Policy paper

Crime and Policing Act 2026: data preservation notices factsheet

Updated 29 September 2026

What are we going to do?

We are strengthening the arrangements for preserving online information that may be relevant to investigations into the death of a child.

The Crime and Policing Act 2026 introduces a new statutory duty requiring senior coroners in England and Wales to notify Ofcom when they become aware of the death of a child aged between 5 and 17. This notification will ensure that online data which may be relevant to understanding the circumstances of the child’s death is preserved as quickly as possible and is not deleted in accordance with routine retention processes operated by online services.

The intention is that notification to Ofcom, and the issuing of a Data Preservation Notice (DPN), becomes the clear default position in virtually all cases involving the death of a child aged 5 or above. Only in narrowly defined circumstances, where an investigation into the death is not required, or where online activity is clearly irrelevant to the child’s death (for example, a road traffic accident death that was clearly accidental; or a death resulting from the natural conclusion of a terminal illness), will notification not be necessary.

At the same time, the provisions ensure that the preservation of data remains targeted and proportionate, including by shortening the initial data retention period (although this will remain extendable where required) and maintaining appropriate safeguards for privacy in accordance with data protection legislation.

How are we going to do it?

The Crime and Policing Act 2026 introduces a new statutory duty on coroners in England and Wales, through a new section 31A of the Coroners and Justice Act 2009, requiring them to notify Ofcom within five working days when they become aware that a child aged between 5 and 17 has died and their body is within the coroner’s area. This notification will operate as the trigger for Ofcom to issue a DPN under existing provisions in the Online Safety Act 2023 (the OSA), requiring specified providers of internet services to retain information relating to the deceased child’s use of their services. Regulations which will specify the kinds of services which will receive a DPN in every case are being made separately by the government to supplement this new statutory duty.

Where a coroner is able to identify a particular service that may hold relevant information, they may request that a DPN is targeted to that service (which has been available at coroners’ discretion under section 101 of the OSA since this section came into force in September 2025). Coroners may also request additional targeted DPNs at any point during the course of their investigation if further services of potential relevance are identified.

The duty to notify Ofcom is subject to limited and clearly defined exceptions. Notification will not be required where the coroner determines that their statutory duty to investigate a death is not engaged (i.e. it is clear without investigation that the death is from natural causes), or where the coroner is satisfied that preserving online information would serve no purpose because it is of no relevance to the child’s death.

Where a DPN is issued, the initial retention period for preserved information has been reduced from twelve months (as required under the preceding measures in the OSA) to six months. This ensures that preservation remains targeted and proportionate, particularly where data relating to third parties may be captured. The six-month retention period will remain extendable at the coroner’s request where they consider that continued preservation is, or may be, necessary for the purposes of their investigation. Where it is not yet clear whether preserved information will be required as evidence, the default should be for an extension to be requested.

The legislation also amends an existing regulation making power in the OSA to allow regulations describing which kinds of services should receive a DPN to refer to external documents, such as research on services most commonly used by children, as amended from time to time. This ensures that data preservation remains focused on platforms most likely to hold relevant information, while allowing the regulatory framework to remain current and capable of capturing new and emerging services (without the need for further legislation).

The new duty will apply only in England and Wales. The discretionary DPN arrangements, as set out in the OSA, will continue to apply in Scotland and Northern Ireland, unless/until those administrations choose to amend them.

Background

Access to evidence of online activity after death can be unpredictable, with some services routinely deleting or overwriting data after short periods of time.

The data preservation provisions in the OSA were introduced to address this issue, enabling Ofcom to require providers of internet services to preserve information relating to a child’s online activity, where requested by a coroner, on the basis that it may be relevant to an investigation into their death. However, bereaved families and campaigners have been concerned that reliance on a discretionary process can lead to delay and inconsistency in the preservation of information which may later be required as evidence by the coroner, particularly at the early stages of an investigation when the relevance of online activity may not yet be fully understood.

The new provision responds to these concerns by establishing a clear statutory requirement for rapid triggering of the data preservation process, while ensuring that it remains proportionate. The reduced initial retention period, the ability to extend preservation where necessary, and the narrow exceptions to the notification duty together ensure an appropriate balance between the need to secure evidence and the protection of privacy, including that of third parties.

