Subject Access Request to Bedfordshire Police

Bedfordshire Police's website is at beds.police.uk. Its data protection work is not done in isolation: Bedfordshire, Cambridgeshire and Hertfordshire run a strategic alliance, and one shared Information Rights Unit at Bedfordshire Police Headquarters handles all three. Bedfordshire is the force that unit sits inside, so the address above is genuinely its own building rather than a partner's. The three remain separate controllers — the shared privacy notice says the Chief Constables "are registered as the data controllers for their respective forces" — so a request about something that happened in Bedfordshire is a request to Bedfordshire Police. Check the registration number on the force's own data protection page against the one above, because they do not match. That page says "This last part applies to Bedfordshire Police" and then gives the number as Z4882190, which the Information Commissioner holds for the Chief Constable of Cambridgeshire Constabulary. Bedfordshire's own is Z4882156. It is one shared page rather than one force's slip: all three alliance sites publish it with the force name changed and the number left alone, and only Cambridgeshire's is right. It matters more than a typo, because the Cambridgeshire registration expires in September 2026 and Bedfordshire's runs to September 2027 — anyone checking this force's status from its own page is looking at the wrong force's entry and at a registration about to lapse. The email address above is on a legacy police domain, on a notice the force says it last updated in August 2021, and it is the only data protection mailbox published anywhere on the site. Every other team uses a current address — facial recognition, legal disclosure, the museum and volunteering all end beds.police.uk. The unit itself is current: the force's 2025 facial recognition assessment names the same head of information rights. If an email bounces, use the online form or write to the postal address rather than guessing at a newer address. The postal address above names an individual, because that is how the privacy notice publishes it, and it is the address the notice's right of access section points at. The force's own 2025 facial recognition assessment gives that person a different job title, "Head of Information Rights and Assurance", so the notice's title is out of date and the person is not. The publication scheme page gives the same building addressed to a department — "Information Rights Department, Bedfordshire Police HQ, Woburn Road, Kempston, Bedfordshire, MK43 9AX" — but scopes it to copies of published information rather than to your own records, so use it only if you would rather not write to a named person. The force asks you to make the request through its online form, and it is free unless it decides a request is clearly unfounded or excessive. Its own guidance offers a request "by telephone, email, by post, or in person" and then gives no number for any of them — the contact details above come from the privacy notice instead. If you would rather write than use the form, our free letter template produces a letter you can send. The force publishes three different response times across three pages: one month, or three months in complex cases, on the page in front of the form; "usually within 30 days" plus up to two months extra on its information rights page; and normally one month from receipt in the privacy notice. Thirty days is not a calendar month. One month, extendable by up to two more, is the statutory position. If the force handles your request badly, note where its own page sends you. Its data protection page routes a complaint about a request straight to the Information Commissioner's Office by post, with no internal stage first. You are entitled to complain to the force as well, and doing that first is usually faster. Arrests, cautions and convictions sit on the Police National Computer nationally, and the force says those requests go to ACRO Criminal Records Office, free, rather than to it — as do requests to delete DNA or fingerprints. A check an employer has asked for is a DBS check, and requiring you to make a subject access request instead is an offence; the force states that in its own words. A request to Bedfordshire returns what it holds locally: incident reports, custody records, body-worn video, 999 and 101 recordings. If you think live facial recognition caught you, ask quickly. The force publishes its deployment dates in advance, and both its public page and its 2025 impact assessment say images of people who do not match the watchlist are deleted immediately and irretrievably, that an image which does generate an alert is kept for a maximum of 24 hours, and that the underlying mobile CCTV footage is deleted within 31 days unless it has to be kept for an investigation or a complaint. Video you share with the control room through its GoodSAM service goes after 31 days if it does not form part of a case. The force publishes no retention period at all for body-worn video, and a custody photograph is not deleted automatically — you have to apply. The force does not publish its retention schedule, its subject access policy or its subject rights procedure, but it lists all three as documents you can ask for, so it is worth requesting the retention schedule alongside your data. A collision report is a separate, chargeable route and not a subject access request. The force says fees are payable and that it will confirm them once you get in touch, warns that a request can take from a few weeks to months, and releases a report only once the case has concluded. A subject access request for what the force holds about you is free. Other forces are listed on the police subject access request page.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.