Can Police Access Your Phone Data On The Spot Without A Warrant?

Gone are the days when evidence was solely collected from raids, asset possession, or the classic detective work you see on television. Today, there is more information on the average mobile phone than police could once have gathered from weeks of traditional means.

A phone contains what you would expect – such as messages and photos – but also hidden information – such as location history and deleted search queries. Altogether, a phone is an invaluable investigative tool that can make or break a case.

So, on 6 August 2026, the Minns Government introduced legislation that would make it considerably easier for NSW Police to compel a person to open that device so its contents can be extracted. The Crimes and Other Legislation Amendment (Further Organised Crimes Reforms) Bill 2026, tabled by Police Minister Yasmin Catley, is framed as an organised crime measure. However, the mechanism it creates is not so confined.

What is a Digital Evidence Access Order?

Digital evidence access orders, or DEAOs, are not new. They are a legal order and were introduced into the Law Enforcement (Powers and Responsibilities) Act 2002 (NSW) (‘LEPRA’) in October 2022 that, pursuant to section 76AM of LEPRA lawfully enables investigators to compel the specified person to assist in providing access to the device. This includes being required to provide access information, such as a PIN, a password, a pattern, or a biometric such as a face or fingerprint scan. It also allows police to copy data stored in any electronic device.

What is the Penalty for Refusing to Give Your Password Under a Digital Evidence Access Order?

Failure to comply without reasonable excuse, or providing false information, to a lawful digital evidence access order issued is a criminal offence currently carrying up to five years imprisonment and/or up to 100 penalty units ($11,000 fine).

Importantly, the regime does not acknowledge the common law privilege against self-incrimination and the right to silence. You cannot decline on the basis that unlocking the phone will hand police the evidence used to convict you.

Note too that officers who supply false information to obtain a DEAO commit a summary offence under section 76AG of LEPRA, carrying up to two years imprisonment and an $11,000 fine.

A DEAO has only been available where a device is seized in connection with a search warrant or a crime scene warrant. In other words, a court or authorised issuing officer had already been satisfied that the intrusion was justified before anyone could be compelled to unlock anything. Crucially, what enables a DEAO to be ordered is precisely what the proposed legislation looks to change.

How Long Does a DEAO Last For?

A digital evidence access order remains in force for a period of 7 business days after its issue. If the order issued is in connection with a covert search warrant, then it expires after 10 days from being issued pursuant to section 76AL LEPRA.

How to Get a Digital Evidence Access Order in NSW?

An eligible applicant, being an authorised police officer, can apply for a digital evidence access order in connection with a search warrant or a crime scene warrant for authority for an executing officer to issue a direction to allow police to copy data stored in a device and to compel a person to provide access information for a device, including a PIN, a password, a pattern, or a biometric such as a face or fingerprint scan, in relation to a computer that may be found, or has been found, in executing the warrant pursuant to section 76AB LEPRA.

Note that the application for the digital evidence access order would be required to be made at the same time as the application for the warrant or after the warrant has been issued, whether before or after the warrant is executed, in accordance with section 76AB(2) LEPRA.

An application for the DEAO can be made in person- in which case an eligible issuing officer who determines whether or not the grant it must not issue it unless the information given by the applicant in or in connection with the application is verified before the eligible issuing officer on oath or affirmation or by affidavit pursuant to section 76AC LEPRA.

A DEAO order can also be made electronically by email or by telephone provided it complies with the legislative requirements in sections 76AD and 76AE of LEPRA.

There are strict requirements that must be met in terms of the information in applications for a digital evidence access order outlined clearly in section 76AF of LEPRA.

A digital evidence access order can be issued by an eligible issuing officer if section 76AJ LEPRA is satisfied, namely, each of the following 4 requirements:

1. The order will authorise an executing officer to issue a direction mentioned in section 76AM(1) in relation to a computer that has been found, or may be found, in the execution of a search warrant or crime scene search warrant that has already been issued or will be issued at the same time as the order, and
2. The eligible issuing officer is satisfied there are reasonable grounds for suspecting evidential material is held in, or is accessible from, the computer, and
3. The eligible issuing officer is satisfied the specified person in relation to whom it is proposed the digital evidence access order will be issued is:
   • Reasonably suspected of having committed the offence states in the search warrant or crime scene search warrant, or
   • The owner or lessee of the computer, or
   • An employee of the owner or lessee of the computer, or
   • A person engaged under a contract for services by the owner or lessee of the computer, or
   • A person who uses or has used the computer, or
   • A person who is or was a system administrator for the system including the computer, and
4. The eligible issuing officer is satisfied the specified person in relation to whom it is proposed the digital evidence access order will be issued has relevant knowledge of:
   • The computer or a computer network of which the computer forms or formed a part, or
   • Measures applied to protect data held in, or accessible from, the computer.

It is important to keep in mind that if there is a defect in the DEAO that affects the substance of the order in a material particular, the DEAO will be invalid. An invalid DEAO is not lawfully enforceable and so any evidence obtained as a consequence of executing it can be excluded evidence pursuant to section 138 of the Evidence Act (NSW). Equally, an unlawful or improper execution of a search warrant related to the DEAO can also have the same effect which can result in the criminal charge(s) being withdrawn early or dismissed in court.

