Martyn's Law for Shopping Centres 2026 Guide

Last updated: 25 October 2026

Martyn's Law for shopping centres is the common name for the Terrorism (Protection of Premises) Act 2025, which imposes new legal duties on operators of premises expecting large crowds. Because most centres accommodate 800 or more people at once, the majority sit in the enhanced tier, requiring a named responsible person, a documented risk assessment and coordinated procedures across every tenant.

Key Takeaways

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, which received Royal Assent on 3 April 2025, according to ProtectUK (2026).
Most shopping centres will fall into the enhanced tier, which applies to premises expecting 800 or more people at the same time, per Mappedin (2026).
Enhanced tier premises face a maximum civil penalty of £18 million or 5% of qualifying worldwide revenue, whichever is greater, according to Policy Pros (2026).
The Home Office estimates total UK compliance costs for Martyn's Law at between £1.1 billion and £6.3 billion, per United Outcomes (2026).
27% of retail workers report feeling unsafe at work, and 42% say they have no way to instantly notify colleagues during an incident, according to Mappedin (2026).

What is Martyn's Law and what is its official name?

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025, an Act of Parliament that places legal duties on those responsible for qualifying public premises and events to prepare for a terrorist attack. The Act received Royal Assent on 3 April 2025, with an expected implementation period of at least 24 months, according to ProtectUK (2025).

The law is named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena bombing, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. His mother, Figen Murray, led the campaign that eventually drove the Act onto the statute book. The Home Office published its final Section 27 statutory guidance — the detailed rulebook operators must follow — on 15 April 2026, comprising a main document plus three supplementary guides, according to Standard Tier (2026).

For shopping centre operators, the practical effect is simple: preparedness for a terrorist attack stops being a discretionary nice-to-have and becomes a statutory duty, enforced by a dedicated regulator with civil and criminal powers.

Does Martyn's Law apply to my shopping centre, and how is the capacity threshold calculated?

Martyn's Law applies to a shopping centre if the premises could reasonably hold 200 or more people at the same time, counting public and staff together — not average daily footfall. Capacity is judged on the maximum number who could realistically be present, including busy weekends and seasonal peaks such as Christmas trading, per Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

Because most shopping centres, retail parks and covered malls comfortably exceed 800 people at peak times, most shopping centres will fall into the enhanced tier, according to Mappedin (2026). A small parade of shops or a compact retail unit might sit below the 200 threshold and fall outside scope entirely, but anything with a food court, anchor department store, cinema or multiple large units should assume enhanced tier status until proven otherwise.

Operators should not rely on typical Tuesday-afternoon footfall to argue their way into the lower tier. Regulators will look at design capacity — fire certificate occupancy figures, car park spaces, and event-day maximums — not quiet-day averages.

Standard tier vs enhanced tier: which applies to a shopping centre?

The standard tier applies broadly to premises where 200 to 799 people may be present, focused on low-cost, common-sense preparedness such as basic evacuation and lockdown procedures and staff awareness training. The enhanced tier applies broadly to premises and events where 800 or more people may be present, and carries heavier duties including a documented, regularly reviewed risk assessment, according to Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams.

The financial exposure between the two tiers is stark. Standard tier premises face a maximum civil penalty of £10,000, with daily penalties of up to £500 for continued non-compliance, according to Policy Pros (2026). Enhanced tier premises face a maximum civil penalty of £18 million or 5% of qualifying worldwide revenue — whichever is greater — with daily penalties of up to £50,000, per Policy Pros (2026).

Feature	Standard tier (200–799)	Enhanced tier (800+)
Core duty	Basic evacuation/lockdown procedures	Documented, current risk assessment plus procedures
Staff training	General awareness	Structured, role-specific training
Responsible person	Named individual	Named individual with organisational backing
Max civil penalty	£10,000	£18m or 5% of worldwide revenue
Daily penalty (non-compliance)	Up to £500	Up to £50,000

Given the penalty gap, misclassifying a shopping centre as standard tier when it is genuinely enhanced tier is one of the costliest mistakes an operator can make.

Who is legally responsible for compliance in a shopping centre?

The responsible person is the individual or organisation the Act holds accountable for compliance, and in most shopping centres this will be the landlord or managing agent who controls the common parts, not each individual retailer. Legal commentary from DAC Beachcroft notes that "the person responsible for a store within a shopping centre must comply with the operator of the shopping centre as necessary for the operator to fulfil their duties under the Bill."

