Subject Access Request to Cambridgeshire Constabulary

The address and email address above are in Bedfordshire, and that is correct. Cambridgeshire, Bedfordshire and Hertfordshire run a strategic alliance with one shared Information Rights Unit at Bedfordshire Police Headquarters, and Cambridgeshire publishes no data protection mailbox, telephone number or postal address of its own — every route leads there. The three remain separate controllers, so a request about something that happened in Cambridgeshire is still a request to Cambridgeshire Constabulary. Unlike its two partner forces, Cambridgeshire publishes its own registration number correctly. If you are checking the alliance, note that Bedfordshire's and Hertfordshire's data protection pages both print this force's number, Z4882190, as their own — so a number that is right here is wrong on the other two sites. The email address above is on a legacy police domain, on a notice the force says it last updated in August 2021. The unit is current: the force's April 2026 facial recognition assessment names the same head of information rights, though with a different job title from the one the notice gives. If an email bounces, use the online form or write to the postal address rather than guessing at a newer address. The force asks you to make the request through its online form, and it is free. Its own guidance says a request can also be made "by telephone, email, by post, or in person" and then names no number, no mailbox and no address for any of them — the contact details above come from the privacy notice instead. If you would rather write, our free letter template will draft the letter. Two of your other rights are harder to use than this one. The force's pages for objecting to processing and for restricting it offer only "verbally" or "by post" as ways to apply, with no online form, no telephone number and no address given — so if you want either, use the contact details above and say which right you are exercising. If you think live facial recognition caught you, ask quickly. The force says images of people who do not match its watchlist are deleted immediately and irretrievably, that an image which does generate an alert is kept for a maximum of 24 hours, and that the mobile CCTV footage from a deployment is deleted within 31 days. Its own impact assessment records the 24-hour window as a risk that the force "may be unable to comply with a subject access request". Video you send the control room through GoodSAM goes after 31 days if it does not form part of a case, and automatic number plate recognition data is kept for a year. The force publishes no retention period at all for body-worn video or for its own CCTV, and no retention schedule — though it will send you the national one if you ask. The force's pages give the deadline three different ways: one month in the privacy notice, "one month, or three months in complex cases" on the page in front of the form, and "usually within 30 days" plus up to two months extra on its information rights page. Thirty days is not a calendar month, and the legal position is one month, extendable by two more. A collision report is a separate, chargeable route and not a subject access request — and although the page is Cambridgeshire's, the request goes to a partner force's mailbox. The force says fees are payable and that it will confirm them once you get in touch, publishes no figure, and releases a report only once the case has concluded. Records for family court proceedings, by contrast, go through this same subject access route and carry no fee. Your national criminal record and a police certificate for a visa come from ACRO rather than from this force, and a check an employer has asked for is a DBS check — requiring you to make a subject access request instead is an offence, which the force states in its own words. Other forces are listed on the police subject access request page.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.