Subject Access Request to the Civil Nuclear Constabulary

The Civil Nuclear Constabulary guards sites rather than an area, so most police records about an ordinary incident are not its. It protects licensed civil nuclear sites and nuclear material in transit, and since 1 April 2025 it has also provided "continued armed police protection at specific energy infrastructure"; it describes itself as policing "other, non-nuclear critical infrastructure" as well. What it does not do is general policing of the surrounding area. Its own charter says it "processes minimal Criminal Offence data as this is handled by the host Home Office Forces within whose area the sites policed by the Constabulary are based", and that it works in partnership with the appropriate Home Office force or Police Scotland at each site. So if you were arrested, charged, cautioned or interviewed, the force that dealt with you is almost certainly the territorial one — work out which force to ask — and the national criminal record is a separate request again to ACRO. Much of what this force holds about individuals is about its own people and the people who applied to join. Its charter lists its lawful bases for "employees (officers and staff, current and prospective)" first and covers occupational health records separately, so personnel, vetting, recruitment and occupational health files are among the records a request here is most likely to reach — and the Constabulary says its application process is thorough because of "the high security nature of our work". Officers and staff are employed by the Civil Nuclear Police Authority under the Energy Act 2004, but the Authority publishes no privacy notice, no personal information charter and no data protection contact of any kind; the Constabulary's own data protection policy says "The Data Controller for the Constabulary is the Chief Constable", so a request about a CNC file goes to the address on this page. The email address does not appear on the Constabulary's own page as text, and its pages give three different ones. Its personal information charter — the newest of them — says "To make a subject access request, or to exercise any of your data subject rights, send us an email or write to", and the address sits behind the words "send us an email", so copying it off the page gets you nothing. It is subject.access.request@cnc.police.uk, and it is the box the Constabulary's own procedure assigns to the Disclosures Officer, the same desk as the postal address above. But the page that charter links as "find out more about your subject data rights" closes by saying "For all requests above please email data.protection@cnc.police.uk", and the list of requests above it includes the right of access; that address is also the Data Protection Officer's, for complaining about how your information was handled, and the one the 2022 body-worn video guidance gives for footage. A 2017 page about stop and search gives a third, subjectaccessrequest@cnc.pnn.police.uk, and cites the Data Protection Act 1998, which was replaced in 2018. All three reach the same small force in one building. Use the first; if it bounces, the others are live. Body-worn video is the only record this force publishes a retention period for, and hardly anyone asks. Footage "is automatically deleted after 31 days if not needed", and only what is kept as evidence survives that; the force says it can "blur or mask it if redaction is required to protect the rights and freedoms of any third parties". In a Freedom of Information response it said it had received no subject access requests for body-worn video at all since 1 January 2015 — the number received and the number granted were both "None". No retention period is published for CCTV, custody images or automatic number plate recognition. The Constabulary states the deadline and the fee itself: "The CNC have one month to respond to a request and cannot charge a fee to deal with a request in most circumstances." On refusals it publishes only a general position — "There are also some circumstances where your rights cannot be exercised because exemptions will apply. We will explain this in our response to you." Despite guarding nuclear sites it publishes no blanket national-security or nuclear-security refusal anywhere. It describes the right of access as Article 15 and mentions Part 3 of the Data Protection Act 2018 and section 45 on no page at all, so expect it to answer in the general terms its own pages use. The request is free, the legal deadline is one month, extendable by two more, and if what comes back looks thin you can check the response against what the law requires. Two neighbours are easy to mistake for this force. Sites "used wholly or mainly for defence purposes" are excluded from its remit by section 52 of the Energy Act 2004 and are policed by a different force with its own records. And the site operator — the company running the power station or the reprocessing plant — is a separate controller again for its own site access, pass and camera records; a request to the Constabulary reaches only what its own officers generated. Sites "used wholly or mainly for defence purposes" are excluded from the Constabulary's remit by the Energy Act, and are policed by the Ministry of Defence Police, which keeps its own records and takes requests through a different route.

Made under the Data Protection Act 2018 and Article 15 of the General Data Protection Regulation, which is how the Constabulary describes it

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.