Subject Access Request to Gwent Police

Gwent Police asks you to make a subject access request through its own online form, and it is free. The force's request pages publish no email address, postal address or telephone number: its guidance offers a request "by telephone, email, by post, or in person" and then gives none of the four. The address and mailbox above come from the force's privacy notice, whose Right of Access paragraph says you can request access to your personal data "using the contact details in this privacy notice", which is what makes them usable routes rather than general enquiry points. A request made in writing is valid whatever route a controller prefers, and our free letter builder will draft one. The data protection office you are writing to is shared. Gwent Police's privacy notice describes the contact as the Joint Data Protection Lead Officer for South Wales Police and Gwent Police, so one office covers two separate forces. Each force publishes its own address and mailbox for that office on its own site, and the details above are Gwent's. South Wales Police publishes a Bridgend address and its own mailbox for the same office, so if a message to Gwent bounces that is the other way in. It does not change