What powers allow police to seize a digital device?

s.19 PACE 1984 (general power of seizure while lawfully on premises, where there are reasonable grounds to believe the item is evidence of or obtained through crime — s.19(4) covers information in electronic form accessible from the premises), s.20 PACE 1984 (extending that electronic-production requirement to the other seizure powers such as a s.8 warrant, an s.18 search on arrest, and Schedule 1), a search warrant such as one issued under s.8 PACE, or informed, voluntary, documented consent.

What happens if a suspect refuses to disclose an encryption key or password?

RIPA 2000 s.49 allows a notice to be served requiring disclosure of an encryption key or the protected material in an intelligible form. RIPA 2000 s.53 makes failure to comply with that notice a criminal offence, carrying a maximum sentence of 5 years in cases involving national security or child indecency, and 2 years in all other cases.

Digital Evidence

Device seizure lawful basis, the NPCC good-practice principles, cloud and social media evidence, mobile phone downloads, forensic imaging, triage versus full examination, and digital disclosure duties — an officer quick-reference.

Unofficial independent resource — always verify with official sources (College of Policing, your force, PFEW).

Reviewed by the BlueLineHub Editorial Team

Last reviewed: 26 August 2026 · Next review due: 26 February 2027

Reviewed by BlueLineHub Editorial

What is the lawful basis for seizing a digital device and what principles govern handling digital evidence?

A digital device can be seized under s.19 PACE 1984 (general power of seizure while lawfully on premises, where there are reasonable grounds to believe it is evidence of or obtained through crime) — s.19(4) itself lets a constable require electronic information accessible from the premises to be produced in a visible, legible, removable form. Section 20 extends that same electronic-production requirement to the other seizure powers (a s.8 warrant, an s.18 post-arrest search, and Schedule 1). A device may also be seized under a warrant (e.g. s.8 PACE) or with informed, voluntary, documented consent.

Handling is governed by the ACPO (now NPCC) Good Practice Guide for Digital Evidence's four principles: no action should change the data, only a competent person should access original data in exceptional circumstances, an audit trail of all processes must be created and preserved, and the investigation lead has overall responsibility for compliance with the law and these principles.

All operational references

A reference to the lawful basis for seizing digital devices, the NPCC/ACPO good-practice principles for handling digital evidence, how cloud-stored and social media evidence is obtained, what a mobile phone download can recover, forensic imaging and hash verification, the difference between triage and full examination, and the disclosure obligations digital material creates. It is educational reference, not tactical or legal guidance — always seek advice from your Digital Forensics Unit and follow current force policy and law.

NPCC Good Practice Guide Principles

The ACPO (now NPCC) Good Practice Guide for Digital Evidence sets out four core principles that govern all digital evidence handling. These are non-statutory operational guidance, not legislation — but departure from them without documented justification will be challenged in court and may result in evidence being ruled inadmissible.

The four principles

Principle 1 — No action should change data

No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court.

Principle 2 — Competent person

In exceptional circumstances where it is necessary to access original data, the person doing so must be competent to do so and be able to give evidence explaining the relevance and implications of their actions.

Principle 3 — Audit trail

An audit trail or other record of all processes applied to digital evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.

Principle 4 — Overall responsibility

The person in charge of the investigation has overall responsibility for ensuring the law and these principles are adhered to.

Device Seizure: Lawful Basis

s.19 PACE 1984 allows seizure of items on premises during a lawful search where there are reasonable grounds to believe they are evidence of, or obtained through, crime.

s.19(4) PACE 1984 itself lets a constable require information stored in electronic form and accessible from the premises to be produced in a visible, legible, removable form. s.20 extends that same requirement to the OTHER seizure powers — a s.8 warrant, an s.18 search on arrest, and Schedule 1 special-procedure orders; it does not apply to s.19, which already has its own electronic-information power.

A search warrant under s.8 PACE 1984 (a Justice of the Peace warrant for an indictable offence) or other relevant legislation specifies what can be searched for and seized.

Consent must be informed, voluntary, and documented. The owner must understand what access is being sought and why.

Checklist: Before Seizing a Device

Confirm the lawful basis for seizure
Photograph the device (front and back, serial number if visible)
Note its state (on/off, open/closed, any visible screen content)
Use a Faraday bag for mobile phones to prevent remote wipe
Label as an exhibit immediately with your unique exhibit reference
Record time, date, location, and circumstances of seizure in your notes

Cloud-Stored Data

A significant proportion of digital evidence is now stored remotely in cloud services (iCloud, Google Drive, OneDrive, Dropbox, WhatsApp backups) rather than on the device itself. Seizing the device alone may not secure the evidence.

Production orders — Schedule 1 PACE 1984 applications (made via s.9 PACE) to a circuit judge requiring a specified organisation to produce material it holds. Used for UK-based providers or those with a UK legal presence.

International Mutual Legal Assistance (MLA) — where data is held by a foreign company or on servers abroad, requests must go through the Home Office MLA process. This is slow (months to years) but essential for formal proceedings, and requires a formal Letter of Request to the foreign jurisdiction.

UK-US Data Access Agreement — this agreement entered into force on 3 October 2022, giving effect to the Crime (Overseas Production Orders) Act 2019 and enabled by the US CLOUD Act 2018. It allows UK authorities to make direct requests to US communications service providers for certain data. It is limited to serious crime, requires domestic authorisation before use, and creates no new investigative powers of its own. Seek specialist advice — the route through your force's legal team or the NCA.

Social Media Evidence

Preservation requests — before seeking disclosure, request preservation of the relevant data from the platform. Many platforms (Meta, X/Twitter, TikTok) respond to law enforcement preservation requests by locking the data so it cannot be deleted while legal process is initiated. This is time-critical — act quickly, as some platforms have short preservation windows.

