http://www.legislation.gov.uk/ukpga/2016/25/part/7BInvestigatory Powers Act 2016An Act to make provision about the interception of communications, equipment interference and the acquisition and retention of communications data, bulk personal datasets and other information; to make provision about the treatment of material held as a result of such interception, equipment interference or acquisition or retention; to establish the Investigatory Powers Commissioner and other Judicial Commissioners and make provision about them and other oversight arrangements; to make further provision about investigatory powers and national security; to amend sections 3 and 5 of the Intelligence Services Act 1994; and for connected purposes.texttext/xmlenStatute Law Database2026-08-19Expert Participation2026-05-11 Investigatory Powers Act 2016s. 48ACrime and Policing Act 2026s. 180(2)s. 255(1) Part 7B226E1For the purposes of this Part, an intelligence service examines a third party bulk personal dataset if—athe intelligence service has relevant access, whether on payment or otherwise, to a set of information that is held electronically by a person other than an intelligence service,bthe set includes personal data relating to a number of individuals,cthe nature of the set is such that the majority of the individuals are not, and are unlikely to become, of interest to the intelligence service in the exercise of its functions, anddafter any initial inspection of the contents (see section 226I), the intelligence service examines the set electronically (but does not obtain the set) for the purpose of the exercise of its functions.2For the purposes of subsection (1)(a), an intelligence service has “relevant access” to a set of information that is held electronically by another person where—athe access is made available to the intelligence service as a result of arrangements made directly between the intelligence service and that other person,bthe type and extent of the access available to the intelligence service is not generally available (whether on a commercial basis or otherwise), andcthe access is electronic.226F1An intelligence service may not exercise a power to examine a third party bulk personal dataset unless the examination of the dataset is authorised by a third party BPD warrant.2A “third party BPD warrant” is a warrant issued under this Part authorising an intelligence service to examine any third party bulk personal dataset described in the warrant.3A third party BPD warrant may authorise the examination of a bulk personal dataset—athe content of which may vary from time to time, orbthat does not exist at the time of the issue of the warrant.226FA1Section 226F(1) does not apply to the exercise of a power of an intelligence service to examine a third party bulk personal dataset if the intelligence service examines the bulk personal dataset under any other warrant or authorisation issued or given under this Act.2See section 226I(5) (initial inspection) for a further exception to 226F(1).226G1The head of an intelligence service, or a person acting on their behalf, may apply to the Secretary of State for a third party BPD warrant.2The application must include a general description of the bulk personal dataset (or datasets) to which the application relates.3Where the person making the application knows that subsection (6) applies to any bulk personal dataset to which the application relates, the application must also include a statement to that effect.4The Secretary of State may issue the warrant if—athe Secretary of State considers that the warrant is necessary—iin the interests of national security,iifor the purposes of preventing or detecting serious crime, oriiiin the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,bthe Secretary of State considers that the conduct authorised by the warrant is proportionate to what is sought to be achieved by the conduct,cthe Secretary of State considers that the arrangements made by the intelligence service for examining the bulk personal dataset (or datasets) to which the application relates are satisfactory, anddexcept where the Secretary of State considers that there is an urgent need to issue the warrant, the decision to issue the warrant has been approved by a Judicial Commissioner.5The fact that a third party BPD warrant would authorise the examination of bulk personal datasets relating to activities in the British Islands of a trade union is not, of itself, sufficient to establish that the warrant is necessary on grounds falling within subsection (4)(a).6This subsection applies to a bulk personal dataset if—athe dataset consists of, or includes, protected data or health records,ba substantial proportion of the dataset consists of sensitive personal data, orcthe nature of the dataset, or the circumstances in which it was created, is or are such that its examination by the intelligence service is likely to raise novel or contentious issues.7In this section—“health record” means a record, or a copy of a record which—consists of information relating to the physical or mental health or condition of an individual,was made by or on behalf of a health professional in connection with the care of that individual, andwas obtained, by the person (mentioned in section 226E(1)(a)) who holds the dataset, from a health professional or a health service body or from a person acting on behalf of a health professional or a health service body in relation to the record or the copy;“sensitive personal data” has the meaning given by section 202(4).8In subsection (7), “health professional” and “health service body” have the meaning given by section 206(7).9An application for a third party BPD warrant may only be made on behalf of the head of an intelligence service by a person holding office under the Crown.226GA1In deciding whether to approve a decision to issue a third party BPD warrant, a Judicial Commissioner must review the Secretary of State’s conclusions as to the