For this reason, it is a critical part of a criminal defence lawyer’s role to carefully review and scrutinise the validity and lawfulness of a digital evidence access order and any related search warrant in order to rule out such important issues.

What The Bill Would Change

Schedule 2 of the Bill creates a new category of digital evidence access orders limited to investigations of an organised crime offence, enabling police to apply for a digital evidence access order in relation to devices that are lawfully seized in the context of organised crime investigations where a search warrant or crime scene warrant had not been sought. The second reading speech to the Bill states that “this supports timely police access to critical digital evidence in fast-moving organised crime investigations where delays can risk loss, encryption or remote wiping of data”. However, an application for a DEAO order still needs to be made and granted before the order can be in effect.

The origin of the change is a statutory review of the 2022 reforms tabled in Parliament earlier this year, in which NSW Police raised that the existing framework is not available in every situation where a device has been lawfully seized. Vehicle searches and person searches were the examples given. The Bill responds by making the power available in those circumstances, for prescribed serious offences linked to organised crime, which the Government has described as including drug supply, the illicit tobacco trade, fire-bombings and public place shootings.

It also lifts the maximum penalty for non-compliance from five years to seven. This reflects the immensely severe stance taken by Parliament towards organised crime.

The practical consequence is significant. A power that previously sat behind a warrant application may now be available in the field: at an RBT stop, after a personal search, or in a far broader range of encounters without the presence of a warrant.

Premier Chris Minns has framed the reform around syndicates using encrypted technology and layers of intermediaries, and the Government points to fast-moving investigations where delay risks data being remotely wiped.

A police officer, under the proposed new laws, may apply for a DEAO in relation to a computer that’s been lawfully seized by a police officer only if the police officer reasonably suspects data contained on the computer is connected to or relevant to the investigation of an organised crime offence. In turn, according to the proposed new laws on this topic, a DEAO may be granted if the issuing officer (i.e. Judge or Registrar) is satisfied as to the following matters:

1. There are reasonable grounds for believing the computer was lawfully seized, and
2. There are reasonable grounds for suspecting data contained on the computer is connected to or relevant to the investigation of an organised crime offence, and
3. There are reasonable grounds to suspect the person in relation to whom it is proposed the digital evidence access order will be issued- committed the organised crime offence or has knowledge of the same, and
4. The person in relation to whom it’s proposed the digital evidence access order will be issued has relevant knowledge of the computer or computer network of which the computer forms or formed a part or has relevant knowledge of measures applied to protect data held in, or accessible from, the computer.

The meaning of “organised crime offence” means a “serious offence linked to organised crime”. A serious offence may be linked to organised crime if the serious offence is:

• Committed by 2 or more persons, or
• Involves substantial planning and organisation, or
• Involves systemic and continuing activity, or
• Is committed to obtain profit, power or influence, or
• Is committed for the purpose of retribution against another person or group of persons.

A “serious offence” is defined as the following offences:

1. An offence prescribed by the regulation, or
2. An aggravated circumstances of offence within the meaning of the Crimes Act 1900, section 195, or
3. An offence against the Crimes Act 1900 (NSW), namely:
   • Section 55 or 86,
   • Part 3, Division 15
   • Part 3A, Division 5
   • Part 4, Division 2
   • Section 99 or 192E
   • Part 4AC

The Bill does other things too. It would allow police investigating serious indictable offences or missing person cases to access unredacted toll camera images, starting with the Sydney Harbour Bridge and Harbour Tunnel. It would connect NSW driver licence photographs to the Commonwealth’s National Driver Licence Facial Recognition Solution. And it doubles maximum penalties for failing to comply with NSW Crime Commission orders to 10 years. $126.6 million in the 2026/27 Budget drives this reform, including $108.8 million for policing technology and digital evidence management.

Can Police Download All Data From My Phone?

Compelling someone to unlock a phone is not the digital equivalent of asking to look in a bag. Once access is obtained, NSW Police use forensic extraction tools, principally a tool called Cellebrite, to take a copy of the device. Greens MLC Sue Higginson told Parliament in June that this reaches every message a person has ever sent, every photo taken, their location at any moment, everything they have ever searched, and biometric data identifying them. Extraction captures content from encrypted messaging applications including WhatsApp, Signal and Telegram, along with search history, health data, call logs, contacts, and metadata.

There is no mechanism by which the download is limited to material relevant to the offence under investigation. The whole device is extracted, even what is irrelevant.

Concerns and Objections to the Proposed New Laws

The strongest criticisms are not about whether police should ever access phones. They are about scope, oversight and what happens to the data afterwards.

The most obvious objection is the highly probable risk that these laws will not solely be used in the organised crime context, which is the stated justification. The power attaches to a category of prescribed offences and operates through ordinary policing encounters. Once a discretionary power such as this is granted to police, we cannot expect that it will exclusively be used for its intended purpose.

There are also real concerns regarding the sheer volume of extracted personal information. Criminal defence lawyers have pointed to evidence given in cross-examination by officers who described downloading around 20 devices a week. Experts extrapolated from that figure across roughly 400 NSW police stations to suggest tens of thousands of extractions annually, before any proposed expansion. With the legislation, police may simply be able to access too much information.

Overall, these reforms may signal a more effective approach towards socially damaging offending such as organised crime, or a further encroachment by Parliament into the civil liberties of NSW citizens. The bill has currently not been passed, and we are likely to see this issue develop.