United Kingdom: Code of Practice for Intelligence services’ retention and use of bulk personal datasets entered into force

On 6 June 2025, the Code of Practice for Intelligence services' retention and use of bulk personal datasets entered into force. This Code of Practice, issued under Schedule 7 to the Investigatory Powers Act 2016, provides guidance for the security service, secret intelligence service, and government communications headquarters on the collection, storage, retention, examination, and analysis of bulk personal datasets (BPDs). A BPD is defined as an extensive collection of information, predominantly personal data, pertaining to a number of individuals, where the majority are not, and are unlikely to become, of intelligence interest, and cannot be processed manually. All retention and examination of BPDs necessitate authorisation through class or specific BPD warrants, which are issued by the Secretary of State and subject to the Judicial Commissioner's approval for oversight. The Code incorporates special protections for journalists, legal professionals, and members of sensitive professions. Furthermore, it establishes strict rules for record-keeping, auditing, and error reporting, with the Investigatory Powers Commissioner mandated to monitor compliance. The Code also outlines procedures for urgent authorisations, the sharing of data with international partners, and the secure deletion of datasets when they are no longer required.