Subject Access Request to British Transport Police

Most of the CCTV that recorded you on the railway is not British Transport Police's. The force says: "When travelling on the railway network, you may be subject to CCTV monitoring and body worn video and audio by TFL, Network Rail and Train Operating Companies." BTP has access to well over a hundred thousand cameras on the network, but the recordings belong to the operators, so a request to BTP will not reach station or on-train footage — for that the controller is usually the train operator, Network Rail or Transport for London, each of which you would have to ask separately. What BTP holds itself is its own officers' body-worn video, its own re-deployable CCTV, and the incident and crime reports its officers wrote. British Transport Police polices the railway across England, Wales and Scotland, so which force holds your records depends on where you were rather than where you live. Its guidance says: "You must apply to the police force where it took place. This might mean that you will have to apply to more than one police force." If part of what happened was on the railway and part was not, that is two requests, and the other one goes to the force whose area it happened in. The force is running a live facial recognition pilot on the railway, and if it caught you the clock has probably already run. BTP publishes what it keeps: images that generate an alert are deleted "immediately after using them or within 24 hours", the images and biometric data of people who do not generate an alert are "automatically and immediately deleted", and of the CCTV footage recorded by the facial recognition cameras it says "we keep it for 31 days". That 31 days is about those cameras only. BTP publishes no retention window at all for station CCTV, on-train CCTV or body-worn video, and the one general figure it does publish is for automatic number plate recognition, which it keeps for 90 days. If someone died on the railway, this is not the route and the force does not treat it as one. British Transport Police investigates railway fatalities on behalf of the coroner — in Scotland, the Procurator Fiscal — and the person to contact is the BTP Fatality Investigator or the coroner's officer rather than the information rights team. The force's bereavement booklets say you can ask for a copy of the post-mortem report and for copies of any statement you gave, and note that Family Liaison Officers are not usually appointed to railway fatalities. Check the address you are emailing. BTP publishes two data protection mailboxes on the same page, differing only by the older pnn.police.uk domain. The one above is in the contact block that the force's own right of access section points to. The other, dataprotection@btp.police.uk, appears further down the same notice under custody images, and a 2026 assessment of the facial recognition pilot says data subject rights requests can be forwarded there. If one bounces, use the other. The application is free, though the force notes it can charge "a reasonable fee if a request for access is clearly unfounded or excessive but we agree to fulfil it anyway". Its own pages give the deadline two different ways: "We have one month to respond to your request (or three months in complex cases)" on the request page, and "We usually respond within 30 days. But it can take up to two months extra" on its information rights page. Thirty days is not a calendar month, and the legal position is one month, extendable by two more.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.