During 2022 and 2023, the ICO conducted security audits of all UK Telecommunications Operators that were subject to a Data Retention Notice under Part 4 of the Investigatory Powers Act 2016. In doing so, it carried out its duty under IPA s.244. This executive summary is based on the findings from our audits.