United Kingdom: Code of practice for bulk acquisition of communications data entered into force

On 6 June 2025, the Code of Practice for bulk acquisition of communications data, which outlines procedures for the lawful acquisition, storage, handling, and examination of communications data (CD) under Chapter 2 of Part 6 of the Investigatory Powers Act 2016. The Code applies to intelligence services and telecommunications operators (TOs), detailing requirements for bulk acquisition warrant applications, which are authorised by the Secretary of State and require approval by a Judicial Commissioner. These warrants, initially valid for six months and renewable, need not be constrained to a specific operation and do not impose a volume limit on CD acquisition, provided it is necessary and proportionate. CD, a subset of systems data, includes the who, when, where, and how of a communication but excludes content revealing meaning, also incorporating "secondary data" or "systems data" that informs system operation. The Code covers operational purposes, including national security, serious crime prevention, and economic well-being, and addresses the issuance of Technical Capability Notices (TCNs) to ensure TOs possess the necessary infrastructure for compliance. Furthermore, it specifies safeguards for the examination of data relating to certain professions and to determine the source of journalistic information, mandates central record-keeping for at least three years with a desirable five-year retention for Investigatory Powers Tribunal (IPT) functions and requires error minimisation through technical systems and reporting of relevant errors to the Investigatory Powers Commissioner (IPC).