Martyn's Law applies to holiday parks by name. If you reasonably expect 200 or more people — guests and staff together — on site at the same time, you're in scope from the moment enforcement starts, expected around spring 2027. For most parks that size, the duty is a set of written procedures and a nominated responsible person, not building work or a security budget.
What Martyn's Law actually is
The Terrorism (Protection of Premises) Act 2025 — universally known as Martyn's Law, after Martyn Hett, who died in the 2017 Manchester Arena attack — received Royal Assent in April 2025. Statutory guidance was published on 15 April 2026, which started a roughly 24-month implementation clock. The Security Industry Authority (SIA) is the regulator: it receives notifications, reviews documentation for the larger tier, and can issue compliance and enforcement notices.
Does it apply to your site?
Schedule 1 of the Act names hotels, hostels and holiday parks directly as qualifying uses, alongside venues used for leisure or recreation "principally for the benefit of visiting members of the public." The threshold that actually decides whether the duty applies is simpler than the legal drafting suggests: it must be reasonable to expect 200 or more individuals present at the same time. That count includes your staff, not only booked guests.
There's one nuance worth knowing if your site is mostly open field and hardstanding. Purely open-air land used for recreation is generally excluded — but that exclusion falls away if you check who is entitled to be there, for example by gating access, checking guests in against a booking list, or requiring a pass or wristband to be on site. Most touring, caravan and holiday parks already do exactly that at a barrier or reception, which is likely enough to bring them into scope even though a field of pitches doesn't look like the kind of premises this law was written to picture.
Standard tier vs enhanced tier
Two tiers exist. Standard tier covers premises where 200–799 people may reasonably be present at once — this is where the overwhelming majority of UK parks will sit. Enhanced tier, for 800 or more, carries stiffer duties around physical and procedural security measures and mandatory SIA notification of enhanced-tier documentation. Unless you run one of the very largest holiday parks in the country, standard tier is the one to plan for.
What standard tier actually requires
This is the part that gets lost in the general coverage of Martyn's Law, most of which is written for concert venues and shopping centres rather than a 60-pitch touring park. For standard tier, there's no requirement to install physical security measures. What's actually required is:
- A named responsible person for the site, who notifies the SIA once the duty starts to apply to you.
- Simple, low-cost procedures covering what staff should do if there's a security incident — an evacuation or an invacuation (staying put and locking down), depending which is safer.
- Those procedures communicated and, where needed, trained into the staff and seasonal workers who'd actually be on site to carry them out.
In practice, that's a written plan, a briefing for your team at the start of each season, and someone whose name is on it. It sits alongside the fire safety and licensing paperwork most parks already maintain — it isn't a parallel bureaucracy, it's one more document in the same folder.
Timeline: what to do now, and what can wait
Enforcement isn't live yet, and the Home Office and SIA are consistently signalling spring 2027 as the likely commencement date, subject to final parliamentary confirmation. That's not a reason to leave it until then. The sites that will find this easiest are the ones that write their procedure once, calmly, ahead of the deadline — rather than producing something in a hurry once a start date is confirmed and every operator in the country is asking the same question at once.
A sensible order of operations for this year:
- Work out honestly whether you'd reasonably expect 200+ on site at peak — most mid-size-and-up parks will.
- Nominate your responsible person; it's usually the owner or general manager on a family-run site.
- Draft the evacuation/invacuation procedure and where your team gathers each season for the briefing.
- Keep it under review as pitch numbers, buildings or events on site change year to year.
Where this connects to how you run the site day to day
Whatever else changes, a responsible person needs to know who's actually on site tonight — which is exactly the number a paper diary or a phone-and-spreadsheet system struggles to give a straight answer to at short notice. A live arrivals list and headcount, the kind a booking system like HolidayPitches keeps automatically from QR check-in, is a small operational side-benefit of the same records you're already keeping for bookings — worth knowing about even if it's not the reason you'd get one. More on how the platform works, including pricing, is on our why HolidayPitches page.
This isn't legal advice — for a decision specific to your site, especially at the boundary of the 200-person threshold, check the official guidance on GOV.UK or speak to your local counter-terrorism security adviser.