Protect Duty Bill: what to expect

This article was co-authored by Weronika Dorociak, UK Government Relations Advisor, London.

The tragic Manchester arena bombing that occurred on 22 May 2017 has prompted a campaign for legislation to better protect the public from the risk of terrorist attacks. The UK Government has confirmed that it will introduce legislation (commonly referred to as the ‘Protect Duty’ or ‘Martyn’s Law’) focused on improving the safety and security of public venues in the UK in spring 2023.

In this article, we explore the measures that might be included in the upcoming Protect Duty Bill and explain how these might impact businesses.


On 26 February 2021, the Home Office launched a consultation on how the UK Government could improve protective security and organisational preparedness at publicly accessible locations across the UK.

The Home Office’s response published in January 2022 revealed that 70% of respondents agreed that there should be additional measures to protect the public from terror attacks. However, a recurring concern raised in the responses was that the “Duty may negatively impact organisations financially”. Analysis revealed that 66% of those who responded to one of the questions (Q40) which highlighted the potential costs associated with the Duty, disagreed with the cost and benefit estimates.

Updated proposal

On 19 December 2022, the UK Government announced further details on the Protect Duty and confirmed that draft legislation will be published in early spring 2023, following the release of the final report into the Manchester Arena Inquiry in March.

Based on the Government’s announcement, it appears that the Protect Duty is likely to be less extensive than proposed in the Government’s consultation. The Duty will now apply to premises that meet the following three criteria:

Qualifying activities

The Duty will apply to locations where ‘qualifying activities’ take place. This includes:

  • Locations used for entertainment and leisure
  • Retail shops
  • Restaurants or locations that provide food and drinks
  • Museums and galleries
  • Sports grounds
  • Public areas that are used by the local or central government
  • Visitor attractions
  • Temporary events
  • Places of worship
  • Locations used for health purposes
  • Locations used for educational purposes.

Eligible locations

The Home Office considers a location to be eligible if it is:

  • A building or a collection of buildings used for the same purpose (e.g. a campus).
  • Location/event that has a defined boundary, allowing capacity to be known.

Maximum occupancy

The premises drawn into the scope of the Duty will have to meet specified capacity thresholds, namely:

100+ (standard tier)

Standard Duty holders will need to ensure that they complete free training, raise awareness among staff members and complete a preparedness plan.

800+ (enhanced tier)

Enhanced Duty holders will be asked to completer risk assessments and develop comprehensive security plans that are of 'reasonably practicable' standard.


The UK Government has also stated that there will be some exemptions from the Duty, including:

  • Locations where transport security regulations already apply
  • Places that are vacant over a reasonable period
  • Places that are permanently closed
  • Locations with a large floor space and low occupancy in practice (e.g. warehouses and storages)
  • Offices and private residential locations.
The Protect Duty Bill is currently facing a delay and is yet to appear on the parliamentary schedule. However, businesses should expect it to be published in the current parliamentary session.

Possible implications for businesses

Owners and operators of the locations that fall within the scope of the Duty will have to carefully consider their risks in ensuring compliance.

In a similar fashion to health and safety policies and risk assessments, the new legislation will likely require liability underwriters asking additional questions of policyholders. Brokers will also need to reflect on whether the limits they recommend for their clients will be sufficient.

Furthermore, although enforcement procedures have not yet been clarified, it is expected that measures will include regular diarised and on-the-spot inspections by a governing body. The consultation also proposed a new offence for those organisations who persistently fail to take reasonable steps to reduce the potential impact of attacks, based on civil rather than criminal sanctions. However, it remains to be seen whether this suggestion will be taken forward.

If a security breach resulted in an incident leading to a person’s death and was considered serious enough, venues could face prosecution under legislation such as the Corporate Manslaughter and Corporate Homicide Act 2007. Whilst this offence is very difficult to prove, investigations are hugely intrusive and a conviction of corporate manslaughter would have an enormous reputation impact as well as the prospect of an unlimited fine, both of which will be of serious concern to businesses.
It is also possible for prosecution costs to be awarded against the organisation and courts can impose ‘remedial orders’ on companies found guilty, forcing them to change their procedures to comply with health and safety laws. Additionally, since 2010, it has been possible to order companies to publicise the fact that they have been convicted which has the potential to cause significant reputational damage.


The terrorist attack in 2017 giving rise to this Bill was one of several in the UK and worldwide in recent years. Whilst there were failings within the national security services’ analysis prior to the Arena bombing and “missed opportunities”, the Inquiry noted that the process surrounding risk and perception of risk from such attacks at venues is often misguided. Whilst the risk of an attack may be low, the impact of an attack is devastating. As such, steps need to be taken to guard against that. Martyn’s Law should go some way to increase security at public spaces.

This legislation is likely to impact the leisure sector within the UK, but may also be used as touchstone for good practice for those providing accommodation overseas. It is possible we may see arguments for this duty extending to UK operators using overseas hotels.

Ultimately, the new Duty will require those responsible under the legislation to properly consider the threat and implement appropriate and proportionate mitigation measures. If an attack transpires, notwithstanding those measures, better training and planning should lead to a better response.

Related items: