Martyn's Law for premises under 800: using occupancy data to evidence your tier

Many buildings have a fire safety capacity of 800 or more, but rarely come near to filling it. That gap counts since it can determine your tier under Martyn’s Law. Here’s where evidence becomes particularly valuable. If your actual peak headcount is below 800, you may belong in the standard tier, with fewer obligations and lower penalties. However, you must be able to explain your assessment to the regulator if they request it.

This guide explains the two tiers under Martyn’s Law, what counts as acceptable evidence, and how occupancy sensors can give you a reliable record of your real peak headcount.

What is Martyn's Law?

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025. It is named after Martyn Hett, one of 22 people killed in the Manchester Arena attack in 2017. His mother, Figen Murray, campaigned for the law.

The Act requires certain public premises and events to be prepared for a terrorist attack. 

Key facts:

• Royal Assent: 3 April 2025.
• Implementation period: At least 24 months from Royal Assent. According to the Security Industry Authority, the Act is expected to come into force in spring 2027.
• Where it applies: England, Wales, Scotland, and Northern Ireland.
• Regulator: The Security Industry Authority (SIA).
• Guidance: The Home Office published the statutory guidance in April 2026.

Who does Martyn's Law apply to?

Martyn's Law applies to premises and events that meet all four conditions in section 2 of the law:

1. They are a building, part of a building, a group of buildings, or a building with land.
2. They are wholly or mainly used for a Schedule 1 use.
3. 200 or more people can reasonably be expected there at the same time, from time to time, staff included, in connection with that Schedule 1 use.
4. They are not excluded under Schedule 2.

Events are assessed separately. A public event is in scope if 800 or more people may be present at the same time and entry is checked ( e.g., ticket or pass checks).

What are the Schedule 1 uses?

Schedule 1 of the Act lists the following 17 categories of use:

• Shops
• Food and drink
• Entertainment and leisure activities
• Sports grounds
• Libraries, museums and galleries
• Halls etc
• Visitor attractions
• Hotels etc
• Places of worship
• Health care
• Bus stations, railway stations etc
• Aerodromes
• Childcare
• Primary and secondary education
• Further education
• Higher education
• Public authorities

What about mixed-use buildings?

A building can be partly in scope. A shop inside a factory, or each unit in a shopping centre, can count as qualifying premises on its own. Therefore, you should only include the people counted in the part of the building used for a Schedule 1 purpose.

Who is responsible for ensuring compliance?

If the premise is an organisation, the person responsible for ensuring compliance must be either a manager or a person in control of the organisation.

Who is exempt from Martyn’s Law?

Schedule 2 of Martyn's law excludes the following premises:

• The Houses of Parliament and the devolved legislatures and governments.
• Public parks, gardens, and recreation grounds that anyone can enter freely, with no tickets, paid entry, or other checks on who comes in.
• Transport premises already covered by their own security rules.

Standard tier vs. enhanced tier

The Act splits premises into two tiers, depending on how many people you can reasonably expect to be present at the same time, staff included. Premises that belong to the following categories stay in the standard tier regardless of how many people they expect:

• Places of worship
• Premises used for childcare
• Premises used for primary, secondary, or further education

‍

How can you determine your tier?

Your tier depends on the maximum number of people you can reasonably expect to be present at the same time, from time to time.

The Home Office's Supplementary Document A sets out six acceptable methods that can help you determine your tier. It says they "allow for flexibility and judgement":

1. Safe occupancy for fire safety purposes.
2. Historic attendance data: records from previous years "which reflect real usage at peak times".
3. Fixed seating or standing positions.
4. Tickets and pre-registration.
5. Restrictions, such as a capacity limit on a premises licence.
6. Other means, with "a justification and supporting evidence".

You must also keep in mind that:

• The figure must include employees, contractors and volunteers, not just visitors.
• "From time to time" means occasionally. The guidance says it "does not refer to an average attendance". If you pass 800 on certain days, you are in the enhanced tier.
• A surge you could not reasonably have anticipated, and won't expect again, does not change your tier on its own.

The SIA can ask how you carried out your assessment, and regardless of the method you choose, you need to be able to show your working.

Why does evidence of your real headcount matter?

A premise with a fire capacity of 800 can use that figure and end up in the enhanced tier. However, for many organisations, that would be a costly overstatement since the enhanced tier comes with additional duties and higher penalties, including:

• A written compliance document submitted to the SIA.
• Public protection measures, so far as reasonably practicable, covering monitoring, movement, physical security, and information security.
• A designated senior individual responsible for compliance with Martyn’s Law.
• Much higher penalties: up to £18 million or 5% of worldwide revenue, against £10,000 for the standard tier.

The opposite mistake is just as risky. Claiming the standard tier without evidence leaves you exposed if the SIA asks how you reached your figure. Guesswork, or a single head count on a quiet day, will not hold up.

Therefore, the answer is an accurate assessment that reflects your real peaks and is backed by data you can show.

What are the standard tier requirements?

Premises belonging to the standard tier must meet the following requirements:

1. Notify the SIA that you are the responsible person for the premises, and inform them if that stops being the case. 
2. Put appropriate public protection procedures in place, so far as reasonably practicable. These are four procedures for staff to follow if an attack happens:
   
   • Evacuation: getting people out safely.
   • Invacuation: moving people to a protected space inside the building.
   • Lockdown: securing the premises to prevent individuals from entering or leaving.
   • Communication: alerting staff and visitors and instructing them what to do.
3. Co-ordinate with other responsible persons where you share a site, such as a unit in a shopping centre.

The standard tier does not require public protection measures, a compliance document, or a designated senior individual.

How can occupancy sensors help you evidence your tier?

Occupancy sensors turn your peak headcount from an estimate into a measured record that supports the "historic attendance data" method in the Home Office guidance, which values data that reflects "actual usage at peak times".

The guidance doesn't name sensors, but it points their way. One of its own examples has an operator keeping "an hourly count of visitors" and measuring how long they stay. Another example has a nightclub tracking numbers with a clicker at the door. Sensors do the same job automatically, around the clock, and keep the record.

Occupancy is not the same as footfall.

The Act counts people present at the same time. A footfall counter that records 3,000 entries a day tells you little on its own. What you need are occupancy sensors that can:

• Count entries and exits at every entrance to calculate real-time occupancy (entries minus exits). Choose a system that resets daily and corrects for drift, so small counting errors don’t add up.
• Log totals at short intervals, such as every 1–5 minutes, so the true peak is captured, not smoothed away.
• Include staff, or let you add a verified staff figure, because the Act counts them too.
• Split by zone, so you count only the parts of the building used for a public purpose under Schedule 1.
• Keep a timestamped history that you can export for the SIA.

Step by step: preparing your evidence file

The following steps will help you build a reliable evidence file for the authorities:

1. Map the premises. Mark every public entrance and the areas used for a Schedule 1 purpose, such as retail, leisure, or hospitality. Exclude areas that are not used for a Schedule 1 purpose, such as the factory floor behind a factory shop. Staff working in the Schedule 1 areas still count.
2. Install and calibrate the sensors. Cover every entrance. Test accuracy against manual counts at a busy time, and keep a record of the test.
3. Collect at least 12 months of data. A full year captures seasonal peaks. If the duties start before you have a year, combine sensor data with other methods, such as booking records or ticket sales.
4. Add staff. Use schedules to add the maximum number of staff on site at the busiest times, unless your sensors already count them.
5. Find your actual peak. Look at the highest figure, not the daily average. Note any planned events that pushed numbers up.
6. Separate one-off spikes. If a single, unforeseeable spike breached 800, record what caused it and why you don't expect it to recur.
7. Write up the assessment. State your method, data period, peak figure, staff figure, and conclusion. Write down the name of the person who signed it off and the date.
8. Notify the SIA under the right tier once the duties start.
9. Review regularly. Review at least once a year, and again after any change in layout, opening hours, or events.

What occupancy data can't do

Sensor data is evidence, not a loophole.

• A low average won't help if your peak is high. If you regularly pass 800 on match days, at Christmas or during late openings, you are enhanced tier, even if most days are far lower.
• Planned growth countsPlanned growth and events count. If you plan events that will bring 800+ people together, the guidance expects you to anticipate it. If busier use is planned, such as longer opening hours or larger regular events, include it in your assessment. A one-off public event with 800+ people and checked entry is a qualifying event with its own enhanced duties, even if the building itself stays at the standard tier.
• Some premises are fixed by type. Premises used as places of worship, or for childcare, primary, secondary, or further education are always in the standard tier. Data won't move them into the enhanced tier, and they don't need it for that purpose.

