Subject Access Request to the Ministry of Justice

Which record you want decides where the request goes. The Ministry of Justice's own online service covers the Prison Service, the Probation Service, the Office of the Public Guardian and the Legal Aid Agency. Prison and probation records use a different inbox and a different address from the rest of the department: data.access1@justice.gov.uk — note the "1" — or the Branston Registry, Building 16, S & T Store, Burton Road, Branston, Burton-on-Trent, Staffordshire, DE14 3EG. Send the full name, date of birth, prison number and the name of the prison. Court and tribunal records are the exception, and the exception is about the online form rather than about the MoJ. The service says "Do not use this service to request information or documents from Courts or Tribunals (HMCTS)" and that a request made that way "is likely to be refused". HM Courts and Tribunals Service's own privacy policy still points court and tribunal requests at the same Disclosure Team by email or post, so use those rather than the form, or contact the court that heard the case using Find a court or tribunal. A subject access request cannot reach a judicial decision or a judge's notes either way, because the Data Protection Act 2018 puts those outside the right of access altogether. A subject access request is the wrong tool for several things people commonly want from the MoJ. For a transcript of what was said at a hearing, use form EX107 and expect to pay, though sentencing remarks are free for bereaved families in homicide cases and for victims of rape and sexual offences. For a copy of your criminal record, apply for a basic DBS check — the police hold those records, not the MoJ — and for records held on the Police National Computer, that is ACRO. Criminal injuries compensation claims are not held by the MoJ at all. The Criminal Injuries Compensation Authority is separately registered with the Information Commissioner's Office as its own data controller, at 10 Clyde Place, Buchanan Wharf, Glasgow G5 8AQ. A prisoner's or probation service user's request cannot be delayed the way an ordinary one can. The MoJ's own policy says the response time "cannot be extended under Part 3 of the DPA which covers SARs from offenders where the processing is for law enforcement purposes". If the records you want are about somebody who has died, this is not a subject access request — data protection rights end at death. Deaths of prisoners, of people recently released, and of residents of approved premises in England and Wales are investigated by the Prisons and Probation Ombudsman, which shares its report with the family.

Made under UK GDPR Article 15, subject to the exemptions in Schedule 2 of the Data Protection Act 2018

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.