Subject Access Request to HM Prison and Probation Service

HMPPS is an executive agency of the Ministry of Justice and is not a separate data controller. Its own personal information charter says so in a single sentence: "As an executive agency of the Ministry of Justice, the MOJ personal information charter explains how we deal with requests for personal information." Its prisoner privacy notice is blunter — "The MoJ is the data controller for the personal information we hold in HMPPS." So the request is made to the MoJ, and the Ministry of Justice page covers the department's other records. The registration number above is the MoJ's; HMPPS has none of its own, and the ICO register does not mention HMPPS at all. Prison and probation records use a different inbox and a different address from the rest of the MoJ, and the MoJ publishes them under its own heading for HMPPS: data.access1@justice.gov.uk — note the "1" — or the Branston Registry. The address without the "1", data.access@justice.gov.uk, is the central Disclosure Team and is the wrong desk for a prison or probation record. HMPPS's own prison visitors notice gives the version without the "1", so both appear on HMPPS documents; use the one with it. The online service names the record systems. The Prison Service holds "security and NOMIS records about time spent in prison" and the Probation Service holds "electronic case notes (nDelius) about time on probation". Naming the system, the prison and the dates helps. The MoJ asks for the full name, date of birth, prison number and the name of the prison the person is currently held in, or the last prison for someone who has been released. If you are in prison now, you do not need any of that. HMPPS's prisoner privacy notice says to "Speak to a member of staff in your prison, who will discuss with the prison Information Access Representative (IAR) / Knowledge and Information Liaison Officer (KILO)", and the Youth Custody Service notice says to contact the local Information Access representative in your establishment. If you are on probation, the probation notice says to speak to your Offender Manager, and gives the email as the alternative. A request from a prisoner or a probation service user cannot be delayed the way an ordinary one can. The Information Requests Policy Framework, published jointly by the MoJ and HMPPS, says the time to respond "cannot be extended under Part 3 of the DPA which covers SARs from offenders where the processing is for law enforcement purposes", and that "This extension does not apply to SARs made by offenders". For staff, former staff and members of the public it says a complex request "can be extended by up to two months under General processing in Part 2 of the UKGDPR". The online service is looser than the framework, telling you to "expect the results back within 30 days" — 30 days and one calendar month are not the same period, and the framework's month is the one the law sets. If the records are about somebody who has died, this is not a subject access request — rights end at death. The same framework says "The laws do not cover information held on the deceased. Requests for such information would be handled under FOIA or considered under the common law of confidentiality", and that a request from a deceased person's next of kin through a legal representative before an inquest is handled under the Freedom of Information Act, which is answered in 20 working days. Where an inquest has not yet been held, HMPPS says disclosure is normally managed by the coroner. Deaths in custody, of people recently released and of residents of approved premises are investigated by the Prisons and Probation Ombudsman, which shares its report with the family. Two things people look for here that a subject access request cannot do. To find out which prison someone is in, GOV.UK's apply to find a prisoner's location service is free, needs the prisoner's permission and replies within 4 weeks. For a copy of a criminal record, that is a basic DBS check, or ACRO for what is held on the Police National Computer — the police hold those records, not HMPPS. HMPPS's four published privacy notices are old. All of them still say "Her Majesty's", and the probation one is titled for the National Probation Service, which stopped existing as a separate body in 2022. The prisoner notice was written in 2018 and the probation notice in 2019. Where they differ from the MoJ charter, the charter is the current source.

Made under UK GDPR Article 15, subject to the exemptions in Schedule 2 of the Data Protection Act 2018

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.