirm they meet safe standing density levels. For an 800+ Enhanced Tier venue, you can document physical measures and create the visual evidence the SIA expects, without using CAD software or hiring a specialist consultant.
Step 6: Review And Update Your Plan Regularly
Once your site plan is in place, compliance becomes an ongoing commitment rather than a single project. Protect Duty compliance requires regular review of your risk assessment, procedures, and site plan whenever circumstances change.
- Your venue layout changes
- Your capacity changes
- You host a new type of event
- You experience a security incident or near miss
- Staff roles change significantly
The SIA expects to see evidence of ongoing review and improvement. Build reviews into your annual calendar and treat your site plan as a living document.
Protect Duty Compliance Checklist For Venues
Use this checklist to track your progress toward compliance.
Standard Tier:
- Confirmed your venue is in scope (200+ capacity)
- Conducted a terrorism risk assessment
- Documented evacuation, invacuation, lockdown, and communication procedures
- Trained staff on procedures
- Created a to-scale site plan showing security measures
- Established a review schedule
Enhanced Tier (Additional Requirements):
- Appointed a designated senior individual
- Conducted a detailed risk assessment
- Implemented physical protective measures
- Prepared a formal compliance document
- Notified the SIA of your qualifying status
- Submitted your compliance document to the SIA
Common Protect Duty Pitfalls To Avoid
Treating compliance as a one-time exercise. Protect Duty requires ongoing review and improvement. Schedule regular reviews and update your documentation after any significant change.
Failing to involve all stakeholders. Security planning touches operations, facilities, HR, and management. Involve each relevant team from the start to avoid gaps in your procedures.
Relying on non-scaled diagrams. Hand-drawn or PowerPoint diagrams rarely represent your venue accurately. Use a to-scale tool like OnePlan so your plan reflects reality and can withstand SIA scrutiny.
Missing documentation. The SIA will expect evidence of compliance. Record your risk assessment, procedures, training sessions, and reviews.
Overlooking operational changes. When your venue layout or operations change, your security plan must change as well. Review your plan after any significant operational change.
Official Resources And Further Guidance
For authoritative information, consult these official sources:
- Home Office statutory guidance for the Terrorism (Protection of Premises) Act 2025
- ProtectUK counter-terrorism police guidance
- Security Industry Authority (SIA) Martyn’s Law updates
Requirements may vary based on your specific circumstances. Work with your local Safety Advisory Group and consult official guidance for your situation. OnePlan is a planning and mapping tool, not a legal or regulatory authority. Always follow the direction of the SIA, Home Office, and relevant local authorities.
Frequently Asked Questions
When Does Martyn’s Law Come Into Force?
The Act received Royal Assent on 3 April 2025, with a minimum 24-month implementation period. Enforcement is expected to begin in spring 2027, though the SIA has not yet confirmed an exact date. The Home Office published its statutory guidance in April 2026 to give venues time to prepare, so use this period to complete your assessment, procedures, and site plan.
How Are Capacity Thresholds Applied In Practice?
Standard Tier applies to premises and events where 200 to 799 individuals, including staff, may reasonably be expected to be present at the same time. Enhanced Tier applies to those expecting 800 or more individuals at any one time. Thresholds are based on reasonable expectations of simultaneous presence and include all people on site, not just paying attendees. If your capacity sits close to either threshold, review the Home Office statutory guidance and illustrative examples carefully.
What Does Invacuation Mean For My Venue?
Invacuation means moving people inside a building to a safe location, while evacuation moves people outside and away from the premises. It is one of the four required public protection procedures under the Act, alongside evacuation, lockdown, and communication. Invacuation usually applies when the threat is outside the building and moving people outdoors would increase their exposure to danger. Your invacuation procedure should be venue-specific, with clear role assignments and pre-scripted instructions for staff.
How Can OnePlan Support My Protect Duty Planning?
OnePlan is a browser-based platform that lets you create to-scale site plans on a live satellite map without needing CAD or specialist skills. You can drag and drop crowd barriers, fencing, CCTV points, entry and exit locations, and assembly points onto an accurate map of your venue. The crowd capacity calculator lets you outline standing areas and instantly see safe capacity levels. Real-time collaboration keeps your security team, Safety Advisory Group, and venue management aligned on a single live plan, and you can export high-resolution maps for SIA documentation, Safety Advisory Group meetings, and staff briefings.
Start Your Protect Duty Planning Today
Protect Duty compliance feels manageable when you break it into clear steps. By assessing risk, developing procedures, implementing measures, training staff, and creating a to-scale site plan, you can meet your legal obligations and protect attendees with confidence.
The implementation period gives you time to prepare before enforcement begins in spring 2027. Start now by conducting your risk assessment, documenting your procedures, and building the visual site plan that demonstrates your preparedness to the SIA.
OnePlan makes Protect Duty venue planning straightforward. With to-scale mapping on a live satellite base, a standing crowd capacity calculator, and real-time collaboration, you can create the documentation you need in hours, not weeks. Venues like Silverstone use OnePlan as their single source of truth across operations, security, and supplier teams.
Plan your next event the easy way. Start free today or book a 15-minute demo.