http://www.legislation.gov.uk/ukpga/2016/25/section/235AInvestigatory Powers Act 2016An Act to make provision about the interception of communications, equipment interference and the acquisition and retention of communications data, bulk personal datasets and other information; to make provision about the treatment of material held as a result of such interception, equipment interference or acquisition or retention; to establish the Investigatory Powers Commissioner and other Judicial Commissioners and make provision about them and other oversight arrangements; to make further provision about investigatory powers and national security; to amend sections 3 and 5 of the Intelligence Services Act 1994; and for connected purposes.texttext/xmlenStatute Law Database2026-04-08Expert Participation2026-04-07 Investigatory Powers Act 2016s. 235A(1)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 20(c)reg. 1(2)Investigatory Powers Act 2016s. 235A(3)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 20(c)reg. 1(2)Investigatory Powers Act 2016s. 235A(4)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 20(c)reg. 1(2) Part 8CHAPTER 1235A1This section applies where a telecommunications operator would, but for a relevant restriction, be required by regulation 5A(2) of the 2003 Regulations to notify a personal data breach to the Information Commissioner.2The telecommunications operator must report the personal data breach to the Investigatory Powers Commissioner.3Where a telecommunications operator reports a personal data breach to the Investigatory Powers Commissioner under subsection (2), a Judicial Commissioner must disclose information about the breach to the Information Commissioner.4Where a Judicial Commissioner discloses information about a personal data breach to the Information Commissioner under subsection (3), the Information Commissioner must—aconsider whether the breach is serious, andbif the Information Commissioner considers that the breach is serious, notify the Investigatory Powers Commissioner.5The Investigatory Powers Commissioner must inform an individual of any personal data breach relating to that individual of which the Commissioner is notified under subsection (4)(b) if the Commissioner considers that it is in the public interest for the individual to be informed of the breach.6In making a decision under subsection (5), the Investigatory Powers Commissioner must, in particular, consider—athe seriousness of the breach and its effect on the individual concerned, andbthe extent to which disclosing the breach would be contrary to the public interest or prejudicial to—inational security,iithe prevention or detection of serious crime,iiithe economic well-being of the United Kingdom, orivthe continued discharge of the functions of any of the intelligence services.7Before making a decision under subsection (5), the Investigatory Powers Commissioner must ask—athe Secretary of State, andbany public authority that the Investigatory Powers Commissioner considers appropriate,to make submissions to the Commissioner about the matters concerned.8When informing an individual under subsection (5) of a breach, the Investigatory Powers Commissioner must—ainform the individual of any rights that the individual may have to apply to the Investigatory Powers Tribunal in relation to the breach, andbprovide such details of the breach as the Commissioner considers to be necessary for the exercise of those rights, having regard in particular to the extent to which disclosing the details would be contrary to the public interest or prejudicial to anything falling within subsection (6)(b)(i) to (iv).9The Investigatory Powers Commissioner may not inform the individual to whom it relates of a personal data breach notified to the Commissioner under subsection (4)(b) except as provided by this section.10For the purposes of this section, a personal data breach is serious if the breach is likely to result in a high risk to the rights and freedoms of individuals.11In this section—“2003 Regulations” means the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426);“personal data breach” has the same meaning as in the 2003 Regulations (see regulation 2(1) of those Regulations);“relevant restriction” means any of the following—section 57(1) (duty not to make unauthorised disclosures) (including as applied by section 156);section 132(1) (duty not to make unauthorised disclosures) (including as applied by section 197);section 174(1) (offence of making unauthorised disclosure),(read with regulation 29(1)(a)(i) of the 2003 Regulations).S. 235A inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 11(1), 32(2); S.I. 2024/1021, reg. 2(k)