Subject Access Request to ACRO Criminal Records Office

ACRO's subject access request covers the Police National Computer, and nothing else. Its disclosure shows arrest details, impending prosecutions, convictions, non-convictions such as penalty notices, cautions, final warnings and reprimands, no further action and not guilty disposals, disqualified driving disposals, and firearms certificate details. It covers forces in England, Wales and Northern Ireland, Jersey, the Isle of Man and the British Transport Police. ACRO states plainly what it will not send you: custody photographs, body worn video, custody logs, statements you made, statements others made, interview details, and incident reports about crimes you reported. ACRO calls these local information and says they have to be requested from the force that dealt with the matter. If that is what you are after, this is the wrong request. ACRO is not itself a data controller. Its own privacy notice says it is a data processor acting for the 43 police forces that are party to the ACRO Collaboration Agreement made under section 22A of the Police Act 1996, and that it is hosted by Hampshire and Isle of Wight Constabulary, which is the force registered with the ICO (registration Z4886192) and whose Superintendent heads ACRO. There is no ICO registration in ACRO's own name, and the controller of any particular entry on your record is the force that created it, so no single registration number belongs on this page. There is no email address for making a request. ACRO asks you to use its online form, which it describes as seven pages that cannot be saved unless you register for an account first. It publishes a separate postal address for subject access request post, above, which is a different PO Box from its general correspondence address. A subject access request is not the way to get something removed. Early deletion of an arrest, caution or other event from the PNC, the National DNA Database or IDENT1 goes through the Record Deletion Process, which is free, uses a different form, and is emailed to deletions@acro.police.uk. ACRO only logs those applications; the force that owns the record decides. Court convictions, and conditional or absolute discharges, are not eligible at all. If you think what is recorded is wrong rather than that it should be deleted, that is a rectification request to the force that owns the data, not to ACRO. Requests about someone who has died are not subject access requests, and ACRO says a Freedom of Information request to the relevant police force is the route instead. Records held in Scotland sit on the Criminal History System and come from Police Scotland; a deletion request for a record owned by Police Scotland or the Police Service of Northern Ireland has to go to that force directly. ACRO accepts a request made on someone else's behalf only from a parent with parental responsibility for a child under 13, someone holding power of attorney, or a legal representative with a signed letter of authorisation. Otherwise the person the records are about completes the form themselves. The phone number above is ACRO's customer services desk, open Monday to Thursday from 10am to 2pm UK time. ACRO names it as the route to use if you cannot apply online, and it also handles police certificate and ICPC queries. ACRO warns that it is currently taking a high volume of calls and that a call still queueing when the lines close at 2pm will not be answered. If you have been asked for an ACRO police check or police clearance for a visa, emigration or a job abroad, that is a police certificate and not this request. The certificate is chargeable, shows convictions, cautions, reprimands and warnings filtered through ACRO's step-down model, and is the document an embassy or high commission will accept. A subject access request is free and shows more, but ACRO says a subject access disclosure is for personal use only and cannot be used for other purposes such as proving your criminal record history. Neither one substitutes for the other. A certificate that came back "No Live Trace" is a common reason for making this request. ACRO defines "No Trace" as meaning the data subject has no convictions, cautions, final warnings or reprimands, and "No Live Trace" as meaning the data subject has a criminal record which does not appear on the certificate because it has been stepped down. ACRO says an applicant who receives a No Live Trace or Trace Stepped result also gets an additional print containing the offence information. If you want the whole of what is held rather than what the certificate prints, the subject access request is the route to it.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.