Subject Access Request to Greater Manchester Police

Greater Manchester Police runs two data protection mailboxes and they do different jobs. A request to see your data goes to subjectaccess@gmp.police.uk, the address above. dataprotection@gmp.police.uk is for complaints about how the force has handled your personal data, and it is also the contact shown on the force's entry in the ICO's public register — so if you find that address first, you have found the complaints route rather than the request route. Most people should use the force's own online request form, which takes around five minutes, though each step has to be finished within two hours. GMP is unusually open about the alternatives: it says you can also ask by telephone, email, post or in person, so a letter is a real option here rather than a grudging one — our free letter template covers the wording. The number above reaches the Information Compliance and Records Management Unit, the team that handles these requests. It is not 101 and it is not a general enquiry line. The force's own pages say it "usually" responds within 30 days and that it can take "up to two months extra". The statutory position is one calendar month from the point it has what it needs, which the force can extend by up to two further months for a complex or repeated request. Thirty days is not the same as one calendar month, so work from the statutory deadline if you need to chase. Getting a record deleted is a different request from seeing one, and GMP does not handle it. Its own words: "The ACRO Criminal Records Office (ACRO) operates a record deletion service on our behalf … Your enquiries for the removal of data should always go direct to ACRO rather than to us." Court convictions are not eligible for deletion at all. If deletion is what you actually want, start with ACRO instead of filing here. Locally held material is the exception — custody photographs and similar force-held items are deleted or corrected by GMP. An employer cannot require you to make a subject access request as a condition of your employment or contract, and it is an offence for anyone to ask you to do so in return for goods, facilities or services. GMP states this on its own pages and points employers at a Disclosure and Barring Service check instead. If you are due in family proceedings, GMP runs a separate advance-notice process for sharing information with the court and with other parties such as children's social care before the hearing. It starts from the same request pages and, for that specific purpose, it is a faster route than a subject access request. GMP began using live facial recognition in October 2025, and its retention rules make timing decisive. If the system did not alert on you, your image and biometric data were deleted automatically and immediately, so there is nothing held to give you. If it did alert, the images are deleted immediately after use or within 24 hours. The CCTV footage the technology runs on is kept for 31 days. A request made a couple of months later will find nothing left of any of it. Copies of your ID have to be in colour — GMP says it does not accept black and white — and if you are asking for body worn video, CCTV, a custody photograph or anything else containing an image, your proof of identity has to be a passport or photo driving licence. If you send documents by post, send copies: originals are not returned. To apply on someone else's behalf you need their signed third-party permissions form, and the signature on it has to match the one on their identity document. Police records stay with the force that dealt with the matter, so an incident outside Greater Manchester means asking that force instead — the forces we cover lists the ones we have checked. There is no separate "Manchester Police" to ask: the city and the wider county are both GMP.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.