That creates a layered structure. The centre operator typically holds overall responsibility for concourses, service corridors, car parks and shared plant rooms, while individual tenants remain responsible for procedures within their own demised units — stockrooms, tills, staff areas. Both duties must interlock: a fire exit shared between three units, or an evacuation route through a service yard, cannot have three different evacuation plans running in parallel.

Martyn's Law means someone has to own the whole picture, not just their own unit. Get the responsible person named, get evacuation and lockdown procedures agreed across every tenant, and rehearse them together — a plan that only lives in head office is no plan at all."

What specific measures must be in place under the enhanced tier?

Enhanced tier duties require a documented risk assessment covering the premises' vulnerability to a terrorist attack, and that assessment must be kept current rather than treated as a one-off exercise, according to Pulse Operations's guide, Martyn's Law: a readiness guide for security & FM teams. Beyond the assessment, operators need public protection procedures — evacuation, invacuation (moving people to safety within the building), and lockdown — plus a named responsible person, staff training, and records sufficient to demonstrate compliance to the regulator.

For a shopping centre, this typically means:

A single risk assessment covering the whole footprint: concourses, malls, service yards, multi-storey car parks and plant rooms
Coordinated lockdown and evacuation procedures agreed with every tenant, not just the centre's own staff
Staff training that covers security guards, cleaning contractors, centre management and retail employees alike
A tamper-evident record of training delivered, drills run, and incidents logged
CCTV coverage, access control and search procedures proportionate to the assessed risk

This is where the retail safety gap becomes relevant. 27% of retail workers report feeling unsafe at work, and 42% say they have no way to instantly notify colleagues if an incident occurs in-store, according to Mappedin (2026). Enhanced tier duties are, in part, a direct response to that gap — lockdown procedures and staff communication cannot rely on shouting down a corridor.

What are the penalties for non-compliance with Martyn's Law?

Non-compliance with Martyn's Law carries both civil and criminal consequences, enforced by a regulator with inspection and sanction powers. On the civil side, enhanced tier premises face fines up to £18 million or 5% of qualifying worldwide revenue, whichever is greater, with daily penalties of up to £50,000 for continued breaches, according to Policy Pros (2026). Standard tier premises face a lower ceiling of £10,000, plus daily penalties of up to £500, per Policy Pros (2026).

Criminal offences sit alongside the civil regime. Individuals found guilty of offences under the Act — such as obstructing an SIA officer carrying out an inspection — face up to 12 months' imprisonment and/or a fine of up to £10,000 on summary conviction, or 2 years' imprisonment and/or an unlimited fine on indictment, according to Lexology (2026). The regulator has statutory inspection powers, meaning a shopping centre could face an unannounced visit and be asked to produce its risk assessment and training records on the spot.

For a large enhanced-tier shopping centre with significant turnover, the revenue-linked penalty makes this one of the more severe compliance regimes UK operators now face — comparable in tone to GDPR enforcement under the ICO, where fines also scale with global turnover.

What steps should a shopping centre take now to prepare?

Preparation should start with capacity classification, move through risk assessment, and end with rehearsed, recorded procedures across every tenant. Waiting for the enforcement deadline to arrive is the single riskiest strategy, given the Home Office's own estimate that total UK compliance costs will run between £1.1 billion and £6.3 billion, according to United Outcomes (2026) — a range wide enough to suggest early movers will spend considerably less than late ones scrambling against a deadline.

In practice, Pulse Operations has seen how quickly disorganised sites can be brought under control. At a landmark West London mixed-use development, Priority First — the founding team's own London security and FM operation, inside which Pulse was originally built before being offered to other operators — took on retail, residential, plant rooms and service yards along one of West London's best-known streets, with no reliable way to prove which plant room had actually been checked overnight. Pulse made all 152 checkpoints across the site photo-mandatory, so a missed area shows up as a gap in the record rather than a dispute weeks later. The site has been live since February 2026, with more than 540 patrols logged in the first five months and 11 officers inducted onto one system.

Your Martyn's Law shopping centre checklist

Confirm your centre's design capacity against fire certificate figures, not average footfall
Determine standard or enhanced tier status and document the reasoning
Name a responsible person with organisational authority to act across the whole site
Commission a single, whole-site risk assessment covering concourses, car parks and plant rooms
Agree evacuation and lockdown procedures jointly with every tenant, not centre staff alone
Deliver and record structured training for security, cleaning, retail and management staff
Run a joint drill involving tenants and log the outcome in a tamper-evident record
Review and refresh the risk assessment on a set schedule, not a one-off basis

Standard tier or enhanced tier: how do you decide?

