## Introduction

Section 49 of the Regulation of Investigatory Powers Act 2000 (RIPA) allows the police and certain other authorities to require a person to disclose a password, encryption key, or to provide data in a readable form. Although first introduced with counter-terrorism in mind, Section 49 is regularly used in a wide range of investigations, including drugs, fraud, and child abuse cases.

Being served with a Section 49 notice is serious. You are not physically forced to hand over a password, but refusing to comply can itself be a criminal offence under Section 53. This guide explains when a notice can be issued, what it must contain, the risks of non-compliance, available defences, and practical steps to take.

This is general guidance for England and Wales. Always seek legal advice tailored to your case.

## What You'll Learn

- When a Section 49 notice can be issued and what it must include
- What counts as compliance (providing the key vs providing decrypted data)
- The legal tests: necessity, proportionality, and “no other reasonable means”
- Penalties for non-compliance under Section 53 and when higher maximums apply
- Defences such as not being in possession of the key or flaws in the notice
- Secrecy obligations (tipping-off restrictions) and handling of keys
- Practical steps to take immediately after receiving a notice

## Core Concepts

### What a Section 49 notice is

A Section 49 notice is a written requirement to assist in accessing protected (encrypted or otherwise unreadable) information. It may direct you to:

- Disclose the password or encryption key; or
- Provide the information in an intelligible form (for example, decrypt the data yourself and supply the readable content).

A valid notice should specify:

- The protected data it relates to (for example, a seized phone, laptop, email account, or cloud service)
- What you must do (provide the key or provide decrypted data) and by when
- How to deliver the response and to whom
- Whether secrecy obligations apply (you may be prohibited from telling others about the notice, save for your solicitor)
- That appropriate permission has been obtained to issue the notice

Notices should be targeted and time-limited, and the scope should be no wider than reasonably necessary.

### The legal tests the authority must meet

Before a Section 49 notice is served, the authority must be satisfied (and able to show, if challenged) that:

- Possession: The person given the notice has the key or can obtain it (including where it is written down or stored digitally).
- Necessity: The disclosure is necessary for a permitted purpose, commonly preventing or detecting crime or protecting national security.
- Proportionality: The requirement is proportionate to what is being investigated.
- Last resort: The material cannot be obtained by other reasonable means.

Approval must be obtained from an authorising officer of suitable seniority or a judge, depending on the case. These safeguards come from the statute and the relevant Code of Practice.

### Do you have to comply and what happens if you don’t

You cannot be physically compelled to reveal a password. However, Section 53 makes it a criminal offence to fail to comply with a valid notice. The maximum penalties are:

- Up to 2 years’ imprisonment (most cases)
- Up to 5 years’ imprisonment in cases involving national security or child indecency

Prosecutions for non-compliance are not rare, and courts treat them seriously. Importantly:

- The offence relates to failure to comply with the notice terms. It is separate from any alleged original offence.
- A “reasonable excuse” defence may apply if, for example, you are not in possession of the key or the legal tests for the notice are not met.
- If you genuinely cannot remember a password, you will need credible evidence to support that position.

### Defences and challenges that may be available

Common lines of defence include:

- Not in possession: You do not know the password and cannot obtain it; you never set it, or a third party controls the key.
- Impossibility: The device is damaged, or an automatic key escrow no longer exists; you cannot produce what does not exist.
- Legal tests not met: The notice is too broad, not proportionate, unnecessary, or there were other reasonable means available.
- Procedural defects: Inadequate authorisation, unclear terms, or a failure to specify what is required.

Where appropriate, your solicitor may seek to vary the notice (for example, to limit scope, clarify devices/accounts, or extend deadlines) or challenge it.

### Secrecy obligations and handling of keys

Some notices carry secrecy requirements under Section 54 (often called “tipping-off” restrictions). If imposed, you must not disclose the existence or contents of the notice to others, except to your legal adviser. Breaching secrecy directions can itself be an offence.

Where keys are disclosed:

- Authorities must handle and retain them securely and only for as long as needed.
- Wherever possible, notices should seek decrypted data rather than the key itself. If plaintext disclosure will meet the need, you can ask to comply that way to reduce exposure.
- Legal privilege and other protective rules still apply to certain materials. Flag these issues to your solicitor promptly.

### How to weigh up whether to comply

The decision is often complex:

- In a minor case, the risk of a Section 53 sentence may outweigh any benefit from refusing.
- In a serious case, some suspects choose not to comply, accepting a likely Section 53 prosecution to avoid providing evidence that could support a more serious charge. This is a high-risk approach because:
  - You may still be prosecuted for Section 53, and
  - Investigators might obtain the data anyway (for example, through a cloud backup, third-party provider data, or forensic methods), leaving you facing both sets of problems.

