Section 49 of the Regulation of Investigatory Powers Act 2000 (RIPA) is the power that turns a request for your password into a legal order. It is used against encrypted phones, computers and files that the police cannot otherwise get into.

What a section 49 notice is

A written notice requiring you to disclose a key, password, PIN or passcode, or to put protected information into an intelligible form, within a set time. For the police to serve one, the following must be true:

  • They have lawfully obtained the protected information, for example on a seized device.
  • They have reasonable grounds to believe the key is in your possession.
  • Disclosure is necessary in the interests of national security, for preventing or detecting crime, or for the economic well-being of the UK.
  • The requirement is proportionate to what it is meant to achieve.
  • It is not reasonably practicable to get the information any other way.

Permission to serve the notice must normally be given by a judge (a Circuit Judge or District Judge in England and Wales). The notice itself must be in writing, describe the information it relates to, state the time limit, say which office or rank gave permission, and explain how the disclosure is to be made.

What happens if you don't comply

Failing to comply is an offence under section 53, punishable by up to two years' imprisonment, or up to five years where the case concerns national security or indecent images of children. It is a separate offence from whatever is being investigated, and people have been imprisoned under it where no other charge was ever brought.

The defence of not having the key

Section 53 has a built-in defence: if you can show there is enough evidence to raise the issue that you did not have the key at the time the notice was served, the prosecution must then prove beyond reasonable doubt that you did. Genuinely forgetting a password is therefore a defence, but a court will test how plausible that is in your circumstances: how recently the device was used, whether you had set the password yourself, and what you said when first asked. Inventing a forgotten password is lying to the police and can be perverting the course of justice.

Secrecy

Section 54 allows a notice to include a secrecy requirement: in some cases you are not permitted to tell anyone (other than your lawyer) that you have received it. Breaching that is also an offence.

What to do if you receive one

  • Do not respond immediately. Tell the officers you want to speak to a solicitor, and do so before saying anything about whether you know the password.
  • Keep the notice and note the time limit.
  • Your solicitor can check whether the notice was properly authorised and proportionate, and advise you on compliance or on challenging it.

Section 49 notices are relatively rare: most investigations rely on forensic extraction or on persuasion. But if you are served with one, treat it as seriously as a charge.

This is general information for England and Wales, not legal advice. If you have been arrested or charged, speak to a solicitor: advice at the police station is free for everyone.