Martyn's Law for pubs and restaurants: does your venue reach 200 people? The headcount, worked for three venues

Martyn's Law applies to a pub, restaurant or hotel where it is reasonable to expect 200 or more people on the premises at the same time, from time to time. The count includes your staff, and it includes a beer garden or terrace. Many venues that think of themselves as small will cross the line on their busiest night.

The law is the Terrorism (Protection of Premises) Act 2025. It received Royal Assent on 3 April 2025 and applies across the UK. The government promised an implementation period of at least 24 months, so the main duties will not start before April 2027. The Security Industry Authority (SIA) will regulate it.

Is your venue covered at all

Section 2 and Schedule 1 of the Act cover premises used wholly or mainly for listed purposes. Two matter here:

• sale of food or drink mainly for consumption on the premises by visiting members of the public (pubs, bars, restaurants, cafes)
• use as a hotel, a hostel or a holiday park

The premises must be a building, or a building and other land. The statutory guidance gives "a pub with a beer garden" and "a restaurant with outside seating" as examples of a building and other land. So the garden counts towards the number.

Almost every independent pub or restaurant that is in scope will be standard duty.

How to count

The guidance says the figure "must include staff working at the premises". It suggests methods such as booking or attendance records, fixed seats, the capacity in your fire risk assessment, and floor space. The words "from time to time" mean you count a peak that really happens, such as a summer Saturday, a match night or a Christmas party, not an average Tuesday.

Our three worked venues, each at its realistic peak:

The town pub sits 12 people under the line. If its New Year's Eve or a big final regularly fills the garden with standing drinkers, that night is the one to count, and it may tip the pub into scope. The gastropub shows why staff matter: without its 20 staff it would be at 180. For the hotel we counted residents who were not at the wedding or in the restaurant, so no one appears twice.

Write your count down with the date, the night you chose and the method. If the SIA asks, a reasoned figure is far easier to defend than a guess.

What the standard duty asks

Section 5 requires "appropriate public protection procedures", meaning actions staff can take if they suspect an attack, so far as reasonably practicable. The guidance names four:

1. Evacuation: getting people out of the building and away from danger.
2. Invacuation: moving people to a safer place inside, such as a cellar, a kitchen or a function room with a lockable door.
3. Lockdown: securing the premises so people cannot get in or out.
4. Communication: alerting people and giving instructions.

The standard duty does not require physical measures such as bag searches or barriers. For most pubs the work is deciding the routes and the safe rooms, who locks which doors, how the team tells customers, and making sure every person on a shift knows it. A fire evacuation plan already covers part of the first point.

Telling the SIA

Section 9 and the Notification Requirements Regulations 2026 set the deadline. Whoever is responsible for the premises when the duty starts must notify the SIA within three months, through the SIA's online portal. After that, a new responsible person has 28 days from taking over. Someone who stops being responsible must notify too, within the same windows.

The notification includes names and contact details, the address, the capacity figure, any website or social media, licensing details and the type of use. Anyone buying or taking on a pub should add it to the handover list beside the premises licence transfer. The guidance makes clear that where a pub company holds the licence but a tenant controls the building, the tenant is usually the responsible person.

Penalties

For standard duty premises, section 18 sets the maximum penalty for a breach at £10,000. Failing to attend or answer questions when required carries up to £5,000. Enhanced duty premises face up to £18 million or 5% of worldwide revenue, whichever is greater.

What to do this winter

• Count your peak, with staff and outside space, and keep the working.
• If you are at 200 or more, draft the four procedures and walk them round the building with your team.
• Add the procedures to your new starter checklist, so agency and seasonal staff hear them on their first shift.
• Put a reminder in for the commencement date, which the government has not yet fixed.

Overlyft can set up an AI assistant to draft the headcount record, the four procedures and the staff briefing from what you tell it about the building, for you to check against the statutory guidance and sign off yourself.

This is general information, not legal advice. The statutory guidance on GOV.UK and the SIA are the authorities for your venue.