Privacy / Data Quality / Security
UK surveillance watchdog flags records, removable-media and data-accuracy failings in 2025 annual report
The Investigatory Powers Commissioner says oversight is working but criticises GCHQ, the NCA, the prison service and the MoD, and records four serious errors linked to communications data.
The Investigatory Powers Commissioner’s Office (IPCO) has published its annual report for 2025, ordered to be printed by the House of Commons on 29 October 2026. It records 366,976 warrants and authorisations issued across public authorities during the year and an increase in errors by the UK intelligence community and the National Crime Agency (NCA), with four errors meeting the serious error definition.
The report says GCHQ still lacks a clear picture of the scale, location and recoverability of lost removable media that may hold IPA-related data. The NCA could not consistently show that covert source and surveillance records were reviewed, retained or disposed of as the law requires.
According to Computer Weekly, faulty data from one mobile operator produced 72 false positives and 88 false negatives in IP address identification, leading to two wrongful arrests. Sir Brian Leveson also questions whether older regimes such as RIPA remain fit for purpose.
Why it matters
The failings are classic data governance problems: unaccounted-for portable storage, records held past review dates without a demonstrable retention basis, and reliance on third-party data whose reliability warnings were ignored. Organisations handling sensitive data should test whether they can evidence review and disposal decisions, maintain a complete inventory of removable media, and act on quality caveats supplied by data providers before using their data in consequential decisions.
Status: Published. Annual report covering 1 January to 31 December 2025, laid before Parliament
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Who should care
- DPO
- Records managers
- Data stewards
- CISO