Policing.uk

Can police force you to unlock your phone?

Not physically, but they can compel disclosure of your password through a legal notice. Under s.49 of the Regulation of Investigatory Powers Act 2000, police can serve a notice requiring you to disclose an encryption key or password. Refusing to comply is an offence carrying up to 2 years' imprisonment (5 years for national security or child indecency cases).

The law

  • Regulation of Investigatory Powers Act 2000, Section 49. Power to serve notice requiring disclosure of encryption key or password for lawfully obtained protected information.
  • Regulation of Investigatory Powers Act 2000, Section 53. Offence to fail to comply with s.49 notice without reasonable excuse. Max: 2 years (5 years for national security/child indecency).

The penalty

Offence
Failure to disclose encryption key (RIPA s.53)
Maximum
2 years' imprisonment (5 years for national security/child indecency)
Typical range
Suspended sentence to 12 months' custody

What to do

  1. You do not have to unlock your phone during a routine police encounter.
  2. If served with a formal s.49 notice, take it seriously: refusal is a criminal offence.
  3. Seek legal advice immediately before responding to a s.49 notice.
  4. If you have genuinely forgotten your password, explain this clearly and gather evidence that supports your claim.
  5. The notice must be in writing and must specify the protected information, the grounds, and the time for compliance.

In detail

The question involves two separate legal issues: the physical act of unlocking a phone and the legal obligation to disclose a password or encryption key.

Physically, police cannot force you to place your finger on a fingerprint reader or hold your face up for Face ID. There is no specific statutory power authorising officers to use force to compel biometric unlocking of devices, although this area of law is developing.

However, Part III of the Regulation of Investigatory Powers Act 2000 (RIPA) provides a mechanism for compelling the disclosure of encryption keys or passwords. Under s.49, a person with appropriate permission (including police of superintendent rank or above) can serve a written notice on a person whom they believe has a "key" to protected information, requiring disclosure of the key.

The notice can require you to disclose the password itself or to put the protected information into an intelligible form (i.e., unlock the device and hand over the data). You can choose which option to comply with.

Refusing to comply with a s.49 notice without reasonable excuse is an offence under s.53 of RIPA. The maximum sentence is 2 years' imprisonment. For cases involving national security or child indecency, the maximum is 5 years.

A "reasonable excuse" for non-disclosure is very limited. Forgetting the password may be a defence if genuine, but the burden shifts to you to demonstrate on the balance of probabilities that you have forgotten it. Simply asserting that you have forgotten will not necessarily be accepted.

Importantly, a s.49 notice can only be served where the police have lawfully obtained the device and have reasonable grounds to believe it contains information needed for specified purposes (prevention or detection of crime, national security, etc.). It cannot be served speculatively during a routine encounter.

The European Court of Human Rights has not yet definitively ruled on whether compelled password disclosure violates the privilege against self-incrimination (Article 6 ECHR). The issue remains subject to legal debate.

Last updated 16 October 2026