How to Make a Subject Access Request to the Police

Your Right to Access Police Data

UK police forces hold significant amounts of personal data. If you want to know what information the police have about you, a subject access request (SAR) is how you get it. The legal framework is slightly different from a standard SAR to a business, but the core right is the same: you are entitled to find out what personal data is being processed about you.

This guide covers what data police hold, how to submit your request, what exemptions police can rely on, and what to do if your SAR is refused or you receive an incomplete response.

If you need an overview of subject access requests in general, start with our guide on what a subject access request is.

What Data Do the Police Hold About You?

Police forces in the UK maintain several databases and record-keeping systems. The data they hold can be extensive, even if you have never been charged with or convicted of an offense.

Police National Computer (PNC)

The PNC is the central database used by all UK police forces. It holds records of:

• Convictions and cautions — criminal records, warnings, and reprimands
• Arrests — including arrests that did not result in charges
• Bail conditions — current and historical
• Wanted and missing persons — flags and alerts
• Vehicle records — registered keeper information, stolen vehicle markers
• Disqualified drivers — driving bans and endorsements

PNC records can persist for decades. Even if charges were dropped or you were acquitted, an arrest record may still exist on the PNC.

Police National Database (PND)

The PND holds intelligence and information that may not have resulted in any formal action. This includes:

• Intelligence reports — information logged by officers about individuals, incidents, or associations
• Custody records — details from when you were held in police custody
• Stop and search records — documentation of stops, even where nothing was found
• Domestic incident logs — records of police attendance at domestic incidents, regardless of whether charges were brought

The PND is designed for intelligence-sharing between forces, so it can contain information from forces other than the one you are submitting your SAR to.

Local Force Records

Each police force also maintains its own local systems, which may include:

• Crime reports — where you are named as a victim, suspect, or witness
• Occurrence logs — records of incidents attended by officers
• Body-worn video (BWV) — footage from officers' cameras during interactions with you
• CCTV footage — images captured by police-operated CCTV systems
• Interview recordings — audio or video from formal interviews under caution
• Emails and correspondence — any communications between police and you, or about you
• Photographs and biometric data — custody photographs, fingerprints, and DNA profiles

Automatic Number Plate Recognition (ANPR)

ANPR cameras capture images of vehicle registration plates. If your vehicle has been captured, that data is held and may be disclosed as part of a SAR, though retention periods vary and older records may have been deleted.

The Legal Framework: Part 3 of the DPA 2018

When police process personal data for law enforcement purposes — the prevention, investigation, detection, or prosecution of criminal offenses — the processing falls under Part 3 of the Data Protection Act 2018, not the UK GDPR.

This matters because Part 3 has its own set of rules about the right of access. Under Section 45 of the DPA 2018, you have the right to:

• Obtain confirmation of whether the police are processing your personal data
• Obtain a copy of that personal data
• Be told the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients

However, the exemptions available to law enforcement under Part 3 are broader than those under the UK GDPR. This is where things get complicated.

Not all police data processing falls under Part 3. Administrative data — such as HR records about police employees, or data processed for non-law-enforcement purposes — falls under the UK GDPR instead. In practice, most SARs to the police involve law enforcement data, so Part 3 is what applies.

How to Submit a SAR to the Police

Step 1: Identify the Right Force

Submit your SAR to the police force that holds the data you want. If you were arrested by Thames Valley Police, submit it to Thames Valley Police. If you are not sure which force holds your data, submit to the force covering the area where the relevant events occurred.

If you want data from the PNC or PND, you can submit to any force — they all have access. However, it is usually most efficient to submit to the force most likely to hold the local records as well.

Step 2: Find the SAR Process

Most police forces have a dedicated data protection or information management unit. Check the force's website for their SAR form and submission instructions. Many forces accept SARs by email, post, or through an online form.

Common submission points:

• Metropolitan Police (London): Information Rights Unit
• Police Scotland: Information Management, Data Protection Unit
• PSNI (Northern Ireland): Data Protection Section
• Other forces: Search "[force name] subject access request" to find the correct unit

Step 3: Provide Identification

Police forces will require proof of identity before releasing data. Typically, you will need to provide:

• A copy of a government-issued photo ID (passport, driving license)
• Proof of address (utility bill, bank statement dated within the last three months)

Some forces accept scanned copies by email; others require certified copies or originals sent by post. Check the specific force's requirements.

Step 4: Be Specific About What You Want

While you are entitled to all your personal data, being specific helps the force locate relevant records more quickly. Include:

• Your full name (and any previous names)
• Date of birth
• Relevant addresses
• Date ranges you are interested in
• Specific incidents or reference numbers if you have them
• Which types of records you want (PNC, crime reports, BWV, etc.)

You do not have to narrow your request — you can ask for everything — but specificity reduces the risk of delays.

Step 5: Submit and Track

Send your request and note the date. The police have one calendar month to respond under Section 54 of the DPA 2018. Keep a copy of your submission and any acknowledgment you receive.

Police Exemptions: When They Can Withhold Data

This is where SARs to the police differ most from SARs to ordinary businesses. Under Part 3 of the DPA 2018 and related provisions, police can restrict or refuse access to your data in several circumstances.

