Encryption Laws Secria

Encryption lawsUnited Kingdom

UK encryption law: what the government can require

We found no UK law that bans using encryption. Instead, three Acts let authorities require help getting past it: from companies under the Investigatory Powers Act and the Online Safety Act, and from individuals under RIPA.1, 3, 4

Checked 29 October 2026 against the sources. This page describes the law. It is not legal advice.

The four powers

Each is aimed at a different party and approved by a different person. Follow a law's name for its full page.

PowerWhat it can require, and of whomWho decidesIn force
Technical capability noticeA telecommunications or postal operator, including one outside the UK, must keep capabilities set by regulations, which include removing electronic protection it applied, "where reasonably practicable".1, 2Investigatory Powers Act 2016, section 253.The Secretary of State, with a Judicial Commissioner's approval112 Mar 20181
Notification noticeAn operator that provides, or has provided, assistance under the Act must tell the Secretary of State about certain proposed changes to its services before making them.5Investigatory Powers Act 2016, section 258A.The Secretary of State520 Jun 20255
Technology noticeA regulated user-to-user or search service must use accredited technology to identify child sexual abuse content, "whether communicated publicly or privately", or try to develop or source it.3Online Safety Act 2023, section 121.Ofcom, after a skilled person's report and a warning notice310 Jan 20243
Section 49 noticeA person believed to hold a key, password or code must make protected data readable, or in some cases hand over the key.4Regulation of Investigatory Powers Act 2000, section 49.Usually a judge, or the issuer of the warrant the data came from61 Oct 20077
 Read at legislation.gov.uk on 29 October 2026. Section 253(3) to (6) came into force earlier, on 13 February 2017.

Who checks how the powers are used

The Investigatory Powers Commissioner

Judicial Commissioners decide whether to approve technical capability notices. The Investigatory Powers Commissioner must also keep under review the use of the RIPA Part III powers, which include section 49.8

The Investigatory Powers Tribunal

The tribunal hears complaints and human rights claims about the use of these powers.9 Apple's challenge over a technical capability notice is before it, as set out on our Investigatory Powers Act page.

How each side describes it

Two views from the record, in their own words.

The Investigatory Powers Commissioner's 2024 report says a capability notice should not be called "crudely (and erroneously) a 'backdoor'", because it "cannot result in the provision of any data to a public authority" without a separate authorisation that IPCO oversees.10

Apple, which withdrew Advanced Data Protection for new UK users, says: "we have never built a backdoor or master key to any of our products or services and we never will."11

Questions people ask

Is encryption illegal in the UK?

We found no UK law that bans it. The laws on this page let authorities require companies or people to help make protected data readable, under conditions and approvals each Act sets out.1, 3, 4

Is end-to-end encryption banned in the UK?

No law bans it. A technical capability notice can require an operator to be able to remove encryption it applied, where reasonably practicable, and an Ofcom notice can require a service to use accredited technology on private messages for child sexual abuse content.2, 3

Can the UK give a notice to a company outside the UK?

Yes, for technical capability notices. Section 253(8) says one may be given to persons outside the United Kingdom and may require things to be done there.1

Can police make me hand over my password?

Under section 49 of RIPA, an authorised person can require someone believed to hold a key to make protected data readable. Knowingly failing to comply is an offence. See our section 49 page for the conditions.4

Sources 11
  1. Investigatory Powers Act 2016, section 253: technical capability notices, legislation.gov.uk, The National Archives. Read 29 October 2026.
  2. The Investigatory Powers (Technical Capability) Regulations 2018, SI 2018/353, Schedule, legislation.gov.uk, The National Archives. Read 29 October 2026.
  3. Online Safety Act 2023, section 121: notices to deal with terrorism content or CSEA content, legislation.gov.uk, The National Archives. Read 29 October 2026.
  4. Regulation of Investigatory Powers Act 2000, section 49: notices requiring disclosure, legislation.gov.uk, The National Archives. Read 29 October 2026.
  5. Investigatory Powers Act 2016, section 258A: notification of proposed changes, legislation.gov.uk, The National Archives. Read 29 October 2026.
  6. Regulation of Investigatory Powers Act 2000, Schedule 2: persons having the appropriate permission, legislation.gov.uk, The National Archives. Read 29 October 2026.
  7. The Regulation of Investigatory Powers Act 2000 (Commencement No. 4) Order 2007, SI 2007/2196, legislation.gov.uk, The National Archives. Read 29 October 2026.
  8. Investigatory Powers Act 2016, section 229: main oversight functions, legislation.gov.uk, The National Archives. Read 29 October 2026.
  9. Regulation of Investigatory Powers Act 2000, section 65: the Tribunal, legislation.gov.uk, The National Archives. Read 29 October 2026.
  10. Investigatory Powers Commissioner's Annual Report 2024, HC 1277, paragraph 4.70 (ordered to be printed 16 December 2025), Investigatory Powers Commissioner's Office. Read 29 October 2026.
  11. Apple can no longer offer Advanced Data Protection in the United Kingdom to new users (published 22 September 2025), Apple Support. Read 29 October 2026.

We read the law itself, and every status has a date. How we check