following matters—awhether the warrant is necessary on grounds falling within section 226G(4)(a), andbwhether the conduct that would be authorised by the warrant is proportionate to what is sought to be achieved by that conduct.2In doing so, the Judicial Commissioner must—aapply the same principles as would be applied by a court on an application for judicial review, andbconsider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).3Where a Judicial Commissioner refuses to approve a decision to issue a third party BPD warrant, the Judicial Commissioner must give the Secretary of State written reasons for the refusal.4Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to issue a third party BPD warrant, the Secretary of State may ask the Investigatory Powers Commissioner to decide whether to approve the decision to issue the warrant.226GB1This section applies where—aa third party BPD warrant is issued without the approval of a Judicial Commissioner, andbthe Secretary of State considered that there was an urgent need to issue it.2The Secretary of State must inform a Judicial Commissioner that it has been issued.3The Judicial Commissioner must, before the end of the relevant period—adecide whether to approve the decision to issue the warrant, andbnotify the Secretary of State of the Judicial Commissioner’s decision.The “relevant period” means the period ending with the third working day after the day on which the warrant was issued.4Subsections (5) and (6) apply if a Judicial Commissioner refuses to approve the decision to issue a third party BPD warrant.5The warrant—aceases to have effect (unless already cancelled), andbmay not be renewed,and section 226GA(4) does not apply in relation to the refusal to approve the decision.6The head of the intelligence service to whom the warrant was addressed must, so far as is reasonably practicable, secure that anything in the process of being done in reliance on the warrant stops as soon as possible.7Nothing in subsection (5) or (6) affects the lawfulness of—aanything done in reliance on the warrant before it ceases to have effect;bif anything is in the process of being done in reliance on the warrant when it ceases to have effect—ianything done before that thing could be stopped, oriianything done that it is not reasonably practicable to stop.226GC1The decision to issue a third party BPD warrant must be taken personally by the Secretary of State.2Before a third party BPD warrant is issued, it must be signed by the Secretary of State.3But if it is not reasonably practicable for a third party BPD warrant to be signed by the Secretary of State, it may be signed by a senior official designated by the Secretary of State for that purpose.4In such a case, the warrant must contain a statement that—ait is not reasonably practicable for the warrant to be signed by the Secretary of State, andbthe Secretary of State has personally and expressly authorised the issue of the warrant.226GDA third party BPD warrant must—abe addressed to the head of the intelligence service by whom, or on whose behalf, the application for the warrant was made, andbinclude a general description of the bulk personal dataset (or datasets) to which the warrant relates.226H1A third party BPD warrant ceases to have effect at the end of the relevant period unless—ait is renewed before the end of that period (see section 226HA), orbit is cancelled or otherwise ceases to have effect before the end of that period (see sections 226GB and 226HB).2In this section “the relevant period”—ain the case of an urgent third party BPD warrant, means the period ending with the fifth working day after the day on which the warrant was issued, andbin any other case, means the period of 12 months beginning with—ithe day on which the warrant was issued, oriiin the case of a warrant that has been renewed, the day after the day at the end of which the warrant would have ceased to have effect if it had not been renewed.3For the purposes of this section, a third party BPD warrant is an “urgent third party BPD warrant” if—athe warrant was issued without the approval of a Judicial Commissioner, andbthe Secretary of State considered that there was an urgent need to issue it.226HA1If the renewal conditions are met, a third party BPD warrant may be renewed, at any time during the renewal period, by an instrument issued by the Secretary of State.2The renewal conditions are—athat the Secretary of State considers that the warrant continues to be necessary on grounds falling within section 226G(4)(a),bthat the Secretary of State considers that the conduct that would be authorised by the renewed warrant continues to be proportionate to what is sought to be achieved by the conduct, andcthat the decision to renew the warrant has been approved by a Judicial Commissioner.3In this section the “renewal period” means—ain the case of an urgent third party BPD warrant which has not been renewed, the relevant period;bin any other case, the period of 30 days ending with the day at the end of which the warrant would otherwise cease to have effect.4The decision to renew a third party BPD warrant must be taken personally by the Secretary of State, and the instrument renewing the warrant must be signed by the Secretary of State.5Section 226GA (approval of warrants by Judicial Commissioner) applies in relation to a decision to renew a warrant as it applies in relation to a decision to issue a warrant.6In this section—“the relevant period” has the same meaning as in section 226H;“urgent third party BPD warrant” is to be read in accordance with subsection (3) of that section.226HB1The Secretary of State, or a senior official acting on behalf of the Secretary of State, may cancel a third party BPD warrant at any time.2If the Secretary of State, or a senior official acting on behalf of the Secretary of State, considers that any of the cancellation conditions are met in relation to a third party BPD warrant, the person must cancel the warrant.3The