United Kingdom: Home Office adopted Code of Practice for Intelligence services’ retention and use of bulk personal datasets

On 5 June 2025, the UK Home Office adopted the Intelligence Services' retention and use of bulk personal datasets Code of Practice. This Code of Practice, issued under Schedule 7 to the Investigatory Powers Act 2016, provides guidance for the Security Service, Secret Intelligence Service, and Government Communications Headquarters on the collection, storage, retention, examination, and analysis of bulk personal datasets (BPDs). A BPD is defined as an extensive collection of information, predominantly personal data, pertaining to a number of individuals, where the majority are not, and are unlikely to become, of intelligence interest, and cannot be processed manually. All retention and examination of BPDs necessitate authorisation via class or specific BPD warrants, which are issued by the Secretary of State and subject to the Judicial Commissioner's approval for oversight. The Code incorporates special protections for journalists, legal professionals, and members of sensitive professions. Furthermore, it establishes strict rules for record-keeping, auditing, and error reporting, with the Investigatory Powers Commissioner mandated to monitor compliance. The Code also outlines procedures for urgent authorisations, the sharing of data with international partners, and the secure deletion of datasets when they are no longer required.