Subject Access Request to the National Crime Agency

A request to the NCA is not made under the same law as a request to most organisations. The NCA says of its own processing that "The NCA processes personal data for law enforcement purposes as defined in Section 31 Data Protection Act 2018", and section 31 sits in Part 3 of that Act, the law enforcement part. It also processes for non-law-enforcement purposes, naming recruitment and vetting of its own staff, and those records sit under the UK GDPR instead. A subject access request is not a way to find out whether you are under investigation, and the NCA says so directly: "If you are unaware of whether or not you are under investigation by the NCA then it is extremely unlikely that you will receive confirmation through the subject access process. The NCA investigates individuals without their knowledge to ensure investigations can progress uninhibited; if your request relates to whether or not you are under investigation you will be likely to receive a 'neither confirm nor deny' response." The NCA adds that this same answer is given whether or not it holds anything, and that the Statutory Disclosure Team "will provide no further clarification regarding this response in either circumstance". Nothing about a neither-confirm-nor-deny answer tells you which of the two it is. The NCA publishes three data protection mailboxes and only one takes requests. StatutoryDisclosureTeam@nca.gov.uk is the address it names for exercising your rights. DPO@nca.gov.uk is the Data Protection Officer, published for complaints and general queries, and it is also the address on the ICO register. DataProtection@nca.gov.uk is the Data Protection and Privacy team, which the NCA says manages its data protection compliance. Send a request to either of the last two and it has to be passed on. The address the ICO register gives, PO Box 8000 London SE11 5EN, appears in no NCA document and is not the request route. The NCA says it will answer "without undue delay, and before the end of one month of receipt of the request", and that the month "may be extended by a further two months where requests are complex or numerous", with notice inside the first month if it is extending and why. If it refuses, it says you will be told the reason in writing within a month and "given details of how to complain to the supervisory authority", which is the Information Commissioner's Office. It answers free of charge unless the request is manifestly unfounded or excessive, or you ask for further copies. Expect less than a whole file. The NCA says you are "unlikely to receive policy documents or details related to NCA priorities, functions, or activities, even where this is already in the public domain", because that is not personal data, and that redacted material may appear as XXXX. Its notice for young people is blunter still about what falls outside a request: information about other people, "specific documents", and anything that "would affect our ability to detect and prevent crime". The NCA publishes an application form and guidance notes, and says you do not have to use the form — but you do have to give enough detail to find the records. Its own examples are notebook entries and decision logs relating to a named arrest, or the file on a complaint you made about the NCA. A request it considers too broad is sent back to be narrowed, and if it asks for more detail and hears nothing for three months it closes the case without telling you. Several things people ask the NCA for go somewhere else, and the NCA's own form says where. A disclosure for employment purposes goes to the Disclosure and Barring Service in England and Wales, or Disclosure Scotland or AccessNI. Police National Computer data — the national record of arrests, cautions and convictions — goes to ACRO. Europol data can be asked for through the NCA, which acts only as an intermediary and forwards the request, and Europol then answers you directly within three months. Interpol material beyond what NCB Manchester holds locally goes to the Commission for the Control of INTERPOL's Files. It is a criminal offence under section 184 of the Data Protection Act 2018 for an employer, a prospective employer or anyone supplying goods or services to require you to make a subject access request and hand over the result. Schedule 18 to that Act names the Director General of the National Crime Agency among the bodies whose conviction and caution records count for that offence, so an NCA disclosure is squarely within it. Which police record do you need sets out what to do about it and where a proper criminal record check comes from instead. At the NCA, "SAR" usually means something else entirely. A Suspicious Activity Report is the money-laundering report that banks and other regulated businesses file with the UK Financial Intelligence Unit inside the NCA, through the SAR Portal, and it has nothing to do with your right to see your own data. If you are looking for the SAR Portal you are on the wrong page.

Made under the Data Protection Act 2018 and the UK GDPR — the National Crime Agency says it processes personal data for law enforcement purposes as defined in section 31 of that Act

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.