Understanding Martyn’s Law: A Practical Guide for Restaurant Owners

The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, received Royal Assent on 3 April 2025. It is now law. It is not yet in force. The government has set a minimum 24-month implementation period, which means legal compliance will be required no earlier than April 2027. We are currently halfway through that window.

For UK restaurant operators, that is not a reason to wait. It is a reason to prepare now, while the guidance is published and the requirements are clear, rather than scrambling in the final months before the deadline.

This guide covers what the Act requires, which restaurants are in scope, and what you need to do before enforcement begins.

What is the Terrorism (Protection of Premises) Act 2025?

The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, is UK legislation that requires operators of certain premises to take proportionate steps to protect the public in the event of a terrorist attack. It was named after Martyn Hett, who died in the Manchester Arena bombing in 2017, and campaigned for by his family. The Act received Royal Assent on 3 April 2025. The Security Industry Authority (SIA) will act as the regulator once the Act comes into force, which is expected no earlier than April 2027.

Which restaurants are in scope?

The Act applies to premises that meet all three of the following criteria:

• The premises include at least one building
• The premises are used for one or more of the uses listed in Schedule 1 of the Act (restaurants are explicitly included)
• The premises can reasonably expect more than 200 individuals to be present at least occasionally

If your restaurant has a capacity of fewer than 200 people, you are currently out of scope. If your capacity is 200 or more, you fall under the standard duty. If 800 or more people could be expected, you fall under the enhanced duty. Most restaurants will fall under standard duty or be out of scope entirely.

What the standard duty requires

Standard duty applies to restaurants with a capacity of 200 to 799. The requirements are procedural, not structural. No physical security infrastructure is mandated. What is required:

• Notify the SIA that your premises are in scope
• Have documented public protection procedures covering four scenarios: evacuation, lockdown, invacuation (moving people to a safe area within the building), and communication protocols during an incident
• Ensure staff understand these procedures

The key word is documented. Having a plan in your head, or telling staff verbally what to do, does not meet the standard. You need written procedures and evidence that your team has been trained on them.

What the enhanced duty requires

Enhanced duty applies to premises where 800 or more people are expected. In addition to everything under standard duty, enhanced duty holders must:

• Conduct a documented assessment of the premises’ vulnerabilities to terrorism
• Implement reasonably practicable physical and operational measures to reduce the risk of harm

For most restaurants, enhanced duty will not apply. It is primarily aimed at large entertainment venues, stadiums, shopping centres, and major events.

What you need to do now

The Home Office published statutory guidance in April 2026. There is no legal requirement to comply until the Act comes into force, but the guidance is designed to help operators prepare. The practical steps for a standard duty restaurant are:

Step 1: Establish your capacity. If your maximum occupancy is under 200, you are currently out of scope. If it is 200 or more, you are in scope and should proceed with the following steps.

Step 2: Write your public protection procedures. Document your evacuation routes, lockdown procedures, invacuation protocol, and communication plan for each. These do not need to be complex. They need to be clear, specific to your premises, and known by your team.

Step 3: Train your staff. Every member of your team needs to understand the procedures. This includes what to do in each scenario, who leads the response, how to communicate with guests, and when to call emergency services. Training needs to be documented.

PocketTrainer’s Counter-terrorism Awareness For F&B Employees course covers exactly what your team needs to meet the standard duty training requirement, with completion automatically logged and available for inspection.

Step 4: Test your procedures. Walk through each scenario with your team. Identify gaps. Update the procedures accordingly.

Step 5: Prepare to notify the SIA. Once the Act comes into force, you will need to register your premises with the SIA. The process for doing this has not yet been confirmed, but keeping your documentation in order now means the registration process will be straightforward.

Why training records matter

When the Act comes into force and the SIA begins enforcement, inspectors will not just ask whether your staff know what to do. They will ask for evidence that training happened. The maximum penalty for non-compliance is £18 million, with the possibility of restriction notices that could affect your ability to trade.

This is the same shift that happened with food safety compliance. The standard moved from “do you train your staff” to “prove it.” The operators who built documented training systems before enforcement began avoided the scramble. The same will happen here.

For restaurants already using a digital training platform, adding Martyn’s Law procedures as a training module is straightforward. Staff complete the module, the completion is logged, and you have the evidence you need.

If you want to see how PocketTrainer helps restaurant operators build and track compliance training across their teams, book a 15-minute demo.

The timeline

• 3 April 2025: Royal Assent. The Act is law.
• April 2026: Home Office publishes statutory guidance.
• No earlier than April 2027: Act comes into force. Legal compliance required.
• Now: Preparation period. No legal obligation yet, but the guidance is published and the clock is running.

What this means for multi-site operators

If you operate multiple restaurants, each site needs its own documented procedures. Evacuation routes, lockdown protocols, and communication plans are specific to each building. A centralised procedure document does not meet the standard if it does not reflect the specifics of each location.

Multi-site operators should build a template that can be adapted site by site, with each version approved and signed off by the manager responsible for that location. Training should be delivered consistently across all sites, with completion tracked centrally.

Final thoughts

Martyn’s Law is not a bureaucratic exercise. It exists because people died, and because the public deserves to know that the venues they visit have a plan. For restaurant operators, the requirements under standard duty are proportionate and achievable. The procedures are not complex. The training is not onerous. The documentation is manageable with the right system in place.

The operators who will struggle are the ones who treat April 2027 as the start date rather than the deadline. Start now, while the guidance is fresh and there is time to get it right.

If you want to see how PocketTrainer supports compliance training across restaurant teams, book a 15-minute demo.