The UK Investigatory Powers Act 2016 lets the government require communications providers to build and keep capabilities for lawful access, and since 2024 to warn it before changing their security, which puts encryption architecture inside the scope of national law. Technical capability notices, national security notices, retention notices and the newer notification notices are secret by design: recipients may not disclose them without permission. For security and engineering teams at telecoms operators, messaging and cloud services, and any provider that may be treated as a telecommunications operator, the Act shapes key management, logging and change processes. This guide summarises the notice types, who they reach, the 2024 amendments, review and oversight, enforcement, and what lawful access means for encryption, service accounts and AI agents. It takes a defensive and transparency-focused view. Status line: checked against legislation.gov.uk on 27 October 2026. This page is not legal advice.
Key takeaways
- Four notice types matter to engineers. Retention notices (s.87), national security notices (s.252), technical capability notices (s.253) and, since 20 June 2025, notices requiring notification of proposed changes (s.258A).
- Technical capability notices can reach encryption. Section 253(5) lists obligations that may include removing electronic protection applied by or on behalf of the operator, subject to the necessity, proportionality, feasibility and cost tests and Judicial Commissioner approval.
- Secrecy is a legal duty. Recipients must not disclose the existence or contents of a s.252 or s.253 notice without the Secretary of State's permission (s.255(8)), which limits transparency reporting.
- Review no longer means free change. Since the 2024 amendments, an operator that refers a notice for review need not comply with the referred part, but must not make changes that would reduce its capability to assist (s.257).
- Design choices are the defence. Where providers do not hold keys, there is less "electronic protection applied by or on behalf of" them to remove; key custody, minimal retention and clear change governance are the practical controls.
Scope: who and what is covered
| Notice | Given by and approved by | Who receives it | What it can require |
|---|---|---|---|
| Retention notice (s.87) | Secretary of State, approved by a Judicial Commissioner | A telecommunications operator or description of operators | Retain relevant communications data, including internet connection records, for up to 12 months |
| National security notice (s.252) | Secretary of State, approved by a Judicial Commissioner | Telecommunications operators in the UK | Steps necessary in the interests of national security, such as services or facilities that help an intelligence service; cannot have as its main purpose something that needs a warrant |
| Technical capability notice (s.253) | Secretary of State, approved by a Judicial Commissioner (the double lock) | Relevant operators (postal and telecommunications operators, or those proposing to be one), including outside the UK | Obligations set in regulations so the operator can assist with warrants and authorisations, such as providing facilities, handling apparatus, removing electronic protection, maintaining security |
| Notification notice (s.258A) | Secretary of State, after consultation; no Judicial Commissioner approval in the section | Relevant operators that provide or have provided assistance under the Act | Notify the Secretary of State a reasonable time before making specified changes to services or systems |
Warrants (for interception, equipment interference and bulk powers) and communications data authorisations are the underlying legal instruments; the notices make sure providers can assist when those are served. "Telecommunications operator" in the Act is broad and can include providers of communications services and systems, not only network carriers, so messaging, email and some cloud services should assess whether they fall within it.
Key obligations
Technical capability notices in detail
- Test: the notice must be necessary to ensure the operator, or another relevant operator, can assist with a relevant authorisation, and the required conduct must be proportionate (s.253, as amended in 2024 to add "another relevant operator").
- Regulations and consultation: the obligations that can be imposed are set by regulations, which must be reasonable and practicable, after consulting the Technical Advisory Board and affected parties.
- Before giving a notice: the Secretary of State must consult the recipient (s.255(2)) and weigh benefits, number of users, technical feasibility, cost and other effects (s.255(3)), with extra feasibility and cost checks where removal of electronic protection is involved (s.255(4)).
- Duty to comply: recipients must comply (s.255(9)), within a reasonable period.
- Two-year lapse: since 14 October 2024 a notice ceases to have effect after two years unless varied, renewed or revoked (s.255(5A) and (5B)). Retention notices have the same two-year validity rule (s.87(6A)).
Review of a notice (s.257)
- The recipient may refer the notice, in whole or part, back to the Secretary of State within the period set in regulations.
- The Secretary of State consults the Technical Advisory Board (technical requirements and financial consequences) and a Judicial Commissioner (proportionality); both take evidence from the recipient and report.
- The Secretary of State then varies, revokes or confirms the notice; variation or confirmation needs Investigatory Powers Commissioner approval.
- During review the recipient need not comply with the referred part, but must not make relevant changes that would negatively affect its capability to assist under any warrant, authorisation or notice.
