Martyn's Law for pubs, restaurants and hotels: what it means and how to prepare

Martyn's Law is named after Martyn Hett, who was killed in the Manchester Arena attack in 2017. It puts a legal duty on the people who run busier public venues to think in advance about what they'd do in a terrorist attack, and to make sure staff know it. For most pubs, restaurants and hotels that fall within it, the duty is about procedures and people, not barriers and bag searches.

Here's how to tell whether your venue is in scope, what the duties are, when they start, and a checklist you can work through this winter.

Does Martyn's Law apply to your venue?

Two tests decide it.

1. What the premises is used for. The Act lists the uses it covers. The ones that matter in hospitality are:

• Food and drink: selling food or drink mainly for consumption on the premises. The statutory guidance spells out that this includes bars, pubs, restaurants, cafés and food halls.
• Hotels, hostels and holiday parks.
• Entertainment and leisure venues, which can include nightclubs.
• Halls for hire: venues hired out for events, exhibition halls and conference centres.

The premises must be wholly or mainly used for one or more of these.

2. How many people can reasonably be expected at the same time. The Act says premises are in scope where it is reasonable to expect 200 or more individuals to be present at the same time.

Older articles say 100. That was the figure in the government's earlier proposals, which had a standard tier of 100 to 799. The Act as passed uses 200.

How to count

The statutory guidance is specific about this, and it catches people out:

• It's the busiest time, not a typical day. Count the greatest number you can reasonably expect at once, at your busiest trading times: a summer Saturday, a big match, New Year's Eve.
• Staff count. Add everyone working at that time, front and back of house.
• It's people at the same time, not footfall across the day. Customers who come and go aren't added up over a session.
• Outdoor space counts. Premises can be a building plus land, and the guidance gives "a pub with a beer garden" and a restaurant with outside seating as examples.
• Fire capacity isn't the test. It's a useful upper limit, but the question is how many people you can actually expect.
• Show your working. You need a reasonable, evidenced method (bookings, ticket sales, covers, a headcount on your busiest night), because the SIA can ask how you got the figure.

A worked example: a pub seats 90 inside and 110 in the beer garden, and on a sunny bank holiday weekend there are 60 people standing at the bar and on the terrace on top of that, with 18 staff on. That's well over 200 at the same time, so it's standard tier, even though on a wet Tuesday there are 40 people in.

Who is responsible?

The duty sits with the responsible person: whoever is in control of the premises for the relevant use. That isn't always the licence holder. The guidance gives the example of a tenanted pub where a brewery holds the premises licence but the tenant controls the premises, so the tenant is responsible. Where a venue sits inside larger qualifying premises (a restaurant inside a shopping centre, a bar inside a hotel), the responsible persons must co-ordinate with each other.

Standard tier duties (200 to 799 people)

Standard tier venues have two duties.

1. Notify the SIA. Tell the Security Industry Authority who is responsible for the premises, and tell it again if that changes. The notification regulations, made in July 2026, give venues in scope three months from the day the duties start, or 28 days from becoming responsible if that's later. The notification asks for details such as your trading name, address, the greatest number of people you expect at once and how you worked it out, any licences you hold, and whether you have outside seating. Information that stops being accurate must be updated within 28 days.

2. Have public protection procedures in place, so far as reasonably practicable, covering four things:

The statutory guidance uses hospitality examples: a restaurant reusing its existing locks and shutters for lockdown, a bar that replaced several evacuation plans with one simpler plan after a practice showed staff weren't sure which to use, and a hotel duty manager using the PA to start an evacuation.

What the standard tier does not require:

• No physical security measures such as bag searches, CCTV upgrades or barriers. Those are enhanced tier duties.
• No legal requirement to write the procedures down. The guidance still recommends it, because staff need to understand them and you'll struggle to show the SIA what you've done without a record.
• No set training course. The Act has no statutory training requirement, but staff with a role in the procedures must know what it is and be able to carry it out, and the guidance calls counter-terrorism awareness for all staff good practice.

Enhanced tier in brief (800 or more)

Large hotels, big event venues and the busiest bars and clubs may reach 800. On top of the standard tier duties, enhanced tier venues must:

• put in place public protection measures, covering monitoring, movement of people, physical security and security of information
• document their procedures and measures, assess how they reduce the risk, and send that document to the SIA

Qualifying events of 800 or more carry the same enhanced duties. If you're near that number, read the statutory guidance in full and take specialist advice.

Martyn's Law timeline

As of 3 November 2026 the start date has not been confirmed. We'll update this page when it is.

Penalties

The SIA is the regulator. It can inspect, issue compliance and restriction notices, and fine. For standard tier premises the maximum penalty is £10,000, plus up to £500 a day if a compliance or restriction notice is still being breached after the payment deadline. For the enhanced tier it's up to £18 million or 5% of qualifying worldwide revenue, whichever is higher. Giving the SIA false or misleading information is a criminal offence for any venue.

The Act applies in England, Wales, Scotland and Northern Ireland.

Martyn's Law preparation checklist

You don't have to do anything yet, but the procedures are mostly common sense and cheap to put in place. Work through this before spring 2027:

• Work out your number. Count customers and staff at your busiest realistic time, including any garden, terrace or function room. Write down how you did it.
• Decide who is responsible. Owner, tenant, operator or management company: whoever controls the premises.
• Talk to neighbours you share a building or site with, if you sit inside larger premises.
• Walk the building with "what if" questions. Which exits lead away from the street? Which room could people shelter in? Which doors lock quickly? Where are the shutter keys?
• Write a one-page procedure for each of the four: evacuation, invacuation, lockdown, communication. Keep it short enough to use at 11pm on a Saturday.
• Name the roles. Who makes the call on a shift, who locks which door, who rings 999, who talks to customers. Tie this to the duty manager on the rota, not to one named person who might be off.
• Brief every team member, including part-timers and agency staff. The free ACT Awareness e-learning on ProtectUK is a good starting point.
• Practise it. A ten-minute walk-through before service shows up the gaps.
• Review it whenever the layout, opening hours or capacity changes, and at least once a year.
• Watch for the start date and notify the SIA within three months of commencement.

Much of this overlaps with your fire risk assessment. Our fire safety checklist and risk assessment guide cover the parts you already do. If you run events or weddings, see staff scheduling for event and wedding venues, and for late-night venues, rota app for nightclubs.

Keeping the evidence

Because the standard tier has no legal duty to write things down, the venues that struggle will be the ones that can't show what they did. The SIA can ask how you worked out your number and what your procedures are, so keep a simple record of:

• your capacity calculation and the date you did it
• the written procedures and who wrote them
• who has been briefed, and when
• each practice run, and what you changed afterwards

ShiftComplete can hold much of that alongside the records you keep already. Risk assessments can be created, kept and printed in the app, so your procedures can live next to your fire and general risk assessments. A checklist task such as "monthly lockdown walk-through" or "brief new starters on evacuation routes" is named and timestamped every time it's ticked, with an optional photo. Team announcements get the procedure in front of every member of staff rather than lost in a group chat, and the rota shows who was duty manager on any given night. If something does happen, such as a suspicious item reported, log it as an incident with a photo and notes.

It costs £1.49 per staff member per month with every feature included, and it's free for 60 days with no card needed. It helps you keep the records; the duties under Martyn's Law stay with the responsible person.