cancellation conditions are—athat the warrant is no longer necessary on any grounds falling within section 226G(4)(a);bthat the conduct authorised by the warrant is no longer proportionate to what is sought to be achieved by that conduct.226HC1This section applies where a third party BPD warrant ceases to have effect because it expires without having been renewed or because it is cancelled.2The head of the intelligence service to whom the warrant was addressed must, so far as is reasonably practicable, secure that anything in the process of being done in reliance on the warrant stops as soon as possible.3Nothing in this section affects the lawfulness of—aanything done in reliance on the warrant before it ceases to have effect;bif anything is in the process of being done in reliance on the warrant when it ceases to have effect—ianything done before that thing could be stopped, oriianything done that it is not reasonably practicable to stop.226I1This section applies where—aan intelligence service has relevant access, whether on payment or otherwise, to a set of information that is held electronically by a person other than an intelligence service,bthe intelligence service is considering examining the set of information electronically for the purpose of the exercise of its functions,cthe examination would be otherwise than in the exercise of a power conferred by a warrant or other authorisation issued or given under this Act, anddthe head of the intelligence service, or a person acting on their behalf, believes that—ithe set includes, or may include, personal data relating to a number of individuals, andiithe nature of the set is, or may be, such that the majority of the individuals are not, and are unlikely to become, of interest to the intelligence service in the exercise of its functions.2The head of the intelligence service, or a person acting on their behalf, may carry out an initial inspection of the contents of the set for the purpose of deciding whether, if the intelligence service were to examine it after that initial inspection—athe intelligence service would be examining a third party bulk personal dataset (see section 226E), andbsuch examination would be necessary and proportionate in all the circumstances.3Subsection (4) applies if, after the initial inspection is carried out, the head of the intelligence service, or a person acting on their behalf, decides that—athe intelligence service would be examining a third party bulk personal dataset (as mentioned in subsection (2)(a)), andbsuch examination would be necessary and proportionate in all the circumstances.4The head of the intelligence service, or a person acting on their behalf, must—adecide whether to examine the third party bulk personal dataset, andbif they decide to do so, apply for a third party BPD warrant.5If the head of the intelligence service, or a person acting on their behalf, applies for such a third party BPD warrant, the intelligence service is not to be regarded as in breach of section 226F(1) by virtue of examining the bulk personal dataset if the examination is necessary for the purposes of the making of the application for the warrant.6For the purposes of subsection (1)(a), “relevant access” is to be read in accordance with section 226E(2).7For the purposes of this section, only a person holding office under the Crown may act on behalf of the head of an intelligence service.226IA1The Secretary of State must ensure, in relation to every third party BPD warrant which authorises the examination of a bulk personal dataset, that arrangements are in force for securing that any examination of data contained in the dataset is necessary and proportionate in all the circumstances.2In doing so, the Secretary of State must in particular have regard to the information that is reasonably available to the intelligence services in relation to the examination of such data.226IB1Subsections (2) and (3) apply if, in a case where protected data contained in a third party bulk personal dataset is to be examined in reliance on a third party BPD warrant—athe purpose, or one of the purposes, of using the criteria to be used for the examination of the data (“the relevant criteria”) is to identify any items subject to legal privilege, orbthe use of the relevant criteria is likely to identify such items.2If the relevant criteria are referable to an individual known to be in the British Islands at the time of the examination, the data may be examined using the relevant criteria only if the Secretary of State has approved the use of those criteria.3In any other case, the data may be examined using the relevant criteria only if a senior official acting on behalf of the Secretary of State has approved the use of those criteria.4The Secretary of State may give approval for the purposes of subsection (2) only with the approval of a Judicial Commissioner.5Approval may be given under subsection (2) or (3) only if, where subsection (1)(a) applies, the Secretary of State or (as the case may be) the senior official considers that there are exceptional and compelling circumstances that make it necessary to authorise the use of the relevant criteria.6In deciding whether to give an approval under subsection (2) or (3) in a case where subsection (1)(a) applies, the Secretary of State or (as the case may be) the senior official must have regard to the public interest in the confidentiality of items subject to legal privilege.7For the purposes of subsection (5), there cannot be exceptional and compelling circumstances that make it necessary to authorise the use of the relevant criteria unless—athe public interest in obtaining the information that would be obtained by the examination of the data outweighs the public interest in the confidentiality of items subject to legal privilege,bthere are no other means by which the information may reasonably be obtained, andcobtaining the information is necessary in the interests of national security or for