SI 2025/656 - The Investigatory Powers (Codes of Practice, Review of Notices and Technical Advisory Board) Regulations 2025

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

STATUTORY INSTRUMENTS 2025 No. 656 INVESTIGATORY POWERS The Investigatory Powers (Codes of Practice, Review of Notices and Technical Advisory Board) Regulations 2025 Made - - - - 5th June 2025 Coming into force - - 6th June 2025 The Secretary of State makes these Regulations in exercise of the powers conferred by sections 90(5A), (11A) and (14) to (16), 245, 257(4A), (10A) and (13) to (15), 258A(2) and (4), 267(1)(b) of, and paragraphs 4(3) and 5(4) of Schedule 7 to, the Investigatory Powers Act 2016(1) (“the Act”).

In accordance with paragraph 4(1) of Schedule 7 to the Act, the Secretary of State has prepared and published drafts of the new codes of practice brought into force by these Regulations and considered representations made about them.

In accordance with paragraph 4(2) of Schedule 7 to the Act, the Secretary of State has consulted the Investigatory Powers Commissioner on the new codes and, with respect to the exercise of functions conferred by Part 4 of the Act, the Information Commissioner.

In accordance with paragraph 4(4) of Schedule 7 to the Act, a draft of these Regulations was laid before both Houses of Parliament and approved by a resolution of each House of Parliament.

In accordance with paragraph 4(5) of Schedule 7 to the Act, drafts of the new codes of practice brought into force by these Regulations were laid before both Houses of Parliament.

In accordance with paragraph 5(2) of Schedule 7 to the Act, the Secretary of State has prepared and published drafts of the revised codes of practice brought into force by these Regulations and considered representations made about them.

In accordance with paragraph 5(3) of Schedule 7 to the Act, the Secretary of State has consulted the Investigatory Powers Commissioner on the revised codes and, with respect to the exercise of functions conferred by Part 4 of the Act, the Information Commissioner.

In accordance with paragraph 5(5) of Schedule 7 to the Act, a draft of these Regulations was laid before Parliament and approved by a resolution of each House of Parliament.

In accordance with paragraph 5(6) of Schedule 7 to the Act, drafts of the revised codes of practice brought into force by these Regulations were laid before both Houses of Parliament.

In accordance with section 267(3)(e), (h), (j) and (ja) of the Act, a draft of these Regulations was laid before Parliament and approved by a resolution of each House of Parliament.

(1) 2016 c. 25. Section 90 was amended by section 18(1) and (2) of the Investigatory Powers (Amendment) Act 2024 (c. 9) (“the 2024 Act”). Section 257 was amended by section 18(1) and (5) of the 2024 Act. Section 258A was inserted by section 21(1) and (2) of the 2024 Act. Section 267 was amended by sections 18(1) and (6) and 21(3) of the 2024 Act.Document Generated: 2025-06-06

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

Citation, commencement, extent and interpretation

1.—(1) These Regulations may be cited as the Investigatory Powers (Codes of Practice, Review of Notices and Technical Advisory Board) Regulations 2025.

(2) These Regulations come into force on the day after the day on which they are made.

(3) These Regulations extend to England and Wales, Scotland and Northern Ireland.

(4) In these Regulations, “the Act” means the Investigatory Powers Act 2016.

Codes of practice

2. The following codes of practice laid before Parliament on 31st March 2025 come into force on the day on which these Regulations come into force—

(a) the new codes entitled—

(i)“Bulk Personal Datasets: Low or no reasonable expectation of privacy”;

(ii)“Notices Regime”;

(iii)“Third Party Bulk Personal Datasets”.

(b) the revised codes entitled—

(i)“Bulk Acquisition of Communications Data”;

(ii)“Bulk Personal Datasets”;

(iii)“Communications Data”;

(iv)“Equipment Interference”;

(v)“Interception of Communications”.

Relevant change

3.—(1) Subject to paragraph (4), a “relevant change” for the purposes of section 258A(2)(b) of the Act means a change (to a service or system within section 258A(3) of the Act) that, if implemented, would have a material effect on the capability of the relevant operator to provide any assistance which the relevant operator may be required to provide in relation to any warrant, authorisation or notice issued or given under the Act.

(2) A relevant change (where it has such an effect) includes—

(a) a change to a data retention period by the relevant operator;

(b) a change in the relevant operator’s ability to lawfully provide communications data;

(c) a change in the relevant operator’s ability to lawfully provide the content of communications;

(d) the decommissioning of a service or system.

(3) The matters which are relevant as to whether a change would have the effect referred to in paragraph (1) include—

(a) the current or expected number of warrants, authorisations or requests issued to the relevant operator;

(b) the operational importance of the data provided under sub-paragraph (a);

(c) the types of service the relevant operator provides;

(d) the customer base of the relevant operator;

(e) the market share of the relevant operator.

2Document Generated: 2025-06-06

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

(4) A change is not a relevant change if it—

(a) is made by a relevant operator who does not provide, and does not intend to provide, a telecommunications or postal service to more than 10,000 persons, or

(b) fixes a defect in installed software and leaves the intended functionality of the software unchanged.

Amendment of the Investigatory Powers (Review of Notices and Technical Advisory Board) Regulations 2018

4. The Investigatory Powers (Review of Notices and Technical Advisory Board) Regulations 2018(2) are amended in accordance with regulations 5 to 7.

New regulations 2A (review period) and 2B (relevant period)

5. After regulation 2, insert— “Review period 2A.—(1) For the purposes of sections 90(5) and 257(4) of the Act, the “review period” is a period of 180 days beginning with the day on which the notice is referred to the Secretary of State for review.

