Subject Access Request to the Cabinet Office

The Cabinet Office runs one request route for the whole department and gives you three ways in: its online form, an email to subject.access@cabinetoffice.gov.uk, or a letter to 70 Whitehall. It asks two things of every request: say which part of the Cabinet Office you dealt with, with any reference numbers and dates, because that is how it finds your records; and send identification. It says it will only disclose information about you, not about anyone else, and that what it holds comes back subject to the exemptions in the legislation. The request is free, and if you would rather write than use the form, our free letter template will draft the letter. The department publishes no response time of its own for this route; the legal position is one month, extendable by two more. The telephone number it prints beside the request mailbox, 0207 276 1234, is the departmental switchboard, and its charter names only the form, email and post as ways to make a request. Security vetting is the record most people want from this department, and it has its own desk. UK Security Vetting is part of the Cabinet Office and takes requests about the national security vetting process itself: email uksv-data.protection@cabinetoffice.gov.uk, or write to the UKSV Data Protection Team, United Kingdom Security Vetting, Building 107, Imphal Barracks, Fulford Road, York YO10 4AS. Give your full name including any previous names, your date of birth, your address and what you want — but do not attach identification or documents to that first email. UKSV replies with a secure Egress link and asks through it for a copy of a current passport or driving licence, and says it cannot process the request without one. It says it will respond within 30 calendar days of receipt unless it tells you within that month that it needs longer, and it still accepts the MoD's Form 1694, the form the Ministry of Defence page describes. UKSV can only act on information gathered in the vetting process; where the file sits with the organisation that sponsored your clearance, which is a joint controller with UKSV, it says it will liaise with them and keep you updated, and you can ask either organisation. Three limits on what a vetting request produces, all in the department's own words. UKSV's privacy notice says the exercise of your rights may be subject to limitations or exemptions, including where an exemption is required for national security or where processing is necessary for the prevention or detection of crime — it names no section of the Act and no certificate. The Security Service is a separate controller for the checks it runs on its own records, and UKSV says it has no access to those systems; the notice gives the Security Service's Enquiries Desk, PO Box 3255, London SW1P 1AE. And vetting data is kept for fifteen years from the date a clearance is last used, refused, expires or is withdrawn. A vetting clearance is not a DBS check — that is a different organisation and a different request — and if a clearance was refused or withdrawn, the appeal goes to the Security Vetting Appeals Panel, an arm's-length body the Cabinet Office supports which can only recommend, not decide. A subject access request is not an appeal. What a department can hold back is narrower than it sounds, and our free response checker will tell you what a complete response should contain. Honours nominations are the one thing this department says a request will not reach. Its honours privacy information states that information relating to honours nominations is exempt from the requirement to respond to data subject requests, citing paragraph 15 of Part 2 of Schedule 2 to the Data Protection Act 2018, which disapplies the right of access where personal data is processed for the conferring by the Crown of any honour or dignity. Nomination papers may be kept for 30 years and a permanent record is kept of everyone who receives an honour; the Secretariat may also ask HMRC to rate a candidate's tax affairs, and deletes that rating within 12 months. The Honours Secretariat is at 6th Floor, 10 The South Colonnade, Canary Wharf, London E14 4PU (honours@cabinetoffice.gov.uk, 0207 276 2777). One warning: the privacy page on the online nomination service still tells you to send a £10 fee and a written request to 1 Horse Guards Road and cites the Data Protection Act 1998. That Act was repealed in 2018 and a request has been free since; do not send money. Civil Service pension records are the Cabinet Office's — it is the scheme manager and data controller for the Civil Service Pension Scheme — but the scheme's privacy policy sends access requests to its administrator, Capita Pension Solutions, which took the service over in the last quarter of 2025: call 0300 123 6666 or write to Capita Pensions Solutions, PO Box 713, Darlington DL1 9JZ, and be as specific as you can about what you want. The policy says the information will be provided within one month, extendable by a further two where a request is complex. If you are still employed and paying in, your employer is a joint controller and the policy says only your employer can correct your details. The department's own HR notice, last updated in July 2025, still names MyCSP as the pensions administrator; the scheme's policy is the newer document. If you work or worked for the Cabinet Office, your HR file is the department's. Its HR and finance privacy notice covers every Cabinet Office business unit and the arm's-length bodies it staffs — but not the Crown Commercial Service or the Government Digital Service, which it says have their own notices — and tells staff who want to review their information to contact dpo@cabinetoffice.gov.uk; the department's general request route above reaches the same department. Payroll is run by Shared Services Connected Ltd, which the notice says processes some data offshore in India, and HR casework by MoJ Casework, both as the department's processors. Civil servants in other departments should start with their own employer: the Cabinet Office receives Civil Service-wide data for managing the Civil Service as a whole, but the personnel file sits with the employing department. A job application is a different question again. The Government Recruitment Service, part of Civil Service HR in the Cabinet Office, is the controller for candidates it finds through LinkedIn and searches and keeps that data for two years, and an application to the Cabinet Office itself falls under the HR notice above. Civil Service Jobs publishes its own privacy notice behind a "confirm you're a real person" check, so read it there, and the recruiting department's own notice, before you write. GOV.UK One Login is not the Cabinet Office. Its privacy notice says it is provided by the Government Digital Service, which is part of the Department for Science, Innovation and Technology, and that DSIT is the data controller; a request goes to gds.data.protection@dsit.gov.uk. The Cabinet Office's own request notice still carries a line for requests relating to the Government Digital Service at gds-privacy-office@digital.cabinet-office.gov.uk, and the ICO register still lists the Government Digital Service among the Cabinet Office's names; for One Login, the One Login notice is the newer and the more specific document. Two more things are separate desks. A Freedom of Information request — about what the department does, not about you — goes to foi-team@cabinetoffice.gov.uk or Room G39, 1 Horse Guards Road, London SW1A 2HQ, a different address from the request route above. And several bodies the Cabinet Office supports are registered with the ICO as controllers in their own right even though they share its data protection officer — the Civil Service Commission, the Social Mobility Commission, the Office of the Registrar of Consultant Lobbyists, the Boundary Commission for Wales and the Ethics and Integrity Commission — so a request about one of them goes to that body. The Prime Minister's Office, the Privy Council Office, the Crown Commercial Service and the Government Property Agency are within the Cabinet Office's own registration. Records of someone who has died are not subject access requests, to this department or any other. The Cabinet Office publishes no separate route for them; its HR notice says records of historic value are selected and preserved under the Public Records Act 1958 and passed to The National Archives. If you think the department has mishandled your data or your request, its complaints process, published in February 2026, is to email the Data Protection Officer at dpo@cabinetoffice.gov.uk; it says it will acknowledge within three working days and respond in full within 30 calendar days. That mailbox is for concerns, not for making the request. Other departments are listed on the government subject access request page.

Made under UK GDPR Article 15, subject to the exemptions in Schedule 2 of the Data Protection Act 2018

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.