the purpose of preventing death or significant injury.8In deciding whether to give approval for the purposes of subsection (4), the Judicial Commissioner must—aapply the same principles as would be applied by a court on an application for judicial review, andbconsider the matter with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).9Subsections (10) and (11) apply if, in a case where protected data contained in a third party bulk personal dataset is to be examined in reliance on a third party BPD warrant—athe purpose, or one of the purposes, of using the criteria to be used for the examination of the data (“the relevant criteria”) is to identify data that, if the data or any underlying material were not created or held with the intention of furthering a criminal purpose, would be an item subject to legal privilege, andbthe person to whom the warrant is addressed considers that the data (“the targeted data”) or any underlying material is likely to be data or underlying material created or held with the intention of furthering a criminal purpose.10If the relevant criteria are referable to an individual known to be in the British Islands at the time of the examination, the data may be examined using the relevant criteria only if the Secretary of State has approved the use of those criteria.11In any other case, the data may be examined using the relevant criteria only if a senior official acting on behalf of the Secretary of State has approved the use of those criteria.12Approval may be given under subsection (10) or (11) only if the Secretary of State or (as the case may be) the senior official considers that the targeted data or the underlying material is likely to be data or underlying material created or held with the intention of furthering a criminal purpose.13In this section “underlying material”, in relation to data contained in a third party bulk personal dataset that is to be examined in reliance on a third party BPD warrant, means any communications or other items of information from which the data was produced.226IC1Subsection (2) applies where—aan intelligence service examines a third party bulk personal dataset in reliance on a third party BPD warrant,bas part of the examination, the intelligence service examines an item subject to legal privilege,cthe intelligence service retains the item, anddthe retention of the item may not be authorised by a warrant under Part 7 (bulk personal dataset warrants).2The person to whom the third party BPD warrant (mentioned in subsection (1)(a)) is addressed must inform the Investigatory Powers Commissioner as soon as reasonably practicable after retaining the item.3Unless the Investigatory Powers Commissioner considers that subsection (5) applies to the item, the Commissioner must—adirect that the item is destroyed, orbimpose one or more conditions as to the use or retention of that item.4If the Investigatory Powers Commissioner considers that subsection (5) applies to the item, the Commissioner may nevertheless impose such conditions under subsection (3)(b) as the Commissioner considers necessary for the purpose of protecting the public interest in the confidentiality of items subject to legal privilege.5This subsection applies to an item subject to legal privilege if—athe public interest in retaining the item outweighs the public interest in the confidentiality of items subject to legal privilege, andbretaining the item is necessary in the interests of national security or for the purpose of preventing death or significant injury.6The Investigatory Powers Commissioner—amay require an affected party to make representations about how the Commissioner should exercise any function under subsection (3), andbmust have regard to any such representations made by an affected party (whether or not as a result of a requirement imposed under paragraph (a)).7Each of the following is an “affected party” for the purposes of subsection (6)—athe Secretary of State;bthe person to whom the third party BPD warrant is or was addressed.226ID1A person commits an offence if—athe person examines, in reliance on a third party BPD warrant, any data contained in a third party bulk personal dataset,bthe person knows or believes that the examination of that data is in breach of the requirement specified in subsection (2), andcthe person deliberately examines that data in breach of that requirement.2The requirement specified in this subsection is that any examination of the data is necessary and proportionate.3A person guilty of an offence under this section is liable—aon summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court, to a fine or to both;bon summary conviction in Scotland, to imprisonment for a term not exceeding 12 months, to a fine not exceeding the statutory maximum or to both;con summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months, to a fine not exceeding the statutory maximum or to both;don conviction on indictment, to imprisonment for a term not exceeding 2 years, to a fine or to both.4No proceedings for any offence which is an offence by virtue of this section may be instituted—ain England and Wales, except by or with the consent of the Director of Public Prosecutions;bin Northern Ireland, except by or with the consent of the Director of Public Prosecutions for Northern Ireland.226IE1In this Part—“personal data” has the same meaning as in Part 7 (see section 199(2));“protected data” has the same meaning as in Part 7 (see section 203);“senior official” means a member of the Senior Civil Service or a member of the Senior Management Structure of His Majesty’s Diplomatic Service;“third party BPD warrant” has the meaning given by section 226F.3See also—section 263 (general definitions),section 265 (index of defined expressions).Pt. 7B inserted (14.10.2024 for specified purposes, 25.4.2025 in so far as not already in force) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 5, 32(2); S.I. 2024/1021, reg. 2(e); S.I. 2025/501, reg. 2