{
  "url": "https://openlegislation.uk/investigatory-powers-act-2016/section-202",
  "json_url": "https://openlegislation.uk/investigatory-powers-act-2016/section-202.json",
  "legislation": "ukpga/2016/25",
  "legislation_title": "Investigatory Powers Act 2016",
  "legislation_url": "https://openlegislation.uk/investigatory-powers-act-2016",
  "path": "section/202",
  "kind": "section",
  "number": "202",
  "heading": "Restriction on use of class BPD warrants",
  "text": "(1) An intelligence service may not retain, or retain and examine, a bulk personal dataset in reliance on a class BPD warrant if the head of the intelligence service , or a person acting on their behalf, considers that the bulk personal dataset consists of, or includes, protected data.\nFor the meaning of “protected data”, see section 203.\n(2) An intelligence service may not retain, or retain and examine, a bulk personal dataset in reliance on a class BPD warrant if the head of the intelligence service , or a person acting on their behalf, considers—\n(a) that the bulk personal dataset consists of, or includes, health records, or\n(b) that a substantial proportion of the bulk personal dataset consists of sensitive personal data.\n(3) An intelligence service may not retain, or retain and examine, a bulk personal dataset in reliance on a class BPD warrant if the head of the intelligence service , or a person acting on their behalf, considers that the nature of the bulk personal dataset, or the circumstances in which it was created, is or are such that its retention, or retention and examination, by the intelligence service raises novel or contentious issues which ought to be considered by the Secretary of State and a Judicial Commissioner on an application ... for a specific BPD warrant.\n(4) In subsection (2)—\n“health records” has the same meaning as in section 206;\n“sensitive personal data” means personal data whose retention, or (as appropriate) retention and examination, would be sensitive processing;\n“sensitive processing” means—\n(a)processing of personal data relating to a living individual that is processing of a kind described in section 86(7)(a) to (e) of the Data Protection Act 2018, or\n(b)processing of personal data relating to a deceased individual that would be that kind of processing if the personal data related to a living individual.\n(5) For the purposes of subsections (1), (2) and (3), only a person holding office under the Crown may act on behalf of the head of an intelligence service.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Words in s. 202(1) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 4(2)(a), 32(2); S.I. 2024/1021, reg. 2(d)"
    },
    {
      "type": "F",
      "label": "F2",
      "text": "Words in s. 202(2) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 4(2)(a), 32(2); S.I. 2024/1021, reg. 2(d)"
    },
    {
      "type": "F",
      "label": "F3",
      "text": "Words in s. 202(3) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 4(2)(b)(i), 32(2); S.I. 2024/1021, reg. 2(d)"
    },
    {
      "type": "F",
      "label": "F4",
      "text": "Words in s. 202(3) omitted (14.10.2024) by virtue of Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 4(2)(b)(ii), 32(2); S.I. 2024/1021, reg. 2(d)"
    },
    {
      "type": "F",
      "label": "F5",
      "text": "Words in s. 202(4) substituted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 74(11), 142(1); S.I. 2025/904, reg. 2(c)"
    },
    {
      "type": "F",
      "label": "F6",
      "text": "S. 202(5) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 4(2)(c), 32(2); S.I. 2024/1021, reg. 2(d)"
    },
    {
      "type": "I",
      "label": "I1",
      "text": "S. 202 in force at 25.7.2018 by S.I. 2018/873, reg. 2(k)"
    }
  ],
  "outstanding_effects": [
    {
      "type": "words substituted",
      "affecting": "ukpga/2018/12",
      "affecting_title": "Data Protection Act 2018"
    }
  ],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukpga/2016/25/section/202",
    "retrieved_at": "2026-10-29T09:06:02.282680+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}