Investigatory Powers Act 2016: What Journalists Must Know | UK JournoHub

Last reviewed: 13 June 2026Next review due: 13 December 2026

9 min read

Overview of IPA 2016 surveillance powers

The Investigatory Powers Act 2016 consolidated and extended the UK's surveillance framework, replacing the Regulation of Investigatory Powers Act 2000 (RIPA) and related legislation. It authorises five main categories of power relevant to journalists:

Targeted interception: a warrant authorising the interception of communications of a specific person or organisation, issued by the Secretary of State and approved by a Judicial Commissioner.
Targeted equipment interference: a warrant to hack into a specific device or network to obtain data.
Targeted communications data acquisition: obtaining metadata (who called whom, when, from where) about a specific person, without intercepting content.
Bulk interception: collecting large volumes of overseas-related communications without identifying specific targets in advance (intelligence agencies only).
Bulk acquisition: collecting large volumes of communications data across many individuals without individual targeting (intelligence agencies only).

Journalist legal privilege: sections 32 to 34

Before the IPA 2016, the law contained no specific protection for journalistic sources in the context of surveillance warrants. RIPA 2000 required agencies to “have regard” to confidentiality norms, but there was no enforceable procedural safeguard. The IPA 2016 changed this.

Section 32 defines “sensitive journalistic material” as communications or data that would identify a confidential journalistic source, or unpublished journalistic material that was communicated or given in confidence. Sections 33 and 34 require that before a targeted interception warrant or communications data authorisation is used to obtain sensitive journalistic material, a Judicial Commissioner must specifically approve that step — not merely the general warrant, but the specific use that would engage journalistic privilege.

The Judicial Commissioner must balance the purpose of the interception against the Article 10 right to freedom of expression and the public interest in protecting journalistic sources. This is the “double-lock”: ministerial authorisation plus independent judicial approval. In practice, this means that authorities seeking to identify a journalist's source via surveillance face a higher legal threshold than for ordinary interception targets.

Bulk powers and journalistic metadata

The bulk acquisition and bulk interception powers under Parts 6 and 7 of the IPA 2016 present a different challenge. Because bulk warrants do not target individuals in advance, the journalist-privilege safeguard in ss.32–34 does not apply at the point of collection — it applies only when analysts seek to use or examine material that they subsequently identify as sensitive journalistic material.

The Investigatory Powers (Codes of Practice) Order 2018 and the associated codes of practice require intelligence agencies to handle sensitive material with care, to use the minimum amount of material necessary, and to refer it for Judicial Commissioner review before using it in a way that would identify a journalistic source. However, the material is collected first; the safeguard is applied afterwards.

For journalists covering sensitive subjects — national security, organised crime, state misconduct — the implication is clear: metadata about who you call and when can be swept up in bulk collection even without a targeted warrant against you personally. This reinforces the importance of operational security practices independent of legal protections. See our state actor threats guide for detailed technical steps.

Judicial Commissioners and the IPCO

The Investigatory Powers Commissioner's Office (IPCO) was established by the IPA 2016 to provide independent oversight of the UK's surveillance powers. The Investigatory Powers Commissioner is a senior judge; the Judicial Commissioners who approve warrants are also senior judges (High Court level or above). IPCO publishes an annual report setting out aggregate statistics on warrants granted, including those involving journalists.

IPCO can inspect the records of agencies using surveillance powers and can require remediation where it finds errors or unlawful conduct. It can refer matters to the Investigatory Powers Tribunal (IPT) — the specialist court that handles surveillance complaints. Journalists who believe their communications have been unlawfully intercepted can make a complaint to the IPT, although the IPT's procedures limit what complainants can be told about whether interception has occurred.

The IPCO's 2023 annual report noted a small but non-zero number of cases in which the journalist-privilege provisions in ss.32–34 were engaged. The aggregate numbers are not published by agency or subject matter for operational security reasons.

Big Brother Watch: the ECtHR challenge

The litigation known as “Big Brother Watch” — including the National Union of Journalists as a joint applicant — challenged the UK's bulk surveillance regime before the European Court of Human Rights. The Grand Chamber issued its judgment in September 2021.

The Grand Chamber found that the pre-IPA 2016 bulk interception regime violated ECHR Articles 8 and 10 because it lacked adequate end-to-end safeguards, in particular no independent authorisation before interception and no sufficient protection for journalistic sources. The UK had amended the regime by the time of the judgment (through the IPA 2016 and secondary legislation), and the court took these amendments into account. It found that the reformed bulk interception regime was closer to compliance, though it raised concerns about automated analytics applied to bulk data and the lack of notification to individuals that their communications had been examined.

Civil liberties groups including Liberty and the NUJ continue to argue that bulk powers remain incompatible with Article 10 in practice, particularly given the metadata exposure identified above. Further litigation before the IPT and domestic courts is ongoing as of 2026.

Source protection: practical implications

The IPA 2016 framework means that legal protections for journalistic sources have improved since RIPA 2000, but the practical protection they offer is limited. Metadata — who you called, when, and from where — remains collectable under bulk powers without the journalist-privilege safeguard applying at the point of collection. Content protections apply only where a targeted warrant is being used and the agency is aware the target is a journalist.

