Phone SeizedUnited KingdomHow long police can keep your phone data
How long police can keep your phone data
What you must do, what you can refuse, and what they can do
Every claim below links to the source it comes from, with the wording quoted so you can check it yourself.
What they can do
A power the law gives them over you or your device.
Section 22(2)(a) says that, without prejudice to the generality of subsection (1), anything seized for the purposes of a criminal investigation may be retained, except as provided by subsection (4), for use as evidence at a trial for an offence, or for forensic examination or for investigation in connection with an offence.
Police and Criminal Evidence Act 1984, s.22(2)(a)
“Without prejudice to the generality of subsection (1) above— anything seized for the purposes of a criminal investigation may be retained, except as provided by subsection (4) below— for use as evidence at a trial for an offence; or— for forensic examination or for investigation in connection with an offence”
Read it at legislation.gov.ukquote checked 2026-10-04
Limits on them
A rule that constrains them, or a remedy you can use.
The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.
Data Protection Act 2018, s.35(1)
“The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.”
Read it at legislation.gov.ukquote checked 2026-09-08
The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in relation to the purpose for which it is processed.
Data Protection Act 2018, s.37
“The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in relation to the purpose for which it is processed.”
Read it at legislation.gov.ukquote checked 2026-09-08
The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for the purpose for which it is processed.
Data Protection Act 2018, s.39(1)
“The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for the purpose for which it is processed.”
Read it at legislation.gov.ukquote checked 2026-09-08
Subject to subsection (4), anything seized by a constable, or taken away by a constable following a section 19 or 20 requirement, may be retained so long as is necessary in all the circumstances — the quoted provision states a necessity test and no period of days.
Police and Criminal Evidence Act 1984, s.22(1)
“Subject to subsection (4) below, anything which has been seized by a constable or taken away by a constable following a requirement made by virtue of section 19 or 20 above may be retained so long as is necessary in all the circumstances.”
Read it at legislation.gov.ukquote checked 2026-10-02
Under s.22(4), nothing may be retained for either of the purposes mentioned in subsection (2)(a) if a photograph or copy would be sufficient for that purpose.
Police and Criminal Evidence Act 1984, s.22(4)
“Nothing may be retained for either of the purposes mentioned in subsection (2)(a) above if a photograph or copy would be sufficient for that purpose.”
Read it at legislation.gov.ukquote checked 2026-10-02
PACE Code B para 7.14 says anything seized in accordance with the above provisions may be retained only for as long as is necessary.
PACE Code B (2023), para 7.14
“anything seized in accordance with the above provisions may be retained only for as long as is necessary”
Read it at assets.publishing.service.gov.ukquote checked 2026-09-08
The Code of Practice on extraction of information from electronic devices says it only applies as regards the powers in Chapter 3 of Part 2 of the Police, Crime, Sentencing and Courts Act 2022 (‘the Act’), and that information which is extracted and deemed not relevant must be deleted unless there is a lawful basis to retain it.
Extraction of Information from Electronic Devices: Code of Practice (Oct 2022), paras 1, 4 and 138
“Police, Crime, Sentencing and Courts Act 2022 (“the Act”)—This code does not supersede guidance/codes that accompany other pieces of legislation, and only applies as regards the powers in Chapter 3 of Part 2 of the Act. If another power is being used as the basis for extracting information from an electronic device, the guidance/code for that power will apply.—Information which is extracted and deemed not relevant must be deleted unless there is a lawful basis to retain it.”
Read it at assets.publishing.service.gov.ukquote checked 2026-10-04
What the sources say
What a document, a report, an agency publication or a provision says, quoted as it is worded.
In Part 3 of the Data Protection Act 2018, limb (a) of the definition of "sensitive processing" in s.35(8) is the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership.
Data Protection Act 2018, s.35(8)(a)
“In this Part , “ sensitive processing ” means— the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership”
Read it at legislation.gov.ukquote checked 2026-09-08
The ICO report says police data extraction practices vary across the country, with excessive amounts of personal data often being extracted, stored, and made available to others, without an appropriate basis in existing data protection law.
ICO, Mobile phone data extraction by police forces in England and Wales (June 2020)
“police data extraction practices vary across the country, with excessive amounts of personal data often being extracted, stored, and made available to others, without an appropriate basis in existing data protection law.”
Read it at ico.org.ukquote checked 2026-09-08
The ICO recommended that the Government strengthen the current legislative framework by producing a statutory code or other equivalent measure to ensure the law is sufficiently clear and foreseeable.
ICO, Mobile phone data extraction by police forces in England and Wales (June 2020), Recommendation 1
“The Government should strengthen the current legislative framework by producing a statutory code or other equivalent measure to ensure the law is sufficiently clear and foreseeable.”
Read it at ico.org.ukquote checked 2026-09-08
The general data protection duty
Part 3 of the Data Protection Act 2018 sets data protection principles for the processing of personal data for any of the law enforcement purposes. The first principle (s.35(1)) is that processing must be lawful and fair. The third (s.37) is that personal data must be adequate, relevant and not excessive in relation to the purpose for which it is processed. The fifth (s.39(1)) is that it must be kept for no longer than is necessary for the purpose for which it is processed. That is a necessity test; the quoted provision states no period of days.
Limb (a) of the definition of “sensitive processing” in s.35(8), which applies in Part 3, is the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership.
PACE's retention provision
PACE s.22(1) says that, subject to subsection (4), anything seized by a constable, or taken away by a constable following a requirement made by virtue of section 19 or 20, “may be retained so long as is necessary in all the circumstances”. Section 22(2)(a) says that, without prejudice to the generality of subsection (1), anything seized for the purposes of a criminal investigation may be retained, except as provided by subsection (4), for use as evidence at a trial for an offence, or for forensic examination or for investigation in connection with an offence. Section 22(4) says nothing may be retained for either of the purposes mentioned in subsection (2)(a) if a photograph or copy would be sufficient for that purpose. PACE Code B para 7.14 says “anything seized in accordance with the above provisions may be retained only for as long as is necessary”. The quoted PACE provisions state a necessity test and no period of days, weeks or months.
What the extraction Code says about deletion, and its scope
Para 138 of the extraction Code says: “Information which is extracted and deemed not relevant must be deleted unless there is a lawful basis to retain it.” As quoted, para 138 states no deadline for that deletion.
The same Code says it “only applies as regards the powers in Chapter 3 of Part 2 of the Act” and that “If another power is being used as the basis for extracting information from an electronic device, the guidance/code for that power will apply.” Section 37(1) of the 2022 Act is a power to extract information from a device a user has voluntarily provided and agreed to the extraction from (see victims and witnesses). This site has not sourced a deletion rule specific to a phone seized under PACE; the PACE and data protection provisions above are the ones it has sourced for that situation.
The regulator's own verdict
The Information Commissioner’s Office found that “police data extraction practices vary across the country, with excessive amounts of personal data often being extracted, stored, and made available to others, without an appropriate basis in existing data protection law.” Its Recommendation 1 says: “The Government should strengthen the current legislative framework by producing a statutory code or other equivalent measure to ensure the law is sufficiently clear and foreseeable.”
Related pages
Related pages on this site: Property taken in custody: PACE s.54 and Seize and sift.
Last reviewed . Next review due . No lawyer has reviewed this page — see [email protected] if you think something here is wrong.