Most shopping centre operators default to enhanced tier planning simply because the downside of under-preparing is so severe — daily penalties of up to £50,000 dwarf the standard tier's £500 ceiling. Where genuine doubt exists (a small retail parade, a low-footfall arcade), operators should document the capacity calculation and revisit it whenever occupancy changes, such as a new anchor tenant or an extended food court.

FAQ

Does Martyn's Law apply to shopping centres with multiple separate landlords?

Yes, if the combined premises reasonably accommodate 200 or more people, Martyn's Law applies regardless of how many freeholders or leaseholders are involved. Responsibility is typically apportioned by control of common areas, meaning the operator managing the concourses, malls and shared services usually holds the primary responsible person duty, while individual tenants remain responsible within their own units.

What counts towards the capacity threshold in a shopping centre?

Capacity counts everyone who could reasonably be present at once, including staff, shoppers, contractors and event attendees, not a typical Tuesday footfall count. Operators should use fire certificate occupancy figures or event-day maximums, since Martyn's Law is judged on peak capacity rather than average daily numbers.

Who enforces Martyn's Law against shopping centres?

The regulator has statutory powers to inspect premises, request risk assessments and issue civil penalties for non-compliance. Enhanced tier premises face fines up to £18 million or 5% of qualifying worldwide revenue, whichever is greater, according to Policy Pros (2026), alongside daily penalties for continued breaches.

How much will Martyn's Law compliance cost a shopping centre?

Costs vary enormously by site size and existing security infrastructure, and the Home Office itself estimates the nationwide total at between £1.1 billion and £6.3 billion, according to United Outcomes (2026). For an individual centre, expect costs across risk assessment, staff training, CCTV/access control upgrades and ongoing record-keeping rather than a single one-off fee.

Can individual retailers ignore Martyn's Law because the landlord is responsible?

No, individual retailers within a shopping centre retain duties for their own units even where the landlord holds primary responsibility for shared areas. Legal guidance confirms tenants must cooperate with the centre operator to allow the operator to fulfil its duties, meaning retailers cannot simply defer everything to head office.

When does Martyn's Law come into force for shopping centres?

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, with an expected implementation period of at least 24 months before full enforcement, according to ProtectUK (2025). The Home Office published its final Section 27 statutory guidance on 15 April 2026, giving operators a firmer basis to finalise their compliance work ahead of enforcement.

Does Martyn's Law replace existing fire safety and health and safety duties?

No, Martyn's Law sits alongside existing duties under the Regulatory Reform (Fire Safety) Order 2005 and the Health and Safety at Work etc. Act 1974, rather than replacing them. Shopping centres already running fire risk assessments and health and safety management systems should integrate Martyn's Law requirements into those existing frameworks rather than building an entirely separate compliance silo.

Securing your shopping centre's Martyn's Law compliance with Pulse Operations

Coordinating a single risk assessment, joint tenant procedures and a tamper-evident training record across dozens of retail units, service corridors and car parks is exactly the kind of multi-site complexity Pulse Operations was built to handle. The compliance runway brings SIA licensing, BS 7858 screening, DBS checks, right to work, training records and Martyn's Law assessments onto one expiries timeline, so a shopping centre operator can see at a glance which tenant, which contractor and which officer needs action before an inspector asks.

At the West London mixed-use development described above, Pulse Operations turned an unprovable overnight round into 152 photo-mandatory checkpoints and more than 540 recorded patrols within five months — the same discipline that underpins a defensible Martyn's Law audit trail. Every checkpoint is completed by a mandatory watermarked photograph — officer, site, GPS, time — with no tag scans by design, so the photo is the proof, not a promise.

If your shopping centre needs a clear plan for tenant coordination, evidence retention and enhanced tier readiness, get in touch with Pulse Operations for a walkthrough of the compliance runway and how it fits alongside patrols, incident logging and the client portal.

Explore Pulse Operations services

Take the 2-minute tour Pulse for security companies Pulse for facilities management Mobile patrol & keyholding

Written by

Lauren Dawkins — Founder, Pulse

Lauren Dawkins is a founder of Pulse, the operations platform for UK security and facilities companies. Pulse was built inside the founding team's own security and FM operation — real patrols, real clients, real compliance — before being opened to other operators.

Founding team, Pulse · UK security & facilities operations