At a glance

Martyn’s Law sets new counter-terrorism duties for qualifying UK venues and events.
You cannot claim for a breach of the Act alone, but that breach can support a negligence claim.
Venues expecting 200 to 799 people face standard duties; those expecting 800 or more face enhanced duties.
Larger venues must take additional steps to reduce their vulnerability and protect people from physical harm.
A successful claim must prove that the venue’s failure caused or contributed to your injuries.
Victims can pursue a civil claim, a CICA application or both when the legal requirements are met.

When you attend a concert, eat at a restaurant or visit a public event, you have the right to expect that those responsible for the venue have taken reasonable steps to keep you safe.

The Terrorism (Protection of Premises) Act 2025, better known as Martyn’s Law, puts that responsibility on a clearer legal footing.

The Act creates specific counter-terrorism duties for qualifying premises and events. These duties cover emergency planning, staff preparedness and, for larger venues, protective security measures designed to reduce vulnerability and physical harm.

Martyn’s Law does not create a standalone compensation claim. However, when a venue fails to follow the standards set by the Act, that failure can form important evidence in a personal injury claim.

This guide explains what Martyn’s Law requires, who carries responsibility for venue safety and how security failures can lead to a compensation claim.

What is Martyn’s Law and how does it protect the public?

Martyn’s Law is the informal name for the Terrorism (Protection of Premises) Act 2025.

The legislation followed years of campaigning by Figen Murray, whose son Martyn Hett was one of the 22 people killed in the Manchester Arena attack in May 2017.

The Act received Royal Assent on 3 April 2025. Its purpose is to improve protective security and emergency preparedness across the UK.

The law applies to qualifying premises where at least 200 people, including staff, can reasonably be expected to be present at the same time. It also applies to qualifying events attended by at least 800 people.

The main duties are not yet in force. The Government has confirmed an implementation period of at least 24 months before organisations must comply. Statutory guidance will be published during that period.

Once the duties come into force, qualifying venues must have clear procedures for responding to a terrorist attack.

These procedures cover:

Evacuation
Invacuation
Lockdown
Communication with staff and visitors

Invacuation means moving people into a safer area inside the building rather than directing them outside.

Larger venues and qualifying events must also introduce appropriate protective measures to reduce their vulnerability and limit physical harm.

The correct measures depend on the venue, its use, the number of people present and what is reasonably practicable.

Does Martyn’s Law allow you to sue a venue directly?

Martyn’s Law is the informal name for the Terrorism (Protection of Premises) Act 2025.

The legislation followed years of campaigning by Figen Murray, whose son Martyn Hett was one of the 22 people killed in the Manchester Arena attack in May 2017.

The Act received Royal Assent on 3 April 2025. Its purpose is to improve protective security and emergency preparedness across the UK.

Once the duties come into force, qualifying venues must have clear procedures for responding to a terrorist attack.

These procedures cover:

Evacuation
Invacuation
Lockdown
Communication with staff and visitors

Invacuation means moving people into a safer area inside the building rather than directing them outside.

Larger venues and qualifying events must also introduce appropriate protective measures to reduce their vulnerability and limit physical harm.

The correct measures depend on the venue, its use, the number of people present and what is reasonably practicable.

Does Martyn’s Law allow you to sue a venue directly?

No. Martyn’s Law doesnt give an injured person a direct right to compensation simply because a venue has breached the Act.

You cannot bring a claim solely because a venue failed to complete paperwork, notify the regulator or follow an administrative requirement.

However, the Act does not remove your existing rights under civil law.

If a venue’s security failure caused or contributed to your injury, you can bring a claim under negligence law or the Occupiers’ Liability Act 1957, provided the evidence establishes the required legal tests.

Your right to seek compensation

A personal injury claim must establish four points:

The venue owed you a duty of care
The venue breached that duty
The breach caused or materially contributed to your injury
You suffered injury and financial loss as a result

Martyn’s Law helps define the security standards expected from qualifying venues.

If a venue fails to follow those standards, your solicitor can use that failure as evidence that the operator fell below the required standard of care.

Here are a few examples of failures that would be deemed relevant:

Having no workable emergency plan
Failing to brief staff
Ignoring known security weaknesses
Failing to establish evacuation or lockdown procedures
Leaving access points uncontrolled
Failing to communicate with visitors during an incident
Ignoring previous warnings or security concerns
Failing to introduce proportionate protective measures

A breach of Martyn’s Law does not prove a claim by itself. It provides evidence of breach. Your solicitor must then connect that breach to the injuries you suffered.

Venue negligence and the Occupiers’ Liability Act 1957

The Occupiers’ Liability Act 1957 requires an occupier to take reasonable care to keep lawful visitors reasonably safe while using the premises.

The occupier is the person or organisation with sufficient control over the venue.

This can be:

The venue owner
The business operating the premises
A tenant
An event organiser
A management company
Another organisation controlling the site

A venue does not have to guarantee that no attack will take place.

