Subject Access Request to Dyfed-Powys Police

Dyfed-Powys Police asks you to make a subject access request through its online form, and its privacy notice also designates post to the Information Management Unit at the address above. Its national how-to page adds telephone, email and in person as ways of asking, though the force publishes no telephone number for it. A request made in writing is valid whatever route a controller prefers, and our free letter builder will draft one. The email address above needs a word of explanation, because the force's own web pages do not present it as the way to make a request. Where it appears on them it is the address for asking for an internal review, or a contact for questions about the force's policies. What settles it is the force's own answer, published in March 2024, to a freedom of information request asking for the email address of its subject access request department: this is the address it gave. Its own downloadable request form gives a different one, dataprotection@dyfed-powys.pnn.police.uk, on the older police network domain, and tells you to send the completed form there. That domain still accepts mail, so either reaches the same unit. If you are unhappy with how your request was handled you can ask for an internal review, and that goes to a different address in the same building: Disclosure Supervisor, Data Protection, Dyfed-Powys Police, Police Headquarters, PO BOX 99, Llangunnor, Carmarthen, Carmarthenshire, SA31 2PF. You have two months from the date the information was disclosed. Three of the force's own pages give three different answers on timing, and its request form gives a fourth. The privacy notice says access is normally provided within one month of receipt. The request page says one month, or three months in complex cases. The information rights page says usually 30 days, with up to two months extra where a request is complex, where you have made several requests, or where the data is processed for purposes other than law enforcement. The form says one calendar month after it has a completed form and proof of identity. One calendar month is the statutory period, extendable by up to two further months, and 30 days is the shortest of the four readings. On its advice page the force states its ICO registration number as Z537336X. That registration belongs to the Dyfed Powys Police Federation, a staff association at St David's Park in Carmarthen, which is a different organisation. The Chief Constable's own registration is Z489524X, which is the number shown on this page and the one that is current until September 2027. Nothing turns on it for making a request; it matters if you are checking who you are writing to. The whole request route exists in Welsh. The force's advice tool, its information rights pages and the request form itself all run at a parallel Welsh address, and the form renders in Welsh rather than handing you back an English one. Dyfed-Powys Police was served with a compliance notice on 30 September 2016 requiring it to meet Welsh Language Standards on service delivery, operational matters, policy making and record keeping, so asking in Welsh here is a right rather than a courtesy. Four of the five branches of the force's own advice tool send you somewhere else, and it is worth checking which one you are in before you start. A police certificate for a visa or emigration is ACRO's, not the force's. A check for an employer is a DBS check. A legal aid application goes to GOV.UK. Family court disclosure goes to the Data Protection Team by email. Only "other personal reasons" reaches the subject access form. The force also states plainly that an employer cannot make you do this for them: it is against the law for an employer or potential employer to require a subject access request as a condition of your employment. There is more on that in our guide to enforced subject access requests. Two figures worth knowing before you ask are published in the force's policy library rather than on its privacy notice, which gives no numbers at all. Images from the force's public space CCTV are kept for 31 days and then auto-deleted day on day unless they have been downloaded for evidential purposes. Any ANPR search for data more than 90 days old has to be requested on a form and authorised in writing by an officer of at least Inspector rank. The force's body worn video policy states no retention period at all, and it was last reviewed in May 2026, so if you want footage it is worth asking early rather than assuming a window. A collision report is a separate route and is not free: the force asks you to email a completed request form and says it will be in touch about what it can provide, what it will cost and how to pay. If you reported the incident on the force's own website, you can download your own copy of that report without paying for anything. You can read how the force fits into the wider picture on our police records hub. If the records you want are held by a neighbouring force, South Wales Police covers the area to the south east, Gwent Police the south east corner beyond it, North Wales Police the north, and West Mercia Police the English side of the Powys border.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.