Subject Access Request to the Crown Prosecution Service

A request to the CPS is not made under the same law as a request to most organisations. The CPS says of its own processing that "The processing will fall under part 3 of the Data Protection Act 2018 as the CPS processes data for the purpose of conducting criminal prosecutions", so a request about a prosecution file is a Part 3 right of access rather than a UK GDPR Article 15 one. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the CPS are different and broader. UK GDPR applies only to the narrow set of records it holds for purposes that are not law enforcement. The CPS publishes a deadline of one month, extendable by a further two months where a request is complex or where it has received several from the same person. A request to the CPS is not a route to your case papers. The CPS holds prosecution files the police passed to it, and its own guidance says information subject to legal professional privilege, information relating to another individual, and information relating to the prevention or detection of crime or the apprehension or prosecution of offenders may not be disclosed. If you are a defendant in a live case, disclosure comes through your solicitor rather than through a subject access request. Several things people want from the CPS are somebody else's to give. If you want your criminal record, that is a basic DBS check. For the national police record, that is ACRO, and for what a force holds about an investigation rather than what the CPS holds, that is a request to the force that dealt with it. For a transcript of a hearing, that is HM Courts and Tribunals Service. If you disagree with a decision not to charge or to stop a case, the route is the Victims' Right to Review scheme, not a subject access request. The CPS asks for a review request "ordinarily" within 10 working days of the decision letter, and says requests made after that are still accepted although a delay may affect the outcome, with requests more than three months after the decision unlikely to be accepted without exceptional circumstances. A subject access request takes a month, so do not wait for one before asking for a review. IAT@cps.gov.uk and 020 3357 0788 reach the Information Access Team, which handles both right of access and Freedom of Information requests. The two deadlines are different — a month for subject access, 20 working days for Freedom of Information — so say which one you are making. Two other CPS data protection addresses are not the request route. DataProtectionOfficer@cps.gov.uk is the Data Protection Officer and is where a complaint about how your data was handled goes. GDPREnquiries@cps.gov.uk is the Data Protection Compliance Unit, which handles rectification, erasure and the other rights; the CPS says its form for those "should not be used for a 'right of access' request".

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for the CPS's non-prosecution records

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.