(2) The review period in paragraph (1) may be extended for any period of time with the agreement of the Secretary of State, a Judicial Commissioner and the person to whom the notice was given.

(3) Subsequent extensions to the review period may be agreed in accordance with paragraph (2).

Relevant period 2B.—(1) For the purposes of sections 90(10) and 257(9) of the Act, the “relevant period” is a period of 30 days beginning with the day on which the Judicial Commissioner and the Technical Advisory Board report their conclusions to the Secretary of State under sections 90(9)(b) or 257(8)(b) of the Act.

(2) If the Judicial Commissioner and the Technical Advisory Board report their conclusions to the Secretary of State on different days, the relevant period begins with whichever day is the later one.

(3) The relevant period may be extended by the Secretary of State in exceptional circumstances, provided that the period as extended does not end after the review period under regulation 2A (including any extension to the review period).

(4) The Secretary of State must notify in writing the Judicial Commissioner and the person to whom the notice was given of the duration of the extension.”.

Amendment to regulation 3 (membership of the Technical Advisory Board)

6. In regulation 3—

(a) in paragraph (1), omit “but no more than 15 members”;

(b) in paragraphs (2) and (4), for “Six members (and no more than six members)” substitute “At least six members”.

(2) S.I. 2018/354.

3Document Generated: 2025-06-06

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

(c) after paragraph (7), insert— “(8) So far as is reasonably practicable, the Technical Advisory Board must consist of an equal number of members to whom paragraph (2) applies and members to whom paragraph (4) applies.”.

Substitution of regulation 4 (quorum)

7. For regulation 4, substitute— “Quorum

4.—(1) The quorum for any Technical Advisory Board is to be seven members of whom—

(a) three are members to whom regulation 3(2) applies,

(b) three are members to whom regulation 3(4) applies, and

(c) one is a member to whom regulation 3(6) applies.

(2) Where there are more than seven members, the Technical Advisory Board must comprise—

(a) an equal number of—

(i)members to whom regulation 3(2) applies, and

(ii)members to whom regulation 3(4) applies, and

(b) at least one member, but no more than three members, to whom regulation 3(6) applies.

(3) This regulation applies to any meeting of the Technical Advisory Board constituted for the purposes of carrying out functions under sections 90 or 257 of the Act.”.

Dan Jarvis Minister of State 5th June 2025 Home Office 4Document Generated: 2025-06-06

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

EXPLANATORY NOTE (This note is not part of the Regulations) These Regulations arise out of some of the changes the Investigatory Powers (Amendment) Act 2024 (c. 9) made to the Investigatory Powers Act 2016 (c. 25) (“the Act”).

These Regulations bring into force three new codes and five revised codes of practice issued under paragraph 1(1), paragraph 4 and paragraph 5 of Schedule 7 to the Act. The codes of practice come into force on the day on which these Regulations come into force.

The new codes of practice are as follows— • “Bulk Personal Datasets: Low or no reasonable expectation of privacy” is about the exercise of functions conferred by Part 7A of the Act; • “Notices Regime” consolidates pre-existing guidance into a single code and provides guidance on the new elements introduced by the Investigatory Powers (Amendment) Act 2024;

• “Third Party Bulk Datasets” is about the exercise of functions conferred by Part 7B of the Act.

The revised codes of practice are as follows— • “Bulk Acquisition of Communications Data” is about the exercise of functions conferred by

Chapter 2 of Part 6 of the Act; • “Bulk Personal Datasets” is about the exercise of functions conferred by Part 7 of the Act; • “Communications Data” is about the exercise of functions conferred by Part 3 of the Act;

• “Equipment Interference” is about the exercise of functions conferred by Part 5 and Chapter 3 of Part 6 of the Act; • “Interception of Communications” is about the exercise of functions conferred by Part 2 and

Chapter 1 of Part 6 of the Act.

The codes of practice will be available on the Investigatory Powers Act 2016 codes of practice pages on the gov.uk website.

These Regulations also make changes to the notices regime under the Act. First, the Regulations specify what constitutes a “relevant change” for the purposes of section 258A of the Act. Second, the Regulations amend the Investigatory Powers (Review of Notices and Technical Advisory Board) Regulations 2018 (S.I. 2018/354) (“the 2018 Regulations”) to specify the period of time within which the Secretary of State must complete the review of a notice under sections 90 and 257 of the Act. Third, the Regulations amend the 2018 Regulations with regard to the composition and quorum of the Technical Advisory Board.

Regulation 3 provides further detail on what is considered a relevant change to an operator’s services or systems which will need to be notified to the Secretary of State under section 258A of the Act. A relevant change is one which would have a material effect on existing lawful access capabilities.

Regulation 5 inserts two new provisions into the 2018 Regulations. New regulation 2A specifies the overall period within which the Secretary of State must complete the review of a notice (“the review period”). New regulation 2B sets out the period within which the Secretary of State must complete the review of a notice once the Judicial Commissioner and the Technical Advisory Board have provided their reports (“the relevant period”).

5Document Generated: 2025-06-06

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

Regulation 6 amends regulation 3 of the 2018 Regulations with regard to the composition of the Technical Advisory Board. The maximum cap on membership is removed, whilst seeking to maintain balance across the different membership groups.

Regulation 7 substitutes a new regulation for regulation 4 of the 2018 Regulations. The quorum for any meeting of the Technical Advisory Board for the purposes of carrying out its functions under sections 90 and 257 of the IPA is to be seven members and must be balanced across the different membership groups.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sectors is foreseen.

6