What is Protect Duty — and does it apply to you?

What is Protect Duty?

Protect Duty is the common name for the Terrorism (Protection of Premises) Act 2025. It is UK legislation that places a legal obligation on those responsible for certain venues and events to take proportionate steps to keep the public safe from terrorist threats.

The Act is also widely known as Martyn’s Law, named after Martyn Hett, who was killed in the Manchester Arena attack in May 2017. It received Royal Assent on 3 April 2025.

Who does Protect Duty apply to?

The duty applies to those responsible for qualifying premises with a capacity of 200 or more, and to qualifying events. The scope is broad and includes:

• Schools, colleges and universities
• Hotels and hospitality venues
• Leisure centres and sports facilities
• Theatres, cinemas and entertainment venues
• Shopping centres and large retail premises
• Local authority buildings and public spaces
• Community centres and places of worship
• Critical National Infrastructure sites

If your organisation operates any premises where 200 or more people may be present at the same time, Protect Duty is likely to apply to you.

What are the two tiers?

The Act establishes a tiered approach based on the capacity of your premises:

Standard Tier (200–799 capacity): You must have in place appropriate public protection procedures — including evacuation, invacuation, lockdown and communication procedures — that could reasonably be expected to reduce the risk of harm if a terrorist attack occurred at or near your premises.

Enhanced Tier (800+ capacity): In addition to the standard requirements, you must also put in place appropriate measures to reduce the vulnerability of your premises to a terrorist attack. This may include bag searches, CCTV, vehicle checks and documented security plans. You are also required to formally engage with the regulator.

Both tiers carry genuine accountability at leadership level. The person responsible for the premises — typically the operator, owner or a senior leader — holds personal responsibility for compliance.

When does it come into force?

The Act received Royal Assent on 3 April 2025. The Government has indicated an implementation period of at least 24 months, meaning enforcement is expected from April 2027.

During this period, the Security Industry Authority (SIA) will establish its regulatory function, and the Home Office will publish statutory guidance to help organisations understand the requirements.

However, waiting until enforcement is not a defensible position. The duty of care to protect the public exists now, and the time to understand your obligations is before they become legally mandated.

What does compliance look like?

The Government has been clear that compliance is intended to be proportionate and practical. For standard tier premises, the focus is on simple, low-cost activities — primarily procedures and staff awareness, not expensive physical measures or equipment.

The key requirements are:

• Understanding whether your premises fall within scope
• Knowing which tier applies to you
• Having appropriate procedures in place (evacuation, invacuation, lockdown, communication)
• Ensuring staff are aware of those procedures
• For enhanced tier: documented security plans and additional protective measures
• Notifying the regulator (SIA) that you are a qualifying premises

For further detail, see the Government’s official factsheets and ProtectUK.

Do I need a consultant?

The Government has stated that organisations should not need to spend money on consultants to comply with the basic requirements. The statutory guidance, once published, will be designed to help organisations assess their own position.

However, for senior leaders who hold personal accountability for Protect Duty decisions — particularly those responsible for larger, more complex or multi-site operations — independent advisory provides a structured assessment, a written record of sound decision-making, and the confidence that your position is genuinely defensible.

That is exactly what Aegis Risk & Decision Advisory provides. We are Chartered Security Professionals with over 25 years across counter terrorism, national security and government. We are independent — we have no security products to sell and no conflict of interest.