RIPA section 49: when you must hand over a key or password

Section 49 of the Regulation of Investigatory Powers Act 2000 lets an authorised person require someone believed to hold a key to make protected data readable. Knowingly failing to comply is an offence under section 53.^{1, 2}

Checked 29 October 2026 against the sources. This page describes the law. It is not legal advice.

What a section 49 notice is

A written demand to disclose protected information in an intelligible form, or in some cases the key itself. Part III of the Act, which holds these powers, came into force on 1 October 2007.^{1, 3}

Regulation of Investigatory Powers Act 2000, as amended, read at legislation.gov.uk on 29 October 2026.
When it can be given	The person giving it must believe, on reasonable grounds, that the recipient has the key, that disclosure is necessary and proportionate, and that the data cannot reasonably be made readable another way.¹Section 49(2).
The grounds	National security, preventing or detecting crime, the economic well-being of the UK, or the effective exercise of a public authority's statutory powers or duties.¹Section 49(2)(b) and (3).
What counts as a key	"Any key, code, password, algorithm or other data" that allows access to the data or helps put it into an intelligible form.⁴Section 56(1).
What the notice must say	It must be in writing or recorded, describe the information, state the grounds and who gave permission, and set a time to comply that is "reasonable in all the circumstances".¹Section 49(4).
Readable data or the key	Usually the recipient can comply by handing over the data in an intelligible form, or the key instead. The key itself can be demanded only under a direction given at a senior level (for the police, by or with the permission of a chief officer), who must notify the Investigatory Powers Commissioner within seven days.^{5, 6}Sections 50 and 51.
What is excluded	A key meant only for creating electronic signatures, and never used for anything else.¹Section 49(9).

Who has to approve it

A notice can only be given by someone with "the appropriate permission" under Schedule 2.⁷

The default is written permission from a judge: a Circuit judge in England and Wales, a sheriff in Scotland, or a county court judge in Northern Ireland. Where the data was obtained under a warrant, the warrant or its issuer can grant the permission instead.⁷

A police constable needs to be of the rank of superintendent or above, or to have permission from someone who is. Members of the armed forces need the rank of lieutenant colonel or its equivalent.⁷

The Home Office's code of practice adds a step: no public authority may serve a section 49 notice without the prior written advice of the National Technical Assistance Centre (NTAC), or another body the Secretary of State has agreed. A recipient, or their lawyer, can contact NTAC to confirm a notice is authentic.⁸

The offences and their penalties

Two offences back the notice: not complying (section 53) and telling others about a notice that must be kept secret (section 54).^{2, 9}

Sections 53(5) to (7) and 54(4). A child indecency case is one where the notice's grounds include an offence about indecent photographs of children.
Offence	On indictment, maximum	Summary, maximum
Failing to comply, national security or child indecency case	Five years, a fine, or both²	Six months, a fine up to the statutory maximum, or both²
Failing to comply, any other case	Two years, a fine, or both²	Six months, a fine up to the statutory maximum, or both²
Tipping off	Five years, a fine, or both⁹	Six months, a fine up to the statutory maximum, or both⁹

If you had the key before

If the prosecution shows a person had the key at any time before the notice, the court treats them as still having it, unless they show otherwise. They do that by raising enough evidence that they no longer had it, which the prosecution must then disprove beyond reasonable doubt.² This is section 53(2) and (3).

The late disclosure defence

It is a defence to show that disclosure was not reasonably practicable by the deadline, and that it was made as soon as reasonably practicable afterwards.² This is section 53(4).

Secrecy

A notice can require secrecy only with the consent of whoever granted permission, and only where the data reached the police, the National Crime Agency, HMRC or the intelligence services in a way that is reasonable to keep secret. Software that automatically warns that a key is no longer secure can be a defence to tipping off.⁹

Questions people ask

Can UK police make me unlock my phone?

They can give a section 49 notice for data that is protected by a key, such as a phone passcode, if the conditions in section 49(2) are met and the right permission is in place. Not complying, knowingly, is the offence in section 53.^{1, 2, 4}

Does a section 49 notice cover fingerprints or face unlock?

The Act defines a key as "any key, code, password, algorithm or other data". The Home Office code of practice says key material can include biometric data derived from fingerprint readers or iris scanners.^{4, 8}

What if I have forgotten the password?

The offence is knowingly failing to disclose. If the prosecution shows you had the key before the notice, you are treated as still having it unless enough evidence is raised that you did not, and the prosecution fails to disprove that beyond reasonable doubt.²

Is section 49 part of the Investigatory Powers Act?

No. It is in Part III of the Regulation of Investigatory Powers Act 2000, which is still in force. The Investigatory Powers Act 2016 covers notices to companies, such as technical capability notices.^{1, 3}

Sources 9

Regulation of Investigatory Powers Act 2000, section 49: notices requiring disclosure, legislation.gov.uk, The National Archives. Read 29 October 2026.
Regulation of Investigatory Powers Act 2000, section 53: failure to comply with a notice, legislation.gov.uk, The National Archives. Read 29 October 2026.
The Regulation of Investigatory Powers Act 2000 (Commencement No. 4) Order 2007, SI 2007/2196, legislation.gov.uk, The National Archives. Read 29 October 2026.
Regulation of Investigatory Powers Act 2000, section 56: interpretation of Part III, legislation.gov.uk, The National Archives. Read 29 October 2026.
Regulation of Investigatory Powers Act 2000, section 50: effect of notice imposing disclosure requirement, legislation.gov.uk, The National Archives. Read 29 October 2026.
Regulation of Investigatory Powers Act 2000, section 51: cases in which key required, legislation.gov.uk, The National Archives. Read 29 October 2026.
Regulation of Investigatory Powers Act 2000, Schedule 2: persons having the appropriate permission, legislation.gov.uk, The National Archives. Read 29 October 2026.
Investigation of Protected Electronic Information: Revised Code of Practice, August 2018, paragraphs 3.10, 3.19 and 4.22, Home Office, GOV.UK. Read 29 October 2026.
Regulation of Investigatory Powers Act 2000, section 54: tipping-off, legislation.gov.uk, The National Archives. Read 29 October 2026.

We read the law itself, and every status has a date. How we check