These measures support coroners in carrying out timely and effective investigations, help to prevent irreversible data loss, and ensure that online information is available where it may be required to provide answers to bereaved families about the circumstances of a child’s death.

Frequently asked questions

Will services be sent automatic preservation notices in every case?

A DPN will be issued in each case (subject to limited exceptions) to a group of services which are most popular with children, and which will be described in regulations. The narrowly defined exceptions are where an investigation into the death is not required, or where online activity is clearly irrelevant e.g. a death resulting from natural conclusion of terminal illness.

The regulations will help ensure that where coroners may not be aware of a child’s online accounts and activity within the initial 5-day period at the start of their investigation, a child’s data can still be protected where it is held by the most popular services used by children. If a coroner can identify a service of interest in the initial 5-day period, they can request that a DPN is targeted to that particular service. This request can happen alongside services being served automatic DPNs.

Coroners can continue to identify services of interest throughout their investigation, effectively continuing to add to the list of services that should receive a DPN in that case.

How can the government be certain that the “irrelevant” exception won’t be too widely applied?

The statutory exception is deliberately framed very narrowly to set a high threshold. We intend that it should only be applied in cases where online activity can be ruled out – for example, clearly accidental deaths or those involving the natural conclusion of a terminal illness.

The clear default position is for coroners to notify Ofcom of a death and trigger the automatic issue of DPNs.

Which kinds of services will be sent preservation notices?

A service will receive a Data Preservation Notice in two circumstances. Firstly, if they have been identified as a service of interest by a coroner. A coroner can do this either at the start of their investigation, during the initial notification to Ofcom, or at a later date if a service is subsequently identified as being of interest.

Secondly, we will also make regulations, using an existing power in the Online Safety Act, to describe the kinds of services that will be automatically served a DPN. Our intention is for these regulations to capture the services that are most popular with children, whilst remaining up to date to capture emerging services.

How will the data retention period and extensions operate?

Where a Data Preservation Notice (DPN) is issued following notification by a coroner in England and Wales, the initial statutory retention period for preserved information will be six months. This replaces the twelve-month retention period provided by section 102 of the Online Safety Act 2023.

The six-month period is intended to provide sufficient time for the coroner to determine whether preserved online information is relevant to their investigation and whether it may be required as evidence. If the coroner determines it will not be required, then they will ask Ofcom to cancel the DPN.

The legislation makes clear that the initial six-month retention period is extendable at the coroner’s request where the coroner considers that continued preservation of information is, or may be, necessary for the purposes of their investigation.

Where it is not yet clear at the end of the initial six month period whether preserved information will be required as evidence, it is intended that the default should be to request an extension, to ensure that potentially relevant material is not lost prematurely.

Reducing the initial retention period, while maintaining the ability to extend where necessary, ensures that data preservation remains targeted and proportionate, particularly given that preserved data may include information relating to third parties.

A DPN is concerned solely with ensuring that information is not altered or deleted while a coroner determines whether it may be required for the purposes of an investigation. Where the information is subsequently lawfully accessed and obtained as evidence, the issue of preservation in respect of that material no longer arises. From that point, the information is handled in accordance with the existing coronial and data protection frameworks governing the management, use and disclosure of evidence, with appropriate safeguards and judicial oversight.

How can government be certain that services will comply with data preservation notices?

The Department for Science, Innovation and Technology Ministers engaged with the largest services before the data preservation process initially came into force, and services attending confirmed that the practicality of preserving data upon receipt of a DPN would not be an issue.

The previous Secretary of State wrote to services to remind them of their duties under section 101, following a roundtable in May 2025. The then Minister for Online Safety, Baroness Jones, wrote again in September 2025, 28 days prior to when DPNs came into effect.

Ofcom also consulted with stakeholders, including services, when drafting the guidance for the initial DPNs.

DPNs require services to respond to Ofcom explaining the steps that they have taken to preserve the data (if such data exists), or notifying Ofcom that they have not identified an account associated with the child named in the DPN.

Ofcom has been issuing DPNs for over 6 months now and has not opened any investigations into failure to comply with a DPN.

If a service failed to comply with DPN, Ofcom may consider opening an investigation into its conduct and has robust enforcement powers available.

Failing to comply with a Data Preservation Notice, may lead to Ofcom taking enforcement action against the company. The enforcement action can result in a financial penalty, up to a maximum of either 10% of qualifying worldwide revenue or £18 million (whichever is greater).