UK Investigatory Powers Act — the verified record, live

The Investigatory Powers Act 2016 is the UK's consolidated legal framework for state surveillance: interception, equipment interference, communications data acquisition and retention, and bulk powers, all subject to the double lock of Secretary of State authorisation and Judicial Commissioner approval. It matters to industry because it operates partly through obligations on communications providers — data retention notices, technical capability notices and national security notices — which can require operators, including overseas services, to maintain capabilities to assist. The Investigatory Powers (Amendment) Act 2024 updated the regime, adding a lighter-touch bulk personal dataset regime, changes on internet connection records, and a notification requirement obliging certain operators to inform the Home Office before making technical changes that could affect lawful access — a provision that has drawn strong objections from encrypted service providers. Oversight sits with the Investigatory Powers Commissioner's Office, with complaints heard by the Investigatory Powers Tribunal, whose proceedings on encryption-related notices have been closely watched.

Every document below comes from the body that published it — regulators, courts, parliaments, official registers — with its true publication date and a link to the primary source.

as of 2026-08-31 · refreshed from scheduled releases

Latest developments

Publishing bodies represented

Frequently asked

Who oversees the Investigatory Powers Act?

The Investigatory Powers Commissioner's Office, led by a senior judge, oversees the use of investigatory powers, and Judicial Commissioners must approve warrants alongside the Secretary of State under the double-lock mechanism. The Investigatory Powers Tribunal hears complaints and claims against the intelligence agencies and public authorities, and the Technical Advisory Board advises on the reasonableness of obligations imposed on operators.

What obligations can the IPA place on communications providers?

The Home Secretary can issue data retention notices requiring providers to retain communications data, technical capability notices requiring them to maintain the ability to give effect to warrants — which can extend to removing electronic protection applied by the operator — and national security notices. The 2024 amendments added a requirement for specified operators to notify proposed technical changes affecting lawful access capabilities.

Does the IPA apply to companies outside the UK?

It can. The Act asserts extraterritorial reach for certain warrants and notices, and technical capability notices can be given to overseas operators providing services to the UK, though enforceability abroad varies. This reach, particularly as applied to end-to-end encrypted services, has been the focus of public disputes and Tribunal litigation involving major technology companies, with the details often heard partly in closed session.

More: The Wire — this week across the record · all 38 ecosystems · analyst briefs on this regulation ↗