Subject Access Request to Dorset Police

Dorset Police runs subject access through an Alliance Data Protection unit shared with Devon and Cornwall Police, under a strategic alliance the two forces entered in March 2015. The two remain separate data controllers with separate ICO registrations; only the function is shared. The force's website calls the unit the Alliance Data Protection Office and the alliance's own policy calls it the Alliance Data Protection Team. The online form is the route Dorset puts first, and the force says a request can also be made by telephone, email, post or in person — although it publishes no telephone number for making one. A request is free, and you can write it yourself rather than paying anyone to prepare it. Two email addresses reach the same desk. Dorset's privacy notice publishes dataprotectionalliance@devonandcornwall.police.uk, and the Alliance Data Protection Policy uses dataprotectionalliance@devonandcornwall.pnn.police.uk throughout, as does Dorset's own information sharing team page. If mail to one is returned, try the other. Note that the privacy notice never shows the address as text — it is behind a link labelled "Alliance Data Protection Office", so copying it off the page gets you nothing. Requests to correct or delete information take a different route from requests to see it: the alliance policy sends Dorset rectification and erasure requests to the Information Review Team at RecordDeletionRequests@dorset.pnn.police.uk, while the right of access stays with the Alliance Data Protection Team. That mailbox appears nowhere on Dorset's own website, so a reader exercising those rights cannot find it from the force's site. The alliance policy names two addresses for the right of access and treats them as alternatives: the Winfrith headquarters above, and the Alliance Data Protection Team at Devon and Cornwall Police Headquarters, Elliott House, Middlemoor, Exeter EX2 7HQ. Dorset's own privacy notice publishes only the Exeter one, without the building name. Either reaches the team. Dorset gives the response time three different ways: the privacy notice says within one month, the request page says one month or three months in complex cases, and the information rights page says within 30 days with up to two months extra. They agree in substance — one month, extendable to three — but 30 days and one calendar month are not the same period. The force may also restrict what it releases, and when a force can refuse or limit access is set out separately. When Dorset replies you can check whether the response is complete. Retention. Dorset publishes that automatic number plate recognition data is stored for one year, that most staff with permission may search it only for the first 90 days from collection, and that access for up to a year is possible for serious, major or counter-terrorism investigations on a senior officer's authorisation. For live facial recognition, biometric data from a face that does not match the watchlist is deleted immediately; the force's web page says positive alerts are deleted immediately after use or within 31 days, while its Live Facial Recognition Policy says that data is deleted within 24 hours of the deployment ending, and the web page contradicts itself on the same point. CCTV footage used by the technology is kept no more than 31 days unless it is needed evidentially or for a complaint investigation. The force publishes no retention period at all for body-worn video, general force CCTV or custody images, and its privacy notice defers to national retention periods and College of Policing guidance without giving figures. Two time limits on Dorset's site are not about Dorset's own records and are the most urgent thing here for anyone chasing traffic footage: Dorset says CCTV from National Highways traffic cameras is only kept for seven days and must be asked for within five days of the incident, and that if you are submitting your own dashcam or phone footage you should keep the original for 12 months. Not a subject access request: a police certificate for a visa application goes to ACRO, which Dorset says also holds your full criminal conviction history for your own records; an employer's criminal-record check is a basic DBS check, and no employer can require you to make one as a condition of employment; DNA and fingerprint deletion goes to ACRO, which runs that service on the force's behalf, although records held locally such as custody photographs can be asked of Dorset directly; and a collision report is a separate route costing £46.40 for a third-party report or £130.70 for an abstract report, with the force giving payment instructions when you submit the request, though searching for the collision reference number is free. None of this is a criminal record check, and if you are not sure which record you need, start with which police record you actually need.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.