Author: Adrian Ramdat (Director of Training & Consultancy)
December 2025
The extraction of digital evidence from mobile phones and other electronic devices is now a routine and often vital part of modern investigations. However, it is also an activity that carries significant legal, ethical, and practical responsibilities.
Since coming into force, Chapter 3, Part 2 of the Police, Crime, Sentencing & Courts Act 2022 has provided a clear legal framework governing this sensitive area. But there are still knowledge gaps and inconsistent approaches across organisations, with the potential for serious consequences if these powers are misunderstood or misapplied.
This article offers a brief introduction to the key points of the legislation and explains why anyone involved in extracting or handling digital evidence must now understand these requirements in depth, not just in theory but in day-to-day practice.
Why the Framework Was Needed
Several high-profile cases helped drive the need for a statutory framework. A number of serious criminal cases, particularly in the context of sexual offences, were mishandled due to the inappropriate or inconsistent handling of digital evidence.
In some instances, important exculpatory material held on digital devices was not disclosed in time, leading to cases collapsing at court, causing serious injustice for those wrongly accused. In other cases, victims were subjected to highly intrusive ‘digital strip searches’ that left them feeling as though they were under investigation, undermining both confidence in the justice process and the willingness of victims to come forward.
The Court of Appeal ruling in R v Bater-James & Mohammed (2020) set out important principles on when and how digital material should be extracted and disclosed. However, a wider legal framework was clearly needed to provide consistency, improve safeguards, and rebuild trust.
What the Law Permits and What It Doesn´t
The 2022 Act introduced statutory powers (Sections 37 to 41) that enable authorised persons to extract information from electronic devices, subject to strict conditions.
The legislation applies across the UK and some of the key points include:
The powers apply when information is extracted with the agreement of the device user, for purposes such as:
- Preventing, detecting, investigating, or prosecuting crime.
- Locating a missing person.
- Protecting a child or at-risk adult from harm.
In cases where the device user has died, the powers also cover extraction for the purposes of investigations or inquests.
An electronic device is broadly defined, covering phones, tablets, computers, smart devices, and removable media.
The powers do not cover:
- Coercive extraction using search warrants or production orders.
- Covert extraction (which is governed separately under the Investigatory Powers Act 2016).
- Retrieval of cloud-based data.
It should be noted though that the Act is due to be amended by the Crime & Policing Bill, which at the time of writing is moving through the legislative process. If this receives Royal Assent with amendment then it will extend the powers to allow cloud data to be extracted.
Core Principles: Necessity, Proportionality, and Voluntariness
At the heart of the framework are the principles of necessity and proportionality. Extraction of data should only occur where:
- There is a reasonable line of enquiry.
- No less intrusive means of obtaining the information are available.
- The scope of the extraction is limited to what is relevant.
Devices must be provided voluntarily, and detailed requirements apply to how agreement is sought and recorded.
What does this mean in practice? When vulnerable individuals are involved, these principles must be applied even more rigorously. The Act, along with the associated Code of Practice, provides additional safeguards to ensure this.
Vulnerable Individuals, Children, and Adults Without Capacity
Special considerations apply when the user is a vulnerable person, a child, or an adult lacking capacity.
When dealing with vulnerable individuals, including victims of serious crime, disabled people and those experiencing trauma or mental distress, additional support must be provided to help them make an informed decision.
In the case of children or adults without capacity, an ‘alternative individual’, such as a parent, guardian, or authorised representative, must be involved in the decision-making process.
There are slightly different issues depending on whether the extraction takes place in Scotland, Northern Ireland or England & Wales, when dealing with juveniles, vulnerable individuals or at-risk adults.
The process for dealing with these cases is nuanced and tightly governed, and those involved must ensure that they are acting in accordance with both the Act and wider legal duties.
Organisational Responsibilities and Oversight
The framework also introduces important organisational responsibilities:
- Extraction must be authorised by a Sanctioning Officer, typically a person of higher rank than the investigator.
- Detailed records must be kept of why extraction is necessary and proportionate, the scope of the data being sought, and the alternatives considered.
- The person conducting the extraction must be appropriately trained.
- An audit trail must be maintained so that the process can be scrutinised or replicated if necessary.
There are also specific restrictions around the extraction of confidential or protected information (such as legally privileged material or confidential journalistic sources), which requires separate legal authority.
Other Relevant Legislation
Importantly, extraction of digital evidence must always be carried out in line with other key legal duties, including those set out in the Human Rights Act 1998, the Equality Act 2010, and the Data Protection Act 2018 and UK GDPR. The Attorney General’s Guidelines on Disclosure also play a crucial role in ensuring that digital material is handled lawfully and fairly throughout the criminal justice process.
The Practical Challenge
Extracting digital evidence is far more than a technical process. It demands sound legal and ethical judgement and it requires professionals to weigh difficult decisions in real time that can, subsequently, be challenged in court.
While the legislation is now established, the challenge is ensuring that everyone involved in this sensitive area is equipped with the knowledge, tools, and understanding required to apply it consistently and lawfully.
Learn More With our Bitesize Training
There is far more to this framework than can be covered here and applying it correctly in practice requires more than a surface understanding of the law.
If you or your organisation extract data from digital devices then we encourage you to book our in-house Bitesize training, which will provide a detailed exploration of the legislation, supporting guidance, and the practical considerations involved in this complex area of work.
These are complex obligations and they’re too important to leave to chance. Our Bitesize event will ensure that you and your organisation are equipped to meet the required obligations with clarity, confidence, and care.
Contact us now for more details at info@thesignaturebrand.co.uk
Photo by John on Unsplash