Subject Access Request to Cumbria Constabulary

Cumbria Constabulary calls itself both "Cumbria Constabulary" and "Cumbria Police"; the first is the name it uses in its privacy notice and its ICO registration, the second is the one on its website. Both mean the same force. The force asks you to apply online, and it also accepts a request by post, by email, by telephone or in person — its own guidance says "You can request information from us online. You can also make a request by telephone, email, by post, or in person", and lists the price for all of them as free. If you would rather write, the postal address and email above are the ones its privacy notice designates for the right of access, and you can use our free letter template to set the request out. The telephone route needs an extension the field above cannot show. Cumbria publishes it as "101 Option 2 Extension 60025, or (+44) 0300 124 0111 Option 2 Extension 60025". The 0300 number on its own is the force's line for callers from outside the UK, so ask for the extension. Cumbria says it usually answers within one month, and its pages put it four slightly different ways: "within one month of receipt", "within 30 days ... it can take up to two months extra", "one month to respond to your request (or three months in complex cases)", and "we'll respond without undue delay and in any case within one month" for law enforcement processing. If your month passes with no reply, you can check whether the response is complete and read what to do when an organisation does not comply. It asks for two identity documents, in colour — it says it does not accept black and white — and if you are asking for body-worn video, CCTV or a custody photograph it asks specifically for a passport or photo driving licence. You must apply to the force that dealt with you, and Cumbria says so: "You must apply to the police force where it took place. This might mean that you will have to apply to more than one police force." If your dealings were over a county line, its neighbours are Lancashire, Northumbria, Durham and North Yorkshire. For a police certificate for a visa, emigration or residency abroad, Cumbria sends you to ACRO, and for an employer's check to the DBS. Neither is a subject access request — the difference is set out here. A collision report is a separate, chargeable service, not a subject access request. Cumbria charges a non-refundable £46.40 search fee "payable in all cases", £130.70 for a full report of up to 30 pages, £46.50 for an incident log and £118.40 for footage up to two hours of processing including redaction, and says it takes up to 12 weeks from the date payment is received. Your own personal data is free. One warning about that page, because it affects where your information goes. It offers four "email us" links, and three of them point to hqcollisionenquiries at cumbria.police.uk while the fourth — the one in the sentence asking you to email "in the first instance with any enquiries" — points to a near-identical address at a domain that is not the force's, with the dot missing before "police". That domain is registered to somebody else. If you email Cumbria about a collision report, type the address that appears on the force's own downloadable request form rather than clicking the link, and check the domain reads cumbria.police.uk before you send anything about yourself. How long Cumbria keeps things, where it says so: ANPR reads are "stored together with similar data from other forces for one year", with most staff access limited to "a maximum of 90 days from the date it was collected". Live facial recognition data for anyone not on a watchlist is "immediately and automatically deleted"; watchlist images and alerts go "within 24 hours after each day of deployment", and CCTV footage "within 31 days, the same as standard public cameras". Cumbria publishes no retention period for body-worn video. If you want footage from a traffic camera on a motorway or major A road, that is National Highways' and not Cumbria's, and the window is very short: Cumbria says requests "need to be made within five days of the incident" and that the "footage is only kept for seven days". Asking Cumbria to delete a custody image, or your DNA and fingerprints, is a different application with its own waiting periods — ten years after conviction for the two most serious offence groups, six years for other recordable and for non-recordable offences, and after proceedings conclude if you were arrested but not convicted. If a request is refused you can apply again, after a further ten years, a further five years, or "once the next relevant scheduled review period has been carried out or after 12 months (whichever is sooner)" depending on which of those applies to you.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.