Police Subject Access Request

A force holds what its own dealings with you generated. If you reported a crime, were arrested, were stopped and searched, were a witness or a victim, or were filmed on body-worn video, that material sits with the force that was there — not on any national system.

You apply to the force in whose area it happened. If incidents happened in different places, that is more than one request. London has two territorial forces: the Metropolitan Police covers almost all of Greater London, and the City of London Police covers the Square Mile and is a separate organisation with its own route. The British Transport Police covers the railway network rather than a geographic area.

Requests to a force are made under Part 3 of the Data Protection Act 2018 rather than the UK GDPR, because a force is a competent authority processing your data for law enforcement purposes. You are still entitled to a copy of your personal data; the difference is that the grounds on which a force can restrict what it sends you are broader. Each force page below sets out that force’s own route and what it asks for.

If you have not made one before, what a subject access request is covers what you are entitled to ask for, and our free letter template gives you the wording to send a force yourself at no cost.

• ACRO Criminal Records Office→
• Avon and Somerset Police→
• Devon and Cornwall Police→
• Essex Police→
• Greater Manchester Police→
• Kent Police→
• Lancashire Constabulary→
• Merseyside Police→
• Northumbria Police→
• Police Scotland→
• PSNI→
• South Wales Police→
• South Yorkshire Police→
• Surrey Police→
• Sussex Police→
• Thames Valley Police→
• the Metropolitan Police→
• West Midlands Police→
• West Yorkshire Police→

We publish a force page only once its route has been checked against what that force itself publishes. If the force you need is not listed, its own website will have a data protection or “request information” page, or you can start a request and we will find the right route.

England, Wales and Northern Ireland. The Police National Computer record is handled by ACRO Criminal Records Office, and a subject access request to ACRO is free. It shows arrest details, impending prosecutions, convictions, and non-convictions such as cautions, penalty notices, final warnings, reprimands, no-further-action and not-guilty disposals, along with disqualified driving disposals and firearms certificate details. It also covers Jersey, the Isle of Man and the British Transport Police.

ACRO is explicit about what it will not send you: custody photographs, body-worn video, custody logs, statements you or anyone else made, interview details, and reports of incidents you reported. It calls those local information and says they have to be requested from the force that dealt with the matter. If that is what you are after, ACRO is the wrong request.

Scotland. Scottish records sit on the Criminal History System rather than the PNC, and the request goes to Police Scotland. Police Scotland says roughly half of all the subject access requests it receives are from people who want their criminal record, and its form has a box for exactly that.

Both routes are free and you can use them yourself — the links above go to the pages that take the request. If you would rather not handle the wording and the chasing, we can prepare and send it for you, and how that works sets out what we do at each stage.

A subject access request tells you what is held about you. It does not produce a document an employer, a licensing body or an embassy will accept, and asking for one instead of a certificate is the single most common wasted month on this subject.

It also shows you more than a certificate would, which is the part people do not expect. ACRO says that convictions you believe to be spent will still appear on a subject access disclosure, and that criminal records shared with the UK by overseas authorities may appear on it too. A disclosure is meant for your own use, and handing it to an employer shows them things a proper check would have filtered out.

It is a criminal offence for an employer, a prospective employer or a recruitment agency to require you to make a subject access request as a condition of employment or of providing goods or services. This is called enforced subject access, and it is an offence under section 184 of the Data Protection Act 2018. ACRO says in terms that it can be reported to ACRO, which will refer it to the Information Commissioner’s Office — so there is somewhere to take it if it happens to you.

• England and Wales — a DBS check. You can apply for a basic check yourself, which costs £21.50 and shows unspent convictions and conditional cautions. Standard and enhanced checks normally have to be requested through an employer or a registered body. The DBS says a basic check takes about three days on average. A check is not the same thing as asking the DBS what it holds about you — that is a subject access request to the DBS, which returns your application and barring records but cannot be used as a criminal record check.
• Scotland — Disclosure Scotland. The products changed on 1 April 2025 under the Disclosure (Scotland) Act 2020, and the levels that replaced them are set out on mygov.scot: Level 1 replaced basic disclosure and shows unspent convictions, Level 2 replaced most standard disclosures, and Level 2 with a barred list check replaced most enhanced ones. Guidance written before that date — including some still published by public bodies — uses the old names.
• Northern Ireland — AccessNI. Basic, standard and enhanced checks still exist there. An individual can apply for a basic check directly; standard and enhanced checks have to be countersigned by a registered organisation. If the records you want are the police’s own — incident reports, custody records, body worn video — that is a subject access request to PSNI, not a certificate.
• A visa, emigration, residency or citizenship abroad — an ACRO police certificate. This is a different ACRO product from the free subject access request above, and it is chargeable. GOV.UK now points people to ACRO for it directly. Check the fee on ACRO’s own police certificate page, which also carries its current processing times: the figures printed on some GOV.UK pages have been out of date.

• Disclosure for family court proceedings. This needs a court order, and forces charge a fee before they will consider it. The Met, for example, requires a Private Law Police Disclosure Order and an initial payment made through GOV.UK. A subject access request will not produce it.
• Getting something removed from your record. That is not a subject access request either. Early deletion of an arrest, caution or other event from the PNC, the National DNA Database or IDENT1 goes through ACRO’s free Record Deletion Process, on a different form. ACRO only logs the application — the force that owns the record decides. Court convictions and conditional or absolute discharges are not eligible at all.
• Correcting something that is wrong. That is a rectification request, and it goes to the force that owns the data, not to ACRO.
• Information about the force rather than about you — policies, statistics, how a decision was made in general — is a Freedom of Information request, which is a different law and a different team.
• Records about someone who has died. Data protection rights end at death, so this is not a subject access request. ACRO points people to a Freedom of Information request to the relevant force instead. Our own form does not accept requests about people who have died.

A subject access request to the police is free. A force may only charge where a request is manifestly unfounded or excessive, or where you ask for further copies.

The deadline is one month. A force can extend by up to two further months where the request is complex or you have made a number of requests, but it has to tell you within the first month that it is doing so, and why. Two forces on this site currently publish delays beyond that: Police Scotland states a wait of up to nine months, and the Met warns of a large backlog. Those are the forces describing their own queues, not estimates.

The single thing you control is scope. A request for “everything you hold” is slower and more likely to come back partial. Say what contact you had — whether you reported something, or were a witness, a victim or an accused — roughly when, and where. Police Scotland says in terms that it cannot research vague requests, because policing data sits across a large number of separate systems.

A force can restrict what it sends you where that is necessary and proportionate — to avoid obstructing an inquiry, to avoid prejudicing the investigation or prosecution of an offence, to protect public security, or to protect other people’s rights. It can also refuse to confirm or deny that it holds anything. What it cannot do is refuse because a request is inconvenient or because proceedings are ongoing, and if it does withhold something it must normally tell you within a month, with reasons, and tell you that you can complain to the force, complain to the Information Commissioner’s Office, or go to court.