Screenshots vs downloads — screenshots are admissible but carry risk: they can be cropped, altered, and lack metadata. Where possible, download the raw data or obtain it through a formal platform disclosure process, which provides timestamped records. Screenshots should always include the URL and timestamp visible in the browser.

Metadata — digital images and documents contain embedded metadata (EXIF data) including creation date, device used, and GPS coordinates. This can corroborate or contradict a suspect's account. Do not strip metadata by converting or re-saving files.

Authentication — social media evidence must be authenticated for court. You need to show the account belongs to the suspect (subscriber information, device linkage, posting patterns, communications from the account). Platform records obtained through legal process provide the strongest evidence of account ownership and post authorship.

Mobile Phone Downloads

A mobile phone download (extraction) is performed by a Digital Forensics Unit using specialist tools. What can be extracted depends on the tool, the phone model, OS version, and encryption status.

Data types typically extracted

Call logs (incoming, outgoing, missed)
SMS and MMS messages
Messaging app data (WhatsApp, Signal, Telegram — where not end-to-end encrypted with no key available)
Photos and videos (including deleted items where storage has not been overwritten)
App data (banking apps, social media, dating apps, maps/location history)
Contacts and calendar data
Browser history and bookmarks
Emails
Network connections (saved Wi-Fi SSIDs, Bluetooth pairings)

Digital Forensic Imaging

Bit-for-bit copy (forensic image) — a forensic image is an exact sector-by-sector copy of a storage device, including deleted files, slack space, and unallocated areas. It is not a simple file copy. The forensic image is what examiners work from — the original device is preserved as the exhibit.

Write blockers — hardware or software devices interposed between the original storage device and the imaging computer. They prevent any write operations from reaching the original device during imaging, ensuring no data is altered or added. Using a write blocker is mandatory for forensic imaging — imaging without one violates NPCC Principle 1 and will be challenged in court.

Hash verification (MD5 / SHA-256) — a cryptographic hash is generated from the original device and from the forensic image. If the two hashes match, the image is a perfect copy. Hash values are recorded in the forensic examination log and disclosed to the defence. SHA-256 is preferred to MD5 (MD5 has known collision vulnerabilities, though it remains widely used in practice).

Triage vs Full Examination

Triage is a rapid, targeted examination of a device to answer a specific question (e.g. is there contact between suspect and victim? Are there images of the scene? Is there evidence of drug supply?). It is faster and less resource-intensive than a full examination. It may be conducted at the scene or in a custody suite using a portable triage tool. Triage does not replace a full examination — it informs the decision about whether one is needed.

Full examination is a comprehensive forensic analysis of the entire device or image by a qualified Digital Forensic Practitioner. It takes significantly longer (weeks to months for a complex device) and is more expensive. Full examinations are reserved for serious cases.

Proportionality — digital evidence requests must be proportionate to the offence. Ordering a full phone download for a minor public order offence is likely to be disproportionate and may breach the suspect's Article 8 (right to respect for private life) rights under the Human Rights Act 1998. A Data Protection Impact Assessment is required where the processing is likely to result in a high risk to individuals' rights and freedoms (Data Protection Act 2018 s.64), under the Part 3 regime governing law enforcement processing of this material.

Disclosure of Digital Material

Digital material creates significant disclosure obligations. The Attorney General's Guidelines on Disclosure (as revised 2024) specifically address the challenge of large volumes of digital data in criminal proceedings, within the framework set by the Criminal Procedure and Investigations Act 1996.

Scheduling — all material recovered from digital devices must be properly scheduled on MG6C (non-sensitive unused) or MG6D (sensitive unused) schedules. This includes material that does not assist the prosecution — defence-assisting material must be disclosed.

Relevant vs non-relevant — the disclosure officer must make reasonable enquiries into all digital material seized. 'Reasonable enquiries' does not mean reading every message on every device — it means applying a proportionate search strategy documented in an Explanatory Note. The strategy should be agreed with the CPS in complex cases.

Attorney General's Guidance — specifically requires that where a phone download or computer image has been taken, the disclosure officer must consider whether any material in it may assist the defence or undermine the prosecution, and schedule accordingly. Failure to review digital material is a common disclosure failure and grounds for appeal.

Common failures in digital disclosure

Phone downloaded but report not reviewed for defence-relevant material
Only prosecution-supporting messages extracted and scheduled
CCTV downloads not scheduled as unused material
Third-party communications (between suspect and third parties not parties to proceedings) not considered
Deleted material recovered but not disclosed

Frequently asked

What powers allow police to seize a digital device?: s.19 PACE 1984 (general power of seizure while lawfully on premises, where there are reasonable grounds to believe the item is evidence of or obtained through crime — s.19(4) covers information in electronic form accessible from the premises), s.20 PACE 1984 (extending that electronic-production requirement to the other seizure powers such as a s.8 warrant, an s.18 search on arrest, and Schedule 1), a search warrant such as one issued under s.8 PACE, or informed, voluntary, documented consent.
What are the NPCC/ACPO four principles of digital evidence?: The ACPO (now NPCC) Good Practice Guide for Digital Evidence sets out four principles: no action should change the data; only a competent person should access original data in exceptional circumstances; an audit trail of all processes must be created and preserved; and the investigation lead has overall responsibility for compliance with the law and these principles. These are non-statutory operational guidance, but departure from them without documented justification can result in evidence being ruled inadmissible.
What happens if a suspect refuses to disclose an encryption key or password?: RIPA 2000 s.49 allows a notice to be served requiring disclosure of an encryption key or the protected material in an intelligible form. RIPA 2000 s.53 makes failure to comply with that notice a criminal offence, carrying a maximum sentence of 5 years in cases involving national security or child indecency, and 2 years in all other cases.