It must take reasonable precautions against risks that it knows about or should identify through proper assessment.

Martyn’s Law creates a structured framework for identifying and managing terrorism risks.

A venue can breach its duty of care by:

Failing to create a workable evacuation plan
Having no invacuation procedure
Failing to establish lockdown arrangements
Leaving staff unaware of emergency procedures
Failing to secure or monitor important access points
Using inadequate communication systems
Failing to control crowds or queues
Ignoring recognised vulnerabilities
Disregarding official guidance
Failing to act after earlier incidents or warnings

Your solicitor will examine what happened before, during and after the incident.

This investigation establishes whether the venue’s preparation and response met the standard required by law.

Standard and enhanced duties under Martyn’s Law

Martyn’s Law divides qualifying premises into two tiers.

The tier depends on the number of people, including staff, who can reasonably be expected to be present at the same time.

Standard duty premises

Standard duty premises are qualifying premises where between 200 and 799 people can reasonably be expected to be present.

The responsible person must establish appropriate public protection procedures, so far as reasonably practicable.

These procedures must explain what staff should do when they suspect that an attack is taking place or is about to take place.

They cover:

Evacuating people from the premises
Moving people into a safer part of the building
Locking down the venue
Communicating instructions and warnings

People working at the premises must know the procedures and understand their role.

The Act does not require standard duty premises to make physical alterations or buy specialist equipment simply to meet these procedural duties.

Enhanced duty premises and qualifying events

Enhanced duties apply to qualifying premises and events where at least 800 people can reasonably be expected to be present.

These venues must establish public protection procedures and take additional steps to:

Reduce their vulnerability to an attack
Reduce the risk of physical harm
Protect staff and visitors
Improve their ability to respond

The measures selected must be appropriate and reasonably practicable for the venue.

They can cover:

Monitoring the premises
Controlling access
Searching people or bags
Managing queues and crowds
Securing entrances and exits
Using CCTV
Installing barriers
Preventing hostile vehicle access
Protecting security information
Training staff
Testing emergency procedures
Coordinating with contractors and emergency services

Martyn’s Law does not impose the same equipment list on every venue.

An arena, shopping centre and conference venue each require a security plan that reflects their layout, operation and risk.

Who is responsible for Martyn’s Law compliance?

The Act places responsibility on the person who controls the premises in connection with its qualifying use.

This person or organisation is known as the responsible person.

The responsible person can be:

A company
A charity
A partnership
An individual owner
A venue operator
An event organiser

For a qualifying event, responsibility rests with the person or organisation controlling the premises for the purposes of that event.

A responsible person cannot transfer its legal duty simply by outsourcing security work.

Hiring a security contractor does not remove the venue operator’s responsibility to ensure that proper arrangements are in place.

Where several organisations control different parts of a venue or event, they must coordinate their security responsibilities.

The designated senior individual

An organisation responsible for enhanced duty premises or a qualifying event must appoint a designated senior individual.

This person must hold a sufficiently senior position to oversee compliance across the organisation.

The role can be held by:

A director
A partner
A senior executive
Another person who manages the organisation’s affairs

The designated senior individual provides clear senior-level accountability.

Their appointment helps establish:

Who oversaw the security arrangements
Who approved the venue’s procedures
Who received reports about security concerns
Whether concerns were escalated
Whether recommended action was authorised
Where the management process failed

The operating company remains the main defendant in a civil compensation claim.

However, senior officers can face personal criminal liability when an offence is committed with their consent, connivance or neglect.

Evidence needed for a venue security negligence claim

Strong evidence determines whether a venue security claim succeeds.

Security records, CCTV and internal communications can be deleted or overwritten. You should seek legal advice as soon as possible so your solicitor can secure this evidence.

Terrorism risk assessments and security plans

These documents show:

Which risks the venue identified
Which vulnerabilities it recorded
What action it recommended
Who approved the plan
Whether the plan was reviewed
Whether the venue completed the recommended work

A plan that identifies a serious risk but records no action provides important evidence of a failure to protect visitors.

Staff training and briefing records

Training records establish:

Which staff received security instruction
What that instruction covered
Whether contractors were briefed
Whether staff understood emergency procedures
Whether refresher training took place

A written plan is ineffective if the people responsible for carrying it out do not understand it.

Emergency drill records

Exercise records show whether the venue tested its procedures.

They also reveal:

Problems identified during drills
Delays in the response
Communication failures
Blocked escape routes
Staff shortages
Recommendations that were not completed

Physical security records

Your solicitor will examine records relating to:

CCTV
Alarms
Locks
Security doors
Barriers
Access controls
Search procedures
Security staffing
Maintenance and repairs

These records show whether security systems worked and whether known faults were left unresolved.

CCTV and other footage

CCTV footage provides a clear timeline of the incident.

