What to do if…
a regulator or official asks you to provide passwords or passcodes during an inquiry

What to do now

1. Move the request into writing. Calmly say: “I’m not able to share passwords or passcodes verbally. Please put the request in writing, including the legal basis, scope, deadline, and what information, device, account, or system it covers.”

2. Verify who is asking. Ask for the person’s name, organisation, role, ID if available, contact details, and case or reference number. Write down the time, place, who was present, and the exact words used for the password or access request.

3. Ask what exact power or notice they are relying on. Keep the questions short:

   • Are you asking for documents or data to be produced?
   • Are you asking me to unlock a device or account?
   • Are you asking for the actual password, passcode, encryption key, recovery key, 2FA code, or authenticator approval?
   • Is this voluntary, or is there a formal notice, warrant, court order, or statutory power?

4. Bring in legal and organisational support immediately.

   • If you have a solicitor, contact them now and ask the official to wait while you get advice.
   • If this is a workplace matter, contact your organisation’s legal or compliance lead and IT security lead, and say that the organisation will respond through them.
   • If you are personally named in a notice, tell your solicitor that the notice is addressed to you, not just to the organisation.

5. Offer safer ways to cooperate if the written power allows. Instead of handing over credentials, ask whether the request can be met by:

   • producing specific documents or data exports within the written scope;
   • supervised access while you remain present;
   • access carried out by an IT administrator using a time-limited account with the minimum permissions needed;
   • device collection, imaging, or copying under the stated authority rather than disclosure of your passcode;
   • a written protocol for what will be accessed, copied, searched, or excluded.

6. If a formal notice is served, slow down and read only what matters first. Check:

   • who issued it and whether it is addressed to you;
   • the legal power named in it;
   • exactly what device, account, information, key, password, or assistance is demanded;
   • the deadline and how compliance is meant to happen;
   • whether it says failure to comply may be an offence;
   • whether it limits who may receive the disclosed information.

   In the UK, a notice under Part III of the Regulation of Investigatory Powers Act 2000 may, in some circumstances, require disclosure connected with protected electronic information, including a key or assistance to make information intelligible. If section 49, section 53, encryption, a key, protected information, or a secrecy requirement is mentioned, contact a solicitor immediately and do not alter or destroy anything.

7. If the request happens during a search, raid, inspection, or visit, keep the moment controlled. Say that you are not refusing to cooperate, but you need the request recorded in writing and legal support involved. Keep one person taking notes if possible, and ask for a copy of any warrant, notice, inventory, or written authority before any access is given.

8. If this is at a UK port or border, treat it as legally different from ordinary regulator contact. Border examination powers can involve duties to answer questions or provide information and may operate without ordinary suspicion. Stay polite, ask which power is being used, ask for legal advice as soon as possible, and record what was requested when you safely can.