Legal safeguards (what the law provides)

Judicial Commissioner approval required before using targeted interception to identify a source; IPCO oversight; IPT right of complaint; codes of practice requiring minimisation of sensitive journalistic material.

Operational gaps (what the law cannot fully prevent)

Bulk metadata collection before the privilege review applies; equipment interference on a device without prior knowledge of journalistic content; third-party interception of sources who are not themselves known journalists.

The NUJ and Committee to Protect Journalists recommend that journalists working on national security or law enforcement stories follow a source protection protocol that includes device compartmentalisation, encrypted communications, air-gapped meetings, and document security. See our detailed source protection guide and source protection techniques.

Notification and disclosure obligations

Under s.229 of the IPA 2016, there is a general prohibition on disclosing the existence of a warrant or the fact that surveillance has been conducted. Journalists who are themselves subject to a warrant will not generally be told about it during the warrant's operation.

Post-use notification is limited: the IPA 2016 does not create a general regime of notifying individuals after surveillance has concluded, unlike the practice in some EU jurisdictions. The IPCO can in principle trigger notification in cases of serious error, but this is rare. The practical consequence is that a journalist who has been subject to surveillance will often have no way of knowing unless the material is later produced in criminal proceedings against a source, or is disclosed by a whistleblower within the agencies.

Interaction with PACE and journalistic material orders

The Police and Criminal Evidence Act 1984 (PACE) contains separate protections for “journalistic material” (s.11–14 PACE) that are distinct from the IPA 2016 framework. PACE requires police to apply to a circuit judge for a production order before compelling journalists to hand over special procedure or excluded material. The IPA 2016 surveillance powers operate in parallel and cannot be used as a straightforward substitute for the PACE regime. However, this boundary is not always cleanly observed in practice. If you receive any request or demand relating to source material — whether under PACE, IPA 2016, or otherwise — take immediate legal advice. See also our source protection overview and the state actor threats digital security guide.

Related guides

Source Protection

Legal framework for protecting confidential sources under UK and ECHR law.

Source Protection Techniques

Practical operational security steps for journalists working with sensitive sources.

State Actor Digital Threats

Protecting against state-level surveillance and device interference.

Legal Read Process

Pre-publication legal review checklist for UK newsrooms.

Primary sources

Frequently asked questions

What is journalist legal privilege under the IPA 2016?

Sections 32 to 34 of the Investigatory Powers Act 2016 establish a specific category of 'sensitive journalistic material' that includes communications or data that would identify a journalistic source. Before a targeted interception or communications data warrant can be used to obtain such material, a Judicial Commissioner must specifically approve that step. The double-lock mechanism — Secretary of State approval followed by Judicial Commissioner review — applies, and the reviewing Commissioner must give weight to the public interest in protecting journalists' sources. However, the protection is not absolute: it can be overridden where there is a serious national security or law enforcement justification.

Does the IPA 2016's 'journalist privilege' protect all communications journalists send?

No. The protection is narrow and specific: it applies to communications or data that would identify a confidential source or reveal the content of confidential journalistic material. General communications between journalists and colleagues, editors, or readers are not within the privileged category. Only material that would, if disclosed, identify a source or reveal unpublished journalistic material attracts the additional Judicial Commissioner scrutiny. A journalist should not assume that because they are a journalist all their communications are protected.

What is bulk acquisition and does it affect journalists?

Bulk acquisition warrants under Chapter 2 of Part 6 of the IPA 2016 permit intelligence agencies to collect large quantities of communications data without specifying individual targets. Journalists' metadata — who called whom, when, from where — can be swept up in bulk collection even without a targeted warrant. The Investigatory Powers (Codes of Practice) Order 2018 requires agencies to handle sensitive journalistic material obtained via bulk collection with particular care and to refer it for Judicial Commissioner review if it is to be used in a way that would identify a source. In practice, journalists cannot be certain that their metadata is not in a bulk dataset.

What was the Big Brother Watch case and what did it decide?

National Union of Journalists and others v United Kingdom (Big Brother Watch) was a series of cases before the European Court of Human Rights (Grand Chamber, 2021). The ECtHR found that the UK's bulk interception regime as it existed before the IPA 2016 was incompatible with ECHR Articles 8 and 10 because of insufficient safeguards for journalistic sources. Following IPA 2016 and subsequent amendments, the UK amended its framework to include end-to-end safeguards and Judicial Commissioner oversight. The 2021 Grand Chamber judgment found the reformed regime closer to compliance, though civil society groups continue to argue the bulk powers remain disproportionate.

Should journalists use encrypted communications even with legal privilege?

Yes, emphatically. Legal privilege under the IPA 2016 is a procedural safeguard, not a technical one. It requires authorities to seek additional approval before using intercepted material to identify a source — it does not prevent interception in the first place. Encryption, secure devices, and source protection practices are therefore the first line of defence. The National Union of Journalists and digital security specialists recommend that journalists working with sensitive sources use end-to-end encrypted messaging apps (such as Signal), avoid metadata-leaking communication methods, and compartmentalise devices. See our guide on source protection techniques.