It can establish:

How the attacker entered
Whether access controls were operating
How staff responded
When the alarm was raised
Whether exits were accessible
Whether instructions were given
How crowds were managed
Whether security procedures were followed

Mobile phone footage, body-worn video and dashcam recordings can provide additional evidence.

Witness statements

Witness evidence comes from:

Visitors
Venue employees
Security staff
Contractors
Event organisers
Emergency responders

Witnesses can explain what instructions were given, how staff behaved and whether emergency procedures worked.

Incident and communication logs

Relevant records include:

Control-room logs
Radio communications
Telephone calls
Internal messages
Emergency service contact records
Incident reports

These records establish what the venue knew, when it knew it and how decision-makers responded.

Regulatory records

Once the Act is in force, regulatory evidence will include:

Inspection reports
Compliance notices
Restriction notices
Penalty notices
Previous enforcement action

The Security Industry Authority will regulate the Act, investigate suspected non-compliance and take enforcement action in serious or persistent cases.

Previous warnings from the regulator provide strong evidence that the venue knew about a problem and failed to correct it.

Compensation after a terrorist attack or security incident

Victims have two main routes to compensation after a terrorist attack or violent security incident:

A civil personal injury claim
An application to the Criminal Injuries Compensation Authority

These routes apply different legal tests and provide different levels of compensation.

A civil personal injury claim

You can bring a civil claim when the evidence proves that a venue, organiser, contractor or other organisation negligently caused or contributed to your injuries.

A civil claim compensates you for the full effect of the injury.

The claim covers:

Physical injuries
Psychological injuries
Pain, suffering and loss of amenity
Lost earnings
Lost pension contributions
Medical treatment
Rehabilitation
Care and assistance
Travel costs
Mobility equipment
Home adaptations
Future care
Future financial losses

For serious injuries, your solicitor will obtain expert evidence covering your medical condition, rehabilitation, care, accommodation and future needs.

A CICA application

The Criminal Injuries Compensation Authority administers a government-funded scheme for victims of violent crime in Great Britain.

A CICA application does not require proof that a venue was negligent.

You must meet the scheme’s eligibility requirements, report the incident to the police and cooperate with the criminal investigation.

The scheme uses fixed tariffs for injuries and applies its own rules to loss of earnings, expenses and time limits.

A CICA award does not provide the same level of compensation as a successful civil claim based on the full value of your losses.

You can investigate a civil claim and a CICA application at the same time.

Any compensation received through one route is taken into account under the rules applying to the other. This prevents double recovery for the same injury or loss.

Insurance limits and claims involving multiple victims

A major security incident can result in dozens or hundreds of claims against the same organisations.

This makes the insurance investigation a central part of the case.

Public liability and specialist terrorism policies can contain:

Indemnity limits
Aggregate limits
Terrorism exclusions
Event-specific limits
Conditions relating to contractors
Separate cover for different defendants

An aggregate limit places a maximum on the amount the insurer will pay for all claims arising from one incident or during one policy period.

When several people suffer serious injuries, the available insurance fund can become insufficient to meet every claimant’s full losses.

Your solicitor will therefore investigate every organisation that contributed to the security arrangements.

Defendants can include:

The venue operator
The event organiser
The property owner
A security contractor
A facilities management company
A maintenance contractor
Another organisation controlling access or safety

Each defendant can hold separate insurance.

Identifying all responsible parties increases the available routes to compensation and prevents the claim from relying on one policy alone.

For catastrophic injuries, this work is essential because the compensation must fund long-term care, rehabilitation, lost earnings, equipment and accommodation.

Speak to our expert personal injury solicitors today

The introduction of the Terrorism (Protection of Premises) Act 2025 marks a vital step forward in public safety across the UK. While Section 31 prevents victims from suing venues directly for a statutory breach of Martyn’s Law, the clear, objective standards it introduces make it far easier to hold negligent venue owners accountable under the Occupiers Liability Act 1957.

A failure to prepare is now legally recognised as a failure to protect. If you or a loved one has suffered an injury in a public space due to a failure in venue security, our dedicated team is here to help. We understand how traumatic these experiences can be, and we are committed to fighting for the justice and support you need to rebuild your life.

FAQs about Martyn’s Law and injury claims

Can I sue a venue for injuries sustained in an attack under Martyn’s Law?

While Section 31 prevents you from suing directly for a breach of the Act itself, you can bring a standard personal injury claim under the Occupiers Liability Act 1957, using the Martyn’s Law breach as proof of negligence.

Will a venue’s non-compliance with the 2025 Act help my personal injury compensation claim?

Yes. Failing to comply with the 2025 Act’s safety requirements provides strong, objective evidence that the venue failed to meet its duty of care, making it much easier to prove negligence in court.

Who is held civilly liable if a public premises fails to protect its visitors?

The venue operator, business owner or the corporate entity designated as the ‘Responsible Person’ holds the primary civil liability for failing to maintain a safe environment for visitors.