Investigatory Powers Act 2016 (c. 25)

Part 7 U.K. Bulk personal dataset warrants

[F1 Restriction on use of class BPD warrants etc] U.K.

Textual Amendments

F1 S. 202 cross-heading inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 1(6), 32(2); S.I. 2024/1021, reg. 2(a)

202 Restriction on use of class BPD warrants U.K.

(1) An intelligence service may not retain, or retain and examine, a bulk personal dataset in reliance on a class BPD warrant if the head of the intelligence service [F2 , or a person acting on their behalf,] considers that the bulk personal dataset consists of, or includes, protected data.

For the meaning of “protected data”, see section 203.

(2) An intelligence service may not retain, or retain and examine, a bulk personal dataset in reliance on a class BPD warrant if the head of the intelligence service [F3 , or a person acting on their behalf,] considers—

(a) that the bulk personal dataset consists of, or includes, health records, or

(b) that a substantial proportion of the bulk personal dataset consists of sensitive personal data.

(3) An intelligence service may not retain, or retain and examine, a bulk personal dataset in reliance on a class BPD warrant if the head of the intelligence service [F4 , or a person acting on their behalf,] considers that the nature of the bulk personal dataset, or the circumstances in which it was created, is or are such that its retention, or retention and examination, by the intelligence service raises novel or contentious issues which ought to be considered by the Secretary of State and a Judicial Commissioner on an application F5 ... for a specific BPD warrant.

(4) In subsection (2)—

• “health records” has the same meaning as in section 206;

• [F6 “sensitive personal data” means personal data whose retention, or (as appropriate) retention and examination, would be sensitive processing;

• “sensitive processing” means—

  (a)

  processing of personal data relating to a living individual that is processing of a kind described in section 86(7)(a) to (e) of the Data Protection Act 2018, or

  (b)

  processing of personal data relating to a deceased individual that would be that kind of processing if the personal data related to a living individual.]

[F7 (5) For the purposes of subsections (1), (2) and (3), only a person holding office under the Crown may act on behalf of the head of an intelligence service.]

Textual Amendments

F2 Words in s. 202(1) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 4(2)(a), 32(2); S.I. 2024/1021, reg. 2(d)

F3 Words in s. 202(2) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 4(2)(a), 32(2); S.I. 2024/1021, reg. 2(d)

F4 Words in s. 202(3) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 4(2)(b)(i), 32(2); S.I. 2024/1021, reg. 2(d)

F5 Words in s. 202(3) omitted (14.10.2024) by virtue of Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 4(2)(b)(ii), 32(2); S.I. 2024/1021, reg. 2(d)

F6 Words in s. 202(4) substituted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 74(11), 142(1); S.I. 2025/904, reg. 2(c)

F7 S. 202(5) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 4(2)(c), 32(2); S.I. 2024/1021, reg. 2(d)

Commencement Information

I1 S. 202 in force at 25.7.2018 by S.I. 2018/873, reg. 2(k)

[F8 202A Further provision about sensitive processing U.K.

(1) The Secretary of State may by regulations—

(a) make provision so that a description of Part 4 sensitive processing, or of processing that would be such processing if the information processed related to a living individual, is sensitive processing for the purposes of section 202, and

(b) make provision so that added processing is not sensitive processing for the purposes of that section.

(2) In this section—

• “added processing” means a description of processing that is sensitive processing for the purposes of section 202 by virtue of provision made under subsection (1)(a);

• “Part 4 sensitive processing” means processing of personal data that, at the time the regulations are made, is sensitive processing for the purposes of Part 4 of the Data Protection Act 2018 by virtue of regulations made under section 91A of that Act.

(3) Regulations under this section may amend section 202.]

Textual Amendments

F8 S. 202A inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 74(12), 142(1)(2)(h); S.I. 2025/904, reg. 2(c)

203 Meaning of “protected data” U.K.

(1) In this Part, “protected data” means any data contained in a bulk personal dataset other than data which is one or more of the following—

(a) systems data;

(b) data which falls within subsection (2);

(c) data which is not private information.

(2) The data falling within this subsection is identifying data which—

(a) is contained in the bulk personal dataset,

(b) is capable of being logically separated from the bulk personal dataset, and

(c) if it were so separated, would not reveal anything of what might reasonably be considered to be the meaning (if any) of any of the data which would remain in the bulk personal dataset or of the bulk personal dataset itself, disregarding any meaning arising from the existence of that data or (as the case may be) the existence of the bulk personal dataset or from any data relating to that fact.

(3) For the meaning of “systems data” see section 263(4).

(4) In this section, “private information” includes information relating to a person's private or family life.

Commencement Information

I2 S. 203 in force at 25.7.2018 by S.I. 2018/873, reg. 2(l)