Subject Access Request to the Disclosure and Barring Service

Most people searching for a DBS subject access request want something else, and the something else is usually free, faster, or the only thing that works. A subject access request to the DBS is not a criminal record check and cannot be used as one. The DBS says a request "cannot be treated as, or used to obtain, a police check, disclosure certificate, or certificate of good conduct" and that "the results of a subject access request should not be used for employment purposes". If you need a document an employer will accept, that is a basic DBS check at £21.50, usually processed in about three days. Standard and enhanced checks normally go through an employer or a registered body rather than being something you can apply for yourself. If you want your conviction record itself, the DBS does not hold it — it says "the police own and maintain all information on the PNC". That is a request to the police force that dealt with it, or ACRO Criminal Records Office for the national record. Two deadlines here are shorter than a subject access request will ever be. If something on a certificate is wrong, that is a dispute, and the DBS asks you to report it within 3 months of the date on the certificate. If a certificate never arrived, a reprint has to be asked for within 93 days of issue and no earlier than 14 days after it — and the DBS will not reprint at all where "the certificate has been accidentally lost or destroyed after you received it", so a new application is then the only route. If you have been barred, that is a review by the DBS or an appeal to the Upper Tribunal, and if you are at the "minded to bar" stage the DBS says it will send you a copy of all the information it has relied on so that you can make representations — which may include material a subject access request would redact. What a request does get you is your DBS application details, system notes and correspondence, a copy of what appeared on certificates already issued, and barring referral material held about you. The form also lets you ask for call recordings, though the DBS says the vast majority of its calls are not recorded. Note the result is a snapshot: the DBS says it shows your records "as they were when a DBS application was made", and that only a new check shows current information. It destroys its copy of the result after six months. Requests are free, and the DBS says it "reserves the right to charge a reasonable fee if a request is particularly excessive or repetitive". The DBS Helpline on 03000 200 190 is its general customer services line, open Monday to Friday 9am to 5pm, but the DBS does publish it in its subject access contact details and says requests can be made by telephone. Three other DBS contacts are not the request route: dbsdataprotection@dbs.gov.uk is the Data Protection Officer, where a concern about how a request was handled goes; PO Box 3961, Royal Wootton Bassett SN4 4HF is general customer services; and the disputes team shares PO Box 165 but is a different address block, so do not shorten the address to the PO Box alone. The DBS covers England, Wales, the Channel Islands and the Isle of Man. Scotland is Disclosure Scotland and Northern Ireland is AccessNI.

Made under UK GDPR Article 15, subject to the exemptions in Schedule 2 of the Data Protection Act 2018

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.