Subject Access Request to the Foreign, Commonwealth & Development Office

The Foreign, Commonwealth & Development Office is one data controller for everything its consular staff do, at home and abroad. Its consular privacy notice says the Consular and Crisis Directorate, "including consular teams working in the UK and at British embassies, high commissions and consulates abroad, is part of the FCDO", so a request about something an embassy, high commission or consulate handled — an arrest, a hospital stay, a death, an emergency travel document, an emergency loan, a call to the consular contact centre — is a request to the department in London, not to the post. The department publishes one route for all of it: the Information Rights Unit, by email or by post to the address above. Passports and visas are not the FCDO's records. Its own complaints page says "Contact UK Visas and Immigration if your complaint is about UK visas or contact HM Passport Office if your complaint is about British passports", and the same split applies to a records request: visa, immigration and citizenship files are asked for from the Home Office, and HM Passport Office publishes its own data subject rights request form. What the FCDO does hold is the emergency travel document it issued you abroad, and it says it shares those applications with HM Passport Office. The department publishes two mailboxes and they do different jobs. information.rights@fcdo.gov.uk is the one every FCDO privacy notice names for a subject access request. data.protection@fcdo.gov.uk is the Data Protection Officer's, offered for questions about a notice, for concerns that your data has been mishandled and, in the notices' words, if you "would like to exercise any of your rights" — a request sent there is not lost, but the Information Rights Unit is the desk the department names for access. The telephone number printed beside the DPO's address, 020 7008 5000, is the department's general enquiries line and is not a way to make the request. The FCDO asks that a request include your full name, up-to-date contact details and the date of the request, and "a comprehensive list of what personal data you want to access, including any relevant dates or search criteria to help us identify the data you want". It publishes no list of identity documents and no response time of its own, so the statutory month applies; what to do when a response is late covers chasing it. For a consular case, ask early. The consular notice publishes how long case files are kept once a case is closed: "general enquiries and signposting – 60 days", general assistance 3 years, emergency travel documents 3 years, financial assistance 6 years, Forced Marriage Unit cases 7 years and "cases affecting a minor – up to 21 years", with phone call recordings kept for 3 years. So a call or web enquiry that was answered with signposting may have nothing left to disclose two months later, while a case involving a child is kept for decades. The same notice says that if a British national is arrested overseas for a serious offence the FCDO shares that with ACRO, so part of that record will also sit with ACRO. The department does not hand a consular case to family. Its guidance for people arrested abroad says "The British embassy or consulate will not usually share your personal information with third parties, including with your family, without your consent", and its complaints page asks for "written, signed consent from that person" before it will discuss someone else's case with you. It publishes no separate rule for a representative making a subject access request; those two sentences are the closest it comes. The Forced Marriage Unit is run jointly with the Home Office. Its privacy notice names both departments' Data Protection Officers — data.protection@fcdo.gov.uk and dpo@homeoffice.gov.uk — as the contacts for exercising your rights, does not mention the Information Rights Unit, and says the unit's case data is shared between the two departments. If the person has died, this is not a subject access request: data protection rights end at death, and the FCDO publishes no route for a bereaved family to obtain a consular case file. What it does publish is the registration side. You do not have to register a death abroad in the UK, but you can apply for a consular death registration if you want a UK record of it, and a certificate of a birth or death registered with the FCDO's Overseas Registration Unit is ordered from the General Register Office — not until the November of the following year, or sooner by emailing the unit at Overseas.RegistrationUnit@fcdo.gov.uk with the name, registration date and reference number. FCDO staff, former staff and contractors use the same route; the data-controller notice covers them expressly. Job applicants have a separate recruitment notice that gives the HR mailbox MSUcorres.HR@fcdo.gov.uk, alongside the Data Protection Officer, for exercising rights. Security vetting is done by United Kingdom Security Vetting, which is part of the Cabinet Office and holds the vetting file itself. FCDO Services, the department's trading fund at Hanslope Park, is registered as a data controller separately (Z2813147) and publishes its own request route: email FCDOServices.DataProtectionOfficer@fcdo.gov.uk, or write to the Data Protection Officer, KIM Team, FCDO Services, Hanslope Park (HP71), Milton Keynes MK19 7BH. The department lists seven other bodies that are each "registered as a data controller in its own right" — the British Council, Wilton Park, the Great Britain China Centre, the Marshall Aid and Commemoration Commission, the Independent Commission for Aid Impact, the Westminster Foundation for Democracy and Commonwealth Scholarships — and a request about one of them goes to that body, not to the FCDO. The FCDO was formed in September 2020. GOV.UK says the Foreign and Commonwealth Office and the Department for International Development have "closed" and been "replaced by" it, and its ICO registration dates from 1 September 2020, so a request about something either predecessor held is made to the FCDO.

Made under UK GDPR Article 15, subject to the exemptions in Schedule 2 of the Data Protection Act 2018

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.