Martyn’s Law for schools: what you need to do

If your school expects 200 or more people (staff and pupils together) to be on site at the same time, Martyn’s Law applies to you. For schools that means the standard duty: have sensible procedures for evacuation, invacuation, lockdown and communication, make sure the staff involved know them, and notify the Security Industry Authority (SIA).

Nothing is legally required yet. The Government has said there will be at least 24 months between the Act becoming law and the duties starting, so the earliest start is April 2027. That gives you time to prepare properly rather than in a rush.

Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025. It is named after Martyn Hett, who was killed in the 2017 Manchester Arena attack, and it became law when it received Royal Assent on 3 April 2025.

It requires the people in charge of publicly accessible places to think about how they would respond to a terrorist attack, and to have proportionate plans in place. The regulator is the Security Industry Authority (SIA), which will publish its own guidance and can take enforcement action.

The test is about numbers. A school is covered if it can reasonably expect 200 or more people to be present at the same time. The Government’s statutory guidance says that figure is the greatest expected number of people at the premises at the same time, and it must include staff, not just pupils.

The tougher “enhanced tier” (for premises of 800 or more) does not apply to early years, primary, secondary or further education settings. The DfE confirms they stay in the standard tier. Events held at a school are also not drawn in as separate qualifying events, although the school itself remains in the standard tier.

Work out your number and write down how you reached it. The guidance says the method must be evidenced, and you may need to satisfy the SIA that it is sound. If you have several buildings or sites, do it for each one.

The Act received Royal Assent on 3 April 2025, and the Government has said the implementation period is at least 24 months. The duties therefore cannot start before April 2027. At the time of writing, the official guidance does not give an exact start date.

Until the duties are brought into force there is no legal requirement to comply. But the work is not trivial, and the Department for Education encourages schools to use the time to prepare. Check GOV.UK for the latest, because the guidance is still developing.

The standard duty is about procedures, not equipment. Schools must have “public protection procedures” in place, so far as is reasonably practicable. There are four:

• ✓Evacuation: getting people out of the premises.
• ✓Invacuation: moving people to a safe place inside the premises.
• ✓Lockdown: securing the premises against attackers.
• ✓Communication: alerting people on the premises to the danger.

“Reasonably practicable” means proportionate. You weigh what can be done against the cost, time and difficulty. Nobody is expected to do something that would put their own safety at risk. Most schools already have fire evacuation and lockdown plans, so for many this is about reviewing and extending what exists.

Staff. There is no statutory training requirement, but staff who carry out the procedures must be made aware of them and of their own role. If nobody knows what to do, the procedures are not really in place. The guidance also calls general counter-terrorism awareness good practice for all staff.

Writing it down. There is no legal requirement for a written document at the standard tier, but the guidance says you should prepare one, and a document is the easiest way to share procedures with staff. It also recommends reviewing the procedures periodically, for example once a year.

Notifying the SIA. You must notify the SIA when you become responsible for the premises, and when you stop being responsible. The detail of how and by when will be set out in regulations and SIA guidance still to come.

The duty sits with the “responsible person”: the person or organisation with control of the premises. The DfE’s own example for a primary school is the governing body or, if there is none, the proprietor. For an academy, the trust is normally the organisation in control, but confirm this with your trust’s legal adviser.

Responsibility cannot be delegated. You can ask a hirer, contractor or colleague to carry out tasks, and a hire contract can require them to follow your procedures, but the responsible person stays accountable. Where more than one organisation is responsible for a site, they must co-ordinate with each other so far as is reasonably practicable.

The SIA can issue penalty notices if it is satisfied a school is failing to meet the duties. According to the statutory guidance, for standard tier premises the maximum is £10,000 for most contraventions, with daily penalties of up to £500 for failing to comply with certain notices.

Failing to comply with a compliance notice is not a criminal offence at the standard tier. Giving the SIA false or misleading information is an offence, though, and senior staff can be liable if an offence was committed with their consent, connivance or neglect. The Act does not create a new right to claim compensation, but existing negligence claims are unaffected.

The real cost of getting this wrong is not the fine. It is a school whose staff do not know what to do on the worst day it could face.

• ✓Work out your capacity figure, counting staff as well as pupils, and write down how you reached it.
• ✓Confirm who the responsible person is, and make sure your governors or trust board know.
• ✓Review the emergency plans you already have against all four procedures: evacuation, invacuation, lockdown and communication.
• ✓Keep each procedure short and role-specific, so every member of staff knows what they personally do.
• ✓Brief all staff, include it in induction, and practise the procedures. Drills are the quickest way to find the gaps.
• ✓Write it all down, and diarise an annual review.
• ✓Watch GOV.UK for the SIA's notification process and the confirmed start date.

Knowing exactly who is on site matters in a lockdown or evacuation, so it is worth a look at your visitor sign-in process too.

This article is based on the Government’s published guidance, last checked on 28 October 2026. Read the originals for the full detail:

• →DfE: How Martyn's Law will affect education settings
• →Home Office: Terrorism (Protection of Premises) Act 2025 statutory guidance
• →DfE: Martyn's Law for education settings (all guidance)