The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, will create preparedness and protective security duties for many publicly accessible premises. Retailers should first ask whether each premises satisfies the statutory tests and who controls it.
Which retail premises are in scope?
Premises qualify only if they consist of a building, or a building and other land, are wholly or mainly used for a Schedule 1 purpose such as selling goods or services, are not excluded, and can reasonably be expected to have at least 200 people present at the same time from time to time. Staff count alongside customers.
The standard tier covers 200 to 799 people; the enhanced tier starts at 800. This is not necessarily the fire safety maximum. Government material permits a reasonable, evidenced method, including historic attendance, safe occupancy, registration limits or other justified data. Seasonal sales and fluctuating footfall may therefore matter. Premises near a threshold should record their method and assumptions because no single calculation is prescribed.
A supermarket, department store or large shop may qualify in its own right. In a shopping centre, the centre and each unit are assessed separately, although the centre’s calculation includes people in its units. Retail parks and other shared sites require a fact-specific review of boundaries, buildings, control and attendance.
Responsibility normally rests with the person controlling the premises for the retail use, often the retailer rather than the landlord. Where qualifying premises sit within other qualifying premises, responsible persons must co-ordinate so far as reasonably practicable. An out-of-scope unit within an enhanced centre may also need to co-operate with the centre’s responsible person.
What will retailers have to do?
All responsible persons in scope must notify the Security Industry Authority (“SIA“) and, so far as reasonably practicable, maintain appropriate procedures for evacuation, invacuation, lockdown and communication during a suspected or actual terrorist attack. The Act does not prescribe specific counter-terrorism training, but staff expected to implement procedures must understand their roles.
Enhanced-tier retailers must also assess, implement and review reasonably practicable measures concerning monitoring, movement, physical safety and security, and security of information. They must document their procedures and measures, submit that document to the SIA and, if the responsible person is an organisation, designate a senior individual.
Existing fire, health and safety, security, emergency and business continuity arrangements are a useful starting point, but do not automatically satisfy the Act. A terrorist incident may require a different evacuation route, invacuation or lockdown, and shared-site procedures must not conflict.
What should retailers be doing now?
As practical preparations rather than current statutory duties, retailers should:
- map each site against the statutory criteria using evidenced peak attendance, including staff;
- identify the responsible person and any landlord, centre operator or managing agent interfaces;
- compare current procedures against the four statutory outcomes;
- plan proportionate briefing and exercises for permanent and temporary staff;
- for enhanced sites, review vulnerabilities, measures, documentation and senior oversight; and
- monitor commencement regulations, final SIA guidance and notification arrangements.
The SIA may inspect, require information and issue compliance notices. Enhanced premises may also face restriction notices. Maximum civil penalties are £10,000 for standard-tier contraventions and, for enhanced premises, the greater of £18 million or 5% of qualifying worldwide revenue. Serious non-compliance can also result in criminal liability.
The substantive duties are not yet in force. The SIA expects commencement in spring 2027 but says the exact date will be confirmed. Retailers should use the implementation period to determine scope, settle responsibility and test preparedness, rather than treat any particular date as fixed.