Police force
Subject Access Request to City of London Police
What City of London Police holds about you, where to send the request, and what to expect back.
GetMySAR is an independent service and is not affiliated with, endorsed by, or acting on behalf of City of London Police. The contact details below are published so you can make a request yourself free of charge.
Where to send your request
Verified 30 August 2026- Postal address
- Information Management Services Bishopsgate Police Station 182 Bishopsgate London EC2M 4NP
- ICO registration
- ZA549523
- ID they ask for
- City of London Police asks for copies of at least two official documents which between them prove your name, date of birth, current address and signature — for example a driving licence together with a utility bill or bank statement dated within the last three months. It says it does not accept a driving licence and a passport sent together: if you send either of those, you must also send a utility bill or bank statement less than three months old. If your contact with the force was in a former name, it asks for additional documents in that name, such as a marriage certificate or deed poll. It reserves the right to ask for original documents in some cases, and returns them by post. The residential address on the form must not be a PO Box, though you may give a PO Box as an alternative delivery address if you say so when you first apply and supply the box contract or billing details. If you have lived at your current address for less than ten years, the form also asks for your previous addresses covering that period.
Source: City of London Police published information. Organisations change these details — tell us if this is out of date.
Specific to City of London Police
City of London Police covers the Square Mile only. If your dealings with the police happened anywhere else in Greater London, the force holding your records is the Metropolitan Police, a separate data controller with its own request route. If it happened on the railway or in an Underground station — Liverpool Street, Fenchurch Street, Cannon Street, Moorgate and Bank are all in or on the edge of the City — the force is the British Transport Police, a third separate controller. The force's own guidance says you must apply to the force in whose area the incident took place, and that this can mean applying to more than one. If you reported fraud to Action Fraud, this is the right force. Action Fraud has been replaced by the Report Fraud service, and actionfraud.police.uk now redirects to reportfraud.police.uk. That service's privacy information says City of London Police "is the data controller for personal data processed through the Report Fraud service", so a report you made there is held by this force. Report Fraud publishes its own contact details for the same force — data.protection@cityoflondon.police.uk, and Data Protection Officer, City of London Police, PO Box 36451, London EC3A 8PF — and its sentence pointing you at "Subject Access Requests – City of London Police" is not a proper link: it cannot be opened in a new tab or copied, and a plain click lands on a menu page rather than the instructions. If you followed it and got nowhere, the route is the one on this page. Report Fraud asks people living in Scotland to report via 101 instead. There is no online form. You download the force's subject access request form, complete it and post it. The form says it will not be accepted at a police station, although another of the force's pages lists applying in person as one of the ways to apply — the two documents disagree, and post is the one the form itself insists on. A request in writing is valid whatever route a controller prefers, and our free letter template will draft one. Use the contact details on this page rather than the ones printed on that form. It was created on 25 May 2018 and has never been revised since: it names a Commissioner who left the post in 2021, prints an ICO registration number that no longer returns an entry on the Information Commissioner's register, gives two different telephone numbers and two different email addresses four pages apart — one of them on the decommissioned .pnn.police.uk domain — and links an ACRO page that no longer loads. The force's privacy notice, updated 14 July 2026, is the current document. Do not use this route for your criminal record. The force's own form says "If you require a check to be made against your conviction history records (PNC check) DO NOT use this form", and it states separately that it does not provide Police National Computer disclosures for employment vetting. The national record comes from ACRO Criminal Records Office, and a check an employer has asked for is a DBS check. The application is free, and the force says it will normally respond within one month of receiving it. Applying for someone else needs an original signed letter of authority from them, and they must also sign the application form and supply their own identification. The force warns that applications are rejected where the signature does not match the identity documents sent with it. A collision report is a separate, chargeable request and not a subject access request. The force takes up to 16 weeks to release a collision report and up to 28 days for third-party details, and releases either only once the case has closed. If what you want is what the force holds about you, the subject access route is free and faster. One request here can reach further than this force. The privacy notice says City of London Police "acts as a lead contact point for individuals wishing to exercise their data protection rights" in relation to the Asset Recovery Dataset, which it shares with other law enforcement and government bodies including the National Crime Agency and HM Revenue and Customs.
Making a request to a police force
Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes
A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.
The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.
Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.
This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.
What people commonly ask for
- Incident and crime reports where you are named
- Custody records and detention logs
- Intelligence entries and markers held against you
- Body-worn video and 999 or 101 call recordings
- Records of stop and search encounters
Watch out for
- Section 45(4) DPA 2018 lets a force restrict access where disclosure would obstruct an inquiry, prejudice the prevention or detection of crime, harm public security, or affect the rights and freedoms of other people. A restriction has to be necessary and proportionate for the specific information at issue — it is not a reason to refuse the request as a whole, and the ICO's guidance on restricting the right of access under Part 3 sets out the test a force is supposed to apply.
- Ongoing investigations are the most common ground for withholding. Records may become disclosable once proceedings conclude, and a force can tell you when it is worth asking again.
- A force can refuse to confirm or deny that it holds anything at all, where confirming would defeat the purpose of the restriction. That is a recognised answer rather than an administrative failure.
- Two exemptions sit alongside those restrictions: legal professional privilege — in Scotland, confidentiality of communications — which covers legal advice the force has taken, and safeguarding national security.
- If a force does withhold something, it must normally tell you within a month that it has done so and why, and tell you that you can complain to the force, complain to the ICO, or ask a court to enforce the right. Silence is not one of the options.
- Body-worn video and CCTV often contain other identifiable people, so expect redaction or blurring rather than full disclosure. And the right reaches your own personal data only — section 45 entitles you to personal data concerning you — so it is not a route to a recording of someone else, or to footage of an incident you had no part in.
- Records about someone who has died are not a subject access request — data protection rights end at death, and unlike health records there is no Access to Health Records Act equivalent for policing. ACRO points people to a Freedom of Information request to the force that dealt with the matter. That is a different law with different tests, and the duty of confidence survives death, so it is the right door rather than a guaranteed answer.
- It is a criminal offence under section 184 of the Data Protection Act 2018 for an employer, or for anyone providing goods, facilities or services to the public, to require you to obtain your own police record through a subject access request as a condition. Schedule 18 defines the records this covers by the bodies that hold them, and a record of a conviction or caution obtained from a chief constable is one of them. A job, a tenancy or an insurance policy made conditional on you producing your record this way is the offence, not a formality.
Your rights, whoever you are asking
Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.
Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.
Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.
How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.
If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.
Send it to City of London Police
You can do this yourself for free using the details above. If you would rather not handle the wording, the submission and the chasing, GetMySAR prepares, sends and follows up your request for a fixed £20 fee.
This page is general information about your right of access under UK data protection law. It is not legal advice. If your situation is complex or contested, consider speaking to a solicitor or contacting the Information Commissioner’s Office.