If your data shows peaks close to 800, consider managing them. Timed entry, booking systems, or a lower limit can keep numbers below the threshold.

Frequently asked questions

Does my fire safety capacity decide my Martyn's Law tier?

Not on its own. The test is how many people you can reasonably expect to be present at the same time. Fire capacity is one of six methods the Home Office lists for estimating that.

Do staff count towards the 200 and 800 thresholds?

Yes. The figure must include employees, contractors, and volunteers in the parts of the premises used for a Schedule 1 purpose.

My building is usually under 800, but busier at Christmas. Which tier am I in?

If you can reasonably expect 800 or more at those times, you are in the enhanced tier. "From time to time" means occasionally, not on average.

What if we passed 800 once, unexpectedly?

A one-off surge you could not reasonably have anticipated, and don't expect again, does not, on its own, move you into the enhanced tier. Record what happened.

Can occupancy sensor data be used as evidence?

The guidance doesn't name sensors, but it accepts historic attendance data that reflects actual peak usage. Accurate, timestamped occupancy sensor records are a strong way to provide it.

How long should we collect data for?

No period is set. Twelve months is a sensible target, because it captures seasonal peaks.

When does Martyn's Law come into force?

The implementation period is at least 24 months from Royal Assent on 3 April 2025. According to the Security Industry Authority, the Act is expected to come into force in spring 2027.

Does Martyn's Law apply in Scotland and Northern Ireland?

Yes. It applies across England, Wales, Scotland, and Northern Ireland.

How Ubiqisense can help you

Ubiqisense turns live occupancy data into the evidence Martyn's Law asks for. The example below is a university teaching building, with names pseudonymised.

Seats say enhanced tier; measured says standard tier. 

The building has 1,304 seats across 42 monitored rooms. A seat count would put it in the enhanced tier. 

In the first 84 days of data collection, at most 570 people were in those rooms at the same time. The sensors cover the 42 rooms, but the Act counts everyone in the building, including people in corridors, offices, and toilets. Therefore, the university adds an allowance for those unmonitored areas, set at 100 people. Adding that to the measured peak gives a reasonably expected maximum of 670 people. That is 130 below the 800 threshold, which puts the building in the standard tier.

The university will keep collecting data and review the figure continuously, including during exam periods and open days.

A tier assessment you can show.

Ubiqisense sensors send occupancy data every 20 seconds. The platform charts each day's busiest hour, checks the busiest days at 15-minute resolution, and includes staff. It drafts a method statement covering the premises, use, assessment period, method, result, and conclusion. The figure updates daily and flags a review if it comes within 100 of a threshold, or before events like open days and exams.

Duties, incidents, and evidence in one place. 

A checklist tracks each standard-tier duty: assessing numbers, notifying the SIA, and the evacuation, invacuation, lockdown, and communication procedures. Drills run on real counts, floor by floor, and are saved with their timings. An evidence summary pulls it together, ready to copy.

Works with the systems you already run. 

Ubiqisense consolidates data from your existing IP cameras, entrance counters, and other building data sources in one platform, with native occupancy sensors as the primary data source wherever you need real-time, room-level detail. You can send real-time occupancy counts and procedure events to your other tools over MQTT and BACnet, or through the API.

Privacy by design. 

The Ubiqisense sensor does not collect personal data. It processes everything on the device and sends only anonymous occupancy data, such as people counts, positions, and timestamps, to the Ubiqisense platform.

Ubiqisense was founded in Denmark in 2016 and built the sensor to be GDPR-compliant from the start. It is also ISO 27001 and SOC 2 certified.

Since Ubiqisense is cloud-agnostic, data can be hosted on AWS in the region of your choice, or on Microsoft Azure, Google Cloud, a private in-country cloud, or fully on-premises.

Conclusion

Martyn's Law tiers are based on the people you can reasonably expect, not the most your building could hold. For many organisations with a fire capacity over 800, accurate data could show they belong in the standard tier.

We strongly suggest that you start collecting data now. With the main duties expected from spring 2027, data gathered from today would cover Christmas, Easter and the spring term before you need to notify the SIA. Keep collecting after that to complete a full year and confirm your tier at your first review.

This article is general information, not legal advice.

Find out how Ubiqisense can help you evidence your Martyn's Law tier.