What happens when police examine a seized phone

A full forensic extraction is not the same as an officer scrolling through your messages. It typically pulls far more than what is visible on the screen — including deleted material still recoverable from storage, app data, and metadata you never see. This page goes through what that actually includes, device by device.

What matters here is the legal side: what has to be true before that process can start on a phone the police have already seized.

People sometimes assume examining a seized phone’s contents needs its own separate authorisation on top of the seizure itself — something like the warrant used for live interception. Section 42 frames the Code as guidance on the s.37(1) and s.41(1) powers; whether it reaches a device seized under an ordinary police power such as PACE is not something this site has sourced. The rules governing more intrusive surveillance techniques treat the seizure power itself as the authorisation for interfering with the device to get at its data, so nothing further is required.

The guidance gives the scenario directly: an officer examining data on equipment already lawfully seized under PACE is acting under the 1984 Act’s own authority.

There is a dedicated statutory Code of Practice for police extraction of information from electronic devices — but by its own terms it only covers guidance on the power to extract information from a device a user has voluntarily handed over, or one already in an authorised person’s possession under a related power. It is not written to govern a phone taken from you by force under PACE. That voluntary pathway is covered separately, because the safeguards attached to it are genuinely different.

The Information Commissioner’s Office looked at how forces across England and Wales were actually using extraction, and did not like what it found: “police data extraction practices vary across the country, with excessive amounts of personal data often being extracted, stored, and made available to others, without an appropriate basis in existing data protection law.” Read the ICO’s 2020 report.

Its headline recommendation was a proper statutory code behind the whole practice, so the law is clear and foreseeable rather than left to force-by-force discretion — a finding, not a rule, so it is not listed as a duty item below.