The right choice depends on the case, the strength of the evidence, sentencing exposure, and the likelihood that the data can be obtained without your help. Discuss these factors with your solicitor as early as possible.

## Key Examples or Case Studies

- Case study 1: Withholding a phone PIN in a drug supply investigation
  - Facts: Police seize a smartphone and serve a Section 49 notice requiring the PIN. The suspect refuses.
  - Outcome: The suspect is charged with a Section 53 offence for non-compliance. Separately, investigators obtain messages from a cloud service via a production order. The suspect now faces the original case plus a Section 53 count.
  - Practical point: Refusal can lead to a separate prosecution and may not stop the police from accessing the content by other means.

- Case study 2: “I don’t know the password”
  - Facts: An employee is served with a notice regarding an encrypted company laptop set up by IT. They genuinely never knew the disk encryption key.
  - Outcome: The court accepts the “not in possession” defence, supported by employer statements and IT records. The Section 53 charge does not proceed.
  - Practical point: If you do not have the key, gather evidence quickly (emails, IT policies, witness statements) to support your position.

- Case study 3: Overbroad notice narrowed by negotiation
  - Facts: A notice demands passwords for all devices in a shared household for a low-level offence.
  - Outcome: Through the solicitor, the scope is limited to named devices and accounts, with an extended deadline. The client provides decrypted data rather than handing over passwords.
  - Practical point: Scope, timing, and the method of compliance (plaintext vs key) can often be refined.

## Practical Applications

- Do not ignore the notice
  - Read it carefully. Note the deadline, what is required (key or decrypted data), and any secrecy direction.
  - Missing the deadline without taking action can close off options.

- Speak to a solicitor immediately
  - Get advice on your exposure in the original case and on a Section 53 risk.
  - Your solicitor can request a variation or extension, and communicate with the authority.

- Check the basics
  - Is the notice addressed to you? Does it define the data clearly?
  - Has appropriate authorisation been obtained?
  - Are the legal tests (necessity, proportionality, last resort) explained?

- Consider compliance options
  - If plaintext will satisfy the notice, ask to comply by supplying decrypted data rather than the key.
  - If multiple devices/accounts are listed, confirm the exact scope to avoid overdisclosure.

- If you do not know or cannot obtain the key
  - Record, in writing with your solicitor, why you cannot comply (for example, device set by someone else, password forgotten, key destroyed).
  - Gather supporting evidence (IT logs, emails, statements). The credibility of this defence often turns on early, consistent explanations.

- Do not talk about the notice unless permitted
  - If a secrecy requirement applies, you must not reveal the notice to anyone other than your solicitor.
  - Even without a secrecy direction, be careful: discussing the notice casually can damage your position.

- Do not try to outsmart the process
  - Do not attempt to wipe, reset, or damage devices. That risks further offending (for example, perverting the course of justice).
  - Do not give false passwords to “show you tried”. Credibility matters, and false statements can be used against you.

- Businesses and employees
  - If a notice is served on a company or an employee, identify who actually holds the key.
  - Consider policies on encryption, key escrow, and access controls. Respond via legal and IT leads to avoid accidental breaches of other duties (for example, data protection).

- Keep records
  - File the notice, all emails, and notes of calls. Log any attempts to retrieve keys.
  - If the deadline is tight, ask for an extension in writing before it expires.

## Summary Checklist

- Read the notice and identify what is being requested and by when
- Get urgent legal advice and check for secrecy directions
- Test the legal basis: possession, necessity, proportionality, and other means
- Decide whether to provide the key or supply decrypted data
- If you cannot comply, document why and gather supporting evidence
- Seek to vary scope or extend deadlines where justified
- Do not disclose the notice to others if secrecy applies
- Avoid wiping or altering devices or accounts
- Keep a full paper trail of decisions and communications
- Review the risk of a Section 53 prosecution alongside the original case

## Quick Reference

| Topic                  | Authority      | Key point                                                                   |
| ---------------------- | -------------- | --------------------------------------------------------------------------- |
| Power to require       | RIPA 2000 s49  | Notice can demand a key or require data in intelligible form                |
| Non-compliance offence | RIPA 2000 s53  | Up to 2 years, or up to 5 years for national security/child indecency       |
| Defences               | RIPA 2000 s53  | Not in possession; impossibility; legal tests not met; procedural defects   |
| Secrecy                | RIPA 2000 s54  | Tipping-off restrictions may apply; you can tell your solicitor             |
| Proportionality        | Statute + Code | Must be necessary, proportionate, and a last resort compared to other means |

Section 49 RIPA Notices: Duties, Defences and Risks