United Kingdom: Home Office implemented Investigatory Powers (Codes of Practice, Review of Notices and Technical Advisory Board) Regulations 2025 (No. 656)

On 6 June 2025, the Investigatory Powers (Codes of Practice, Review of Notices and Technical Advisory Board) Regulations 2025 came into force, bringing into effect the following codes of practice: “Bulk Personal Datasets: Low or no reasonable expectation of privacy”, “Notices Regime”, and “Third Party Bulk Personal Datasets”; and the following revised codes of practice: “Bulk Acquisition of Communications Data”, “Bulk Personal Datasets”, “Communications Data”, “Equipment Interference”, and “Interception of Communications," under Schedule 7 to the Investigatory Powers Act 2016. The Regulations define a "relevant change" under section 258A of the Act, specifying alterations to operator services or systems that materially affect lawful access capabilities, and amend the 2018 Regulations to establish a 180-day "review period" for notice reviews by the Secretary of State, extendable with agreement, and a 30-day "relevant period" for post-report decisions, extendable in exceptional circumstances. Additionally, the Technical Advisory Board's composition and quorum requirements were updated, removing membership caps while ensuring balanced representation across membership groups, with a quorum of seven members required for meetings under sections 90 and 257 of the Act.