Notification of proposed changes (s.258A)
Inserted by the Investigatory Powers (Amendment) Act 2024 and in force from 20 June 2025 (SI 2025/722), s.258A lets the Secretary of State require an operator that has assisted under the Act to give notice of specified changes before making them. The changes covered are set by regulations. The duty is to comply a reasonable time before making the change, and the notice itself is secret. For engineering teams, this turns parts of the product roadmap, such as encryption upgrades or data minimisation, into reportable events.
Other changes in the 2024 Amendment Act
| Part | Topic |
|---|---|
| Part 1 | Bulk personal datasets, including a regime for datasets with low or no reasonable expectation of privacy, and third party datasets |
| Part 2 | Oversight: Deputy Investigatory Powers Commissioners, temporary Judicial Commissioners, personal data breaches |
| Part 3 | Communications data: offence of unlawfully obtaining communications data, subscriber details, internet connection records |
| Part 4 | Notices: retention notices, extra-territorial enforcement, review by the Secretary of State, renewal, notification of proposed changes |
| Part 5 | Miscellaneous, including equipment interference and targeted examination warrants and bulk equipment interference safeguards |
Timeline and current status
| Date | Event |
|---|---|
| 2016 | Investigatory Powers Act 2016 (c. 25) enacted |
| 2024 | Investigatory Powers (Amendment) Act 2024 (c. 9) enacted |
| 14 October 2024 | Amendments to s.87, s.253 and s.255, including two-year notice validity, in force |
| 20 June 2025 | s.258A notification notices and the change to s.255(10) enforcement wording in force (SI 2025/722) |
| 2025 | Apple stops offering Advanced Data Protection (end-to-end encryption for more iCloud categories) to new UK users and says existing UK users must eventually turn it off; Apple's support page cites threats to privacy and says it has never built a backdoor, without naming a notice |
| 27 October 2026 | legislation.gov.uk shows a pending amendment by a 2026 Act (c. 20) not yet applied to these sections; check the revised text before relying on it |
Because notices are secret, the public record of how they are used is limited to what the government, the Investigatory Powers Commissioner, courts or providers are permitted to publish. Treat any public account of a specific notice as incomplete.
Enforcement and penalties
- Civil enforcement: the Secretary of State may bring civil proceedings for an injunction, specific performance or other relief to enforce the duty to comply and the secrecy duty (s.255(10)); for persons outside the UK, this applies only to technical capability notices linked to certain warrants or authorisations (s.255(10)(b), (11)). The same civil route applies to s.258A notices.
- Criminal offences: the Act creates offences, for example the offence of unlawfully obtaining communications data in section 11, which apply to individuals and organisations that misuse powers or data.
- Oversight: the Investigatory Powers Commissioner and Judicial Commissioners approve key decisions and oversee use of the powers; the 2024 Act added personal data breach provisions to the Commissioner's functions.
- Challenge: recipients' main route against a notice is the s.257 review; broader challenges go to the Investigatory Powers Tribunal.
What it means for AI agents and non-human identities
Lawful access capabilities are, in engineering terms, privileged machine paths into systems that hold communications and data. Whatever a provider is required to build, it must be secured as tightly as any other privileged access, because attackers target lawful intercept and retention systems too.
- Key custody decides exposure: section 253(5) refers to removing electronic protection applied by or on behalf of the operator. Architectures where keys sit with users or customers (end-to-end encryption, customer-held keys) change what an operator can be asked to do. See the End-to-End Encryption and Messaging Protocols Guide and the BYOK, HYOK and External Key Management Guide.
- Service accounts in lawful access systems: retention and disclosure systems run on service accounts and API credentials with access to sensitive data across the customer base. They need dedicated identities, hardware-backed keys, two-person control and tamper-evident logs. See the Service Account Security Guide.
- Retention stores are crown jewels: internet connection records and other retained data held for up to 12 months are a high-value target. The Salt Typhoon telecom intrusions showed that a state actor using stolen credentials can sit inside telecoms networks for years.
- AI agents with access to communications data: agents used in support, fraud or abuse handling that can query subscriber or traffic data are new privileged identities; scope them away from lawful access and retention systems unless strictly needed, and log every query.
- Change governance: s.257 and s.258A mean some security changes must be assessed for notice impact; include legal review in the change process for cryptographic and data-retention changes, without weakening the default of shipping security improvements.
