Martyn’s Law: what the Act requires, and how whoot. supports your obligations
The Terrorism (Protection of Premises) Act 2025 requires premises where 200 or more people may be present at once, and public events of 800 or more with checks at entry, to be ready to protect the people there. This page explains what the Act requires, when the duties start and where whoot. fits in.
The Act is law, but not yet in force
The Act is named after Martyn Hett, who was killed in the Manchester Arena attack in 2017. It received Royal Assent in April 2025. The duties will start on a date the Government has not yet set, which is expected to be in spring 2027, and the Security Industry Authority (SIA) will enforce them.
| 3 April 2025 | Parliament | Royal Assent, with at least 24 months before the duties commence. |
|---|---|---|
| 15 April 2026 | Home Office | Statutory guidance published. |
| 15 June 2026 | SIA | The SIA's duty to issue its own guidance commenced. |
| November 2026 | SIA | An optional planning tool for standard tier premises and an optional template for the enhanced-tier document published. |
| Autumn 2026 | SIA | Final SIA guidance expected.Expected |
| Early 2027 | SIA | The notification portal opens.Expected |
| Spring 2027 | Government | Expected commencement, after which premises have three months to notify the SIA.Expected |
Two tiers, set by capacity
The thresholds apply to qualifying premises. A public event with checks at entry comes into scope at 800 people.
Standard tier
Premises where 200 to 799 people may be present at once
Notify the SIA, and have public protection procedures for evacuation, invacuation, lockdown and communication, so far as reasonably practicable.
Penalty: Up to £10,000, plus £500 a day
Enhanced tier
Premises where 800 or more may be present at once, and qualifying events of 800 or more
Everything in the standard tier, plus public protection measures, a document setting out the procedures and measures submitted to the SIA, and a designated senior individual where the responsible person is an organisation.
Penalty: Up to £18m or 5% of worldwide revenue, plus £50,000 a day
Schools, further education colleges, early years settings and places of worship stay in the standard tier however many people are present. Universities do not have that exception.
No documentation duty applies at the standard tier, though the guidance notes that a procedure nobody wrote down is hard to demonstrate on inspection.
Four procedures, and the first three depend on the fourth
The Act names evacuation, invacuation, lockdown and communication. Most premises have nothing in place for communication, and that is the part whoot. provides.
- Evacuation
- A single alert to every device and any phone, with the safe route and where to gather, worded apart from a fire evacuation, and replies that show who has left.
- Invacuation
- Messages written in advance that tell people to stay inside, sent in one tap, with replies that show who has done so.
- Lockdown
- Voice rooms by zone for the people responding, a text for everyone else, the full-screen alert on staff computers, and a live map showing both.
- Communication
- Messages between staff and to and from the control room, each one acknowledged, timed and recorded. The other three procedures depend on this one.
The record builds up while you work
Every alert, reply and transmission is timed and recorded, so when the SIA asks how a procedure ran, you can show when it was drilled, declared, answered and stood down.
- Each procedure is set up as a scenario you declare in one tap
- Drills run on the platform and are marked as drills
- Who was alerted, who replied and who needed help, by name
- The timeline, transcripts and map in one incident dossier
The four procedures explained in under two minutes
The video is silent, with captions in place of narration.
Two free guides
One covers events and premises for fewer than 800 people, and the other covers the enhanced tier.
- Standard tier · 200 to 799 · 2 pagesEvents and premises under 800The alert, the sign-up poster and the two-way list that collects replies.Opens with your email
- Enhanced tier · 800+ · 3 pagesEnhanced-tier premisesThe live map, the SMS campaign and the security operations view.Opens with your email
Frequently asked questions
Does whoot. meet our Martyn's Law duties for us?
Our premises hold fewer than 200 people. Does the Act apply?
Can we run drills without alerting the public?
whoot. provides incident-management and emergency-communication infrastructure that supports organisations in implementing their Martyn's Law obligations under the Terrorism (Protection of Premises) Act 2025. It does not constitute legal compliance advice, and no product can make a venue compliant by itself. Consult a qualified safety professional for guidance specific to your premises.
Get your procedures ready before the Act comes into force
We will walk you through the four procedures on your own premises in 30 minutes, from the first alert to the final record.
Or call 020 3856 8700.