Subject Access Request to HM Courts and Tribunals Service

HM Courts and Tribunals Service is an executive agency of the Ministry of Justice, and the MoJ is the data controller for everything HMCTS holds. That does not mean court and tribunal records have no route. The MoJ's online Request Personal Information service says "Do not use this form to request information documents from the courts (within HMCTS)", and the department's charter says such a request "is likely to be refused" — but both statements are about the online form. HMCTS's own privacy policy, updated 11 June 2026, tells you to make a subject access request to the Disclosure Team at 102 Petty France by post or to data.access@justice.gov.uk by email, and its privacy notices for family, civil, tribunal and Court of Protection forms each give the same email address. The MoJ charter adds a second route for these records: contact the court or tribunal that handled the case, using Find a court or tribunal. What a request cannot reach is anything the judge did. HMCTS's privacy notices say they do not apply to personal data "collected and controlled by the court (and its judges) during legal proceedings", and the judiciary's own notice says the rights "do not apply where your personal data is processed by the judiciary exercising judicial functions". So the administrative side is reachable — case and claim files held by the court office, listing and fee records, correspondence, and the telephone, email and webchat records a Courts and Tribunals Service Centre keeps — while a judge's notes, the material a judge controls during proceedings and the reasons behind a decision are not. For those the judiciary points instead to the rules of court: the Civil, Family or Criminal Procedure Rules, or the Tribunal Procedure Rules. That is an application to the court, not a subject access request. One consequence is worth knowing before you complain. The judiciary's notice says that where the judiciary are exercising judicial functions the Information Commissioner has "no supervisory authority", so a complaint about that processing goes to the Judicial Data Protection Panel, through the Judicial Office Data Privacy Officer at 11th Floor Thomas More Building, Royal Courts of Justice, London WC2A 2LL, or JODataPrivacyOfficer@judiciary.uk. A complaint about how HMCTS handled your request goes to the Information Commissioner in the normal way. HMCTS's own link to that judiciary notice is broken — it is published without "https://" on its court and tribunal privacy notices, so it resolves against the GOV.UK path and lands on a "Page not found" — so use the judiciary's data protection privacy notice directly. Several of the things people want from a court are quicker by a different route, and a subject access request will not produce them. A record of what was said at a hearing is a transcript, applied for on form EX107 with a fee that depends on length; sentencing remarks are free for a family member of a victim of murder, manslaughter or a death on the road, and for victims of rape and sexual offences, with a decision within 20 working days. Hearings at magistrates' courts are not recorded, so there is no transcript to ask for. A replacement final order or decree absolute has its own application to the court that dealt with the divorce. A grant of probate or a will is on the probate record search, free to search and £16 for a copy. HMCTS covers England and Wales, plus some non-devolved tribunals in Scotland. Courts and tribunals in Scotland are run by the Scottish Courts and Tribunals Service and in Northern Ireland by the Northern Ireland Courts and Tribunals Service; both are separate data controllers, and a request sent here will not reach them. Data protection rights end at death, so a request for the court records of someone who has died is not a subject access request. A will or grant of representation is on the probate record search above, and a bereaved family member in a homicide case can apply for the sentencing remarks free. Prison and probation records use a different inbox and a different address — those are on the HM Prison and Probation Service page — and Office of the Public Guardian and Legal Aid Agency records go through the department's online form, which is the one that turns court requests away; both are covered on the Ministry of Justice page. If your case was in the family court, the welfare reports and case records made by the children's guardian or family court adviser belong to Cafcass, not to the court, and the local authority's own file is a social services records request. For your criminal record, the police hold those records, not HMCTS. HMCTS does not hold an ICO registration of its own. The Ministry of Justice is the data controller and is registered as Z5679958, at the same 102 Petty France address.

Made under UK GDPR Article 15, subject to the exemptions in Schedule 2 of the Data Protection Act 2018

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.