Compliance steps
- Assess status: with legal counsel, determine whether your services make you a telecommunications or postal operator under the Act, in the UK or for services to UK users.
- Prepare a notice-handling procedure: a small, cleared group, a secure channel, legal counsel, and a record of permitted disclosures; decide in advance who can receive a notice.
- Map capabilities: document where your systems hold keys, what data you retain and for how long, and which systems could be subject to retention or capability obligations.
- Design for minimal provider access: prefer user-held or customer-held keys and short retention where your service and law permit; record the design rationale.
- Secure any lawful access systems: isolate them, use dedicated non-human identities with hardware-backed keys, multi-party approval and tamper-evident logging, and audit them regularly.
- Embed change review: add a legal check for cryptographic, retention and architecture changes, so review and notification duties are met without freezing ordinary security work.
- Plan for review: if a notice is received, know the s.257 referral route and the evidence the Technical Advisory Board and Judicial Commissioner will want on feasibility, cost and impact on users.
- Transparency within the law: publish transparency reporting to the extent permitted, and be clear with users about your encryption model.
Decision guidance
- Large telecoms operators: notices are part of normal operations; the priority is securing lawful intercept and retention systems and their identities.
- Global messaging and cloud providers: the main decisions are architectural (key custody, which features to offer in the UK) and procedural (how to handle a notice and review).
- Smaller providers: keep a lightweight procedure and minimal retention; seek advice early if contacted.
Detection, measurement and framework mapping
- Access to retention and lawful access systems: number of human and non-human identities, target the minimum, all reviewed quarterly.
- Unlogged access: any query to retained data without a tamper-evident log entry, target zero.
- Keys held by the provider: inventory of which data classes are encrypted with provider-held keys versus user-held keys.
- Retention conformance: share of retained data deleted on schedule within the 12-month cap or a shorter internal limit.
- Change reviews: cryptographic and retention changes that went through legal review before release.
| Topic | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Legal and regulatory requirements understood | GV.OC-03 | - |
| Key custody and encryption design | PR.DS-01 | SC-12 Cryptographic Key Establishment and Management, SC-28 Protection of Information at Rest |
| Access to lawful access and retention systems | PR.AA-05 | AC-3 Access Enforcement, AC-6 Least Privilege |
| Tamper-evident logs | DE.CM-09 | AU-9 Protection of Audit Information |
| Retention limits | PR.DS-01 | AU-11 Audit Record Retention, SI-12 Information Management and Retention |
| Change governance | PR.PS-01 | CM-3 Configuration Change Control |
Common failure patterns
- Assuming you are out of scope: treating the Act as carrier-only when your messaging, email or cloud service may count as a telecommunications service.
- Weak security on lawful access systems: intercept and retention platforms with shared admin accounts and static API keys.
- Over-retention: keeping more data, for longer, than any notice requires, creating a larger target.
- No notice procedure: a notice arrives at a general legal inbox and is discussed widely, breaching secrecy.
- Freezing all security work: misreading review and notification duties as a ban on improvements rather than a duty to assess specified changes.
Practitioner checklist
- Legal assessment of whether your services are within the Act's operator definitions.
- Notice-handling procedure with a cleared group and secure channel.
- Map of key custody, retained data and retention periods.
- Lawful access and retention systems isolated, with dedicated machine identities and hardware-backed keys.
- Multi-party approval and tamper-evident logging for access to retained data.
- Legal review step for cryptographic and retention changes.
- Knowledge of the s.257 review route and evidence needed.
- Transparency reporting within what the law permits.
Standards and references
- legislation.gov.uk: Investigatory Powers Act 2016 section 253 Technical capability notices
- legislation.gov.uk: Investigatory Powers Act 2016 section 255 Further provision about notices
- legislation.gov.uk: Investigatory Powers Act 2016 section 257 Review of notices
- legislation.gov.uk: Investigatory Powers Act 2016 section 258A Notification of proposed changes
- legislation.gov.uk: Investigatory Powers Act 2016 section 252 National security notices
- legislation.gov.uk: Investigatory Powers Act 2016 section 87 Retention notices
- legislation.gov.uk: Investigatory Powers (Amendment) Act 2024
- Apple: Advanced Data Protection availability in the UK
Related NHI Mgmt Group resources: UK Telecommunications Security Act Guide · Encryption Guide · Cryptographic Key Management Guide · UK GDPR and Data Protection Act 2018 Guide. This guide summarises the UK Investigatory Powers Act 2016 as amended, as at 27 October 2026, and is not legal advice.