Martyn's Law: the unknown cost of protecting customers

This article was first published by Estates Gazette on 25 March 2024 (here). It is reproduced with their permission. The Terrorism (Protection of Premises) Act became law on 3 April 2025, and the article has been updated accordingly.

As the retail, hospitality and leisure sectors battle with rising costs and diminishing profits across the UK, Nikki Powell looks at the financial implications of compliance with Martyn's Law.

Otherwise known as the Terrorism (Protection of Premises) Act, Martyn's Law is named after Martyn Hett, one of the people who lost their lives in the 2017 Manchester Arena bombing. Fifteen further terror attacks have since occurred in the UK.

The draft Bill was issued in May 2023 and received Royal assent on 3 April 2025. It is expected that the implementation period will be at least 24 months.

The Act seeks to enhance security and mitigate the risk of future terrorism attacks in public venues across the UK. Once implemented, the Act will have a significant impact on businesses operating public spaces, including hospitality venues and retail space. Without doubt, everyone in the sector recognises they have an obligation to protect their staff and customers. However, it seems that Martyn's Law will place frontline retail staff and their employers at the centre of protecting public safety from future terrorist incidents.

Who is affected?

All qualifying public premises will be caught in one way or another.

Qualifying public premises are widely defined as premises wholly or mostly used for one or more of the uses listed in the Act and to which the public or a large section of public have access. They include shops, restaurants, pubs and bars, night clubs, cinemas, live music venues, gyms, sports grounds (other than open access spaces), sports centres, galleries and museums, hotels, guest houses and holiday parks. These can comprise more than one unit in a scheme or building for example a shopping centre or a student accommodation complex.

Premises that qualify for the purposes of the Act must include a building and are then split into two levels: 

• Standard duty – premises where it can be reasonably expected for 200 or more individuals (including staff and volunteers) to be present at the same time at least occasionally; and
• Enhanced duty premises – premises where it can be reasonably expected for 800 or more individuals (including staff and volunteers) to be present at the same time at least occasionally.

Even if the property in question is not a qualifying premises or does not include a building, businesses may find themselves hosting qualifying public events and are therefore caught by the Act. These are events held at premises which would not otherwise qualify but where it is reasonable to expect that 800 or more individuals may be present on the premises at the same time for the purposes of attending an event.

What does the Act require?

Details of the duties that apply for each type of premises and qualifying public events are set out in the table below.

What is the cost of compliance?

The Home Office estimated as part of their initial findings that the cost of implementation over a 10-year period could be £2,160 for standard duty premises and around £80,000 for enhanced premises, but industry bodies query whether this reflects the true cost.

The key categories where operators are likely to see increased costs are:

• Payroll -salaries for compliance teams to evaluate each premises and develop risk assessments, and additional frontline staff to cover time away for staff participating in training.
• Training - the cost of developing and implementing effective training for all staff affected, which will include time away from frontline services for customer-facing staff.
• Technology – investment in security systems to assess and manage risk.
• Testing - ensuring that all training, controls and processes function correctly. 
• Information sharing – creating effective local and national communication channels to ensure staff and customers know what to do in the event of an emergency. There will also be the costs of sharing intelligence and coordinating security measures with landlords and adjoining occupiers.
• Insurance – the events insurance market is likely to see an increased demand for terrorism-specific policies, and the way in which premises are identified as high-risk under the Act may make insurers apprehensive about offering cover. Given the enhanced duties of managers for compliance, management liability insurance will also need to be considered to cover those tasked with managing the risks under the Act.
• Service charge – where the landlord or scheme owner is the lead party, or they are asked by a retailer or occupier to co-operate with them, there are likely to be costs incurred by the landlord. These compliance costs are likely to be recoverable from tenants via the service charge, although this will depend on the service charge provisions of each lease.

Other challenges for the sector

Which premises will be affected?

With draft regulations still awaited, it is unclear how capacity will be determined. Large stores such as those operated by furniture retailers can, hypothetically, accommodate as many as 800 customers and staff. In reality the presence of bulky items of furniture and customer behaviours means a retailer of this nature is highly unlikely to ever have more than 100, and certainly not 800, people in a single store. However, this lack of clarity is making it very difficult for operators to plan for implementation of the Act.

While capacity is based on what is "reasonable to expect", the Home Office suggest using a range of methods such as fire safety safe occupancy calculations and historic data. Guidance issued to date suggests that even where premises would only expect to hit the standard duty or enhanced duty thresholds on a seasonal basis (e.g. a bank holiday) or for a single promotional event they would be classified on that basis on an ongoing basis if that attendance was predictable.

Duty to co-operate

This is a new area for operators and, while they are used to operating in an arena of increasing regulation, they are usually each able to make individual assessments. The duty to co-operate will cut across that autonomy and may generate conflict between individual operators and their neighbours and landlords over what is appropriate compliance.

Impact on staff

Many operators already struggle to fill vacancies. They may be concerned about asking their frontline staff, many of whom may only work a few hours a week, to undertake training and be responsible for recognising suspicious behaviour, identifying threats and responding appropriately. In some cases, this may include carrying out bag searches, queue management or de-escalating conflicts. For many venues, it may well mean introducing or investing in additional security.

Risk assessments

Each venue must be assessed (together with any adjacent premises) to understand the risk of terrorist attack and the measures needed to mitigate any risk. Operators with multiple sites, and sometimes even thousands of sites across the country will need to assess each site individually. Not only will such assessments be costly, but the measures identified may detract from the look and feel of a brand's national trading image.

Customer experience

Operators invest significant money and resources into creating customer-centred experiences, from efficient flow through the premises to product placements and overall aesthetics and ambience. Adding security features into these environments may be problematic. Finding a way to integrate security features seamlessly into the operator's environment -for example bag checks and changing lighting to give better visibility - may jar with the venue's aesthetics. Striking a balance between safety and maintaining a welcome environment for a customer, as well as managing public perception about security of their premises and risk to customers when attending these premises, will be a concern. Ultimately, the success of a multi-let scheme and an individual operator is based on encouraging footfall rather than discouraging people from attending these types of premises. 

Sanctions for non-compliance

Sanctions for breach are significant, ranging from fixed penalties of £10,000 to the greater of £18m or 5% of worldwide revenue

A cost too far?

The profit margins of many operators in the retail, hospitality and leisure sectors are increasingly under pressure from the rising costs of operating physical premises and increased regulatory costs. For some, the implementation of Martyn's Law may well prevent them from being able to maintain physical premises on our high streets and in our shopping centres.