Section 45(4) — Restricting Rights

The police can restrict the right of access where providing the information would adversely affect:

• The prevention, detection, investigation, or prosecution of criminal offenses — if releasing the data would compromise an active investigation or tip off suspects
• The execution of criminal penalties — including the management of sentences
• Public security — where disclosure could threaten public safety
• National security — though this is typically handled by intelligence services rather than police

Third-Party Data

Police records frequently contain information about other individuals — victims, witnesses, informants, and other suspects. The police must not disclose personal data about third parties unless it is reasonable to do so. In practice, this means significant redaction of names and identifying details of other people mentioned in your records.

Informant Protection

The police are not required to disclose information that would identify a confidential informant or source. This is one of the most commonly applied restrictions.

Ongoing Investigations

If the data relates to an active investigation, the police may delay or restrict disclosure until the investigation is complete. They should tell you that a restriction has been applied, though they may not be able to tell you the specific reason if doing so would compromise the investigation.

Neither Confirm Nor Deny (NCND)

In some cases, the police may issue a "neither confirm nor deny" response — refusing to even confirm whether they hold data about you. This is used when confirmation alone would reveal sensitive information (for example, confirming whether someone is under investigation). NCND responses are frustrating, but they are lawful where the exemption conditions are met.

What to Do If Your SAR Is Refused or Incomplete

Step 1: Review the Response Carefully

If the police refuse your SAR or provide a heavily redacted response, they must explain which exemption they are relying on. Read the response letter carefully and check whether the stated reason is specific enough to be meaningful.

Step 2: Request an Internal Review

Most police forces offer an internal review process. Write to the force's data protection officer requesting a review of the decision. Be specific about what you disagree with and why.

Step 3: Complain to the ICO

If the internal review does not resolve the matter, you can complain to the Information Commissioner's Office (ICO). The ICO has the power to investigate and, where appropriate, order the police to disclose data. File your complaint through the ICO website.

The ICO will typically expect you to have gone through the force's internal complaints process first.

Step 4: Apply to the Courts

As a last resort, you can apply to the court for an order requiring the police to comply with your SAR. Under Section 167 of the DPA 2018, the court can order the controller to comply if it finds the request was not handled lawfully. Legal advice is strongly recommended before taking this step.

Timelines and What to Expect

The police have one calendar month from receiving your SAR to respond. If the request is complex or voluminous, they can extend this by up to two additional months (three months total), but they must inform you of the extension and the reasons within the first month.

In practice, police SARs often take longer than SARs to commercial organizations. Police data is spread across multiple systems, BWV footage must be reviewed and redacted, and the exemption assessment for law enforcement data is more involved. Delays are common, but if the force consistently misses deadlines without explanation, that is grounds for a complaint to the ICO.

What You Will Receive

A typical police SAR response includes:

• A covering letter explaining what has been provided and any exemptions applied
• Printouts or electronic copies of records held about you
• Redacted documents where third-party data or exempt information has been removed
• An explanation of any codes or abbreviations used in police records

Body-worn video and CCTV footage, if in scope, may be provided on a disc or via a secure download link. Some forces will invite you to view BWV footage at a police station rather than providing a copy.

Special Considerations

Spent Convictions

Having a spent conviction under the Rehabilitation of Offenders Act 1974 does not mean the police must delete the record. However, it affects what is disclosed on DBS (Disclosure and Barring Service) checks. A SAR to the police will still return the underlying data even if the conviction is spent.

DNA and Fingerprints

If your DNA or fingerprints were taken and you were not convicted, you may be able to request deletion under the Protection of Freedoms Act 2012. This is separate from a SAR but related. The SAR will tell you what biometric data is held; a separate application is needed to request its deletion.

Historical Records

Police forces retain records for varying periods depending on the type and severity of the offense. Some intelligence records are reviewed and weeded after six years; serious crime records may be retained indefinitely. There is no single retention period — it varies by force and record type.

For a broader overview of DSAR exemptions that might be applied, see our DSAR exemptions guide. If you are making a SAR to other government bodies, our guide on subject access requests to the Home Office covers that process.

References

• Data Protection Act 2018: Part 3 (Law enforcement processing), Sections 29–81. Full text on legislation.gov.uk
• ICO Guidance: Right of access — law enforcement processing. ICO law enforcement guidance
• Police National Computer (PNC): Managed by the Home Office. Retention and weeding guidelines published by the National Police Chiefs' Council (NPCC).
• Protection of Freedoms Act 2012: Provisions on retention and destruction of biometric data. Full text on legislation.gov.uk

Related Guides

• What Is a Subject Access Request? — the basics of SARs
• Subject Access Request to the Home Office — SARs to immigration and other Home Office departments
• DSAR Exemptions — when organizations can withhold data
• What to Include in a SAR Response — what a proper response looks like

Understand Your Rights

Our DSAR Compliance Guide explains the full SAR process in plain English, including exemptions, deadlines, and your options when things go wrong. Whether you are making a request or responding to one, it is the practical starting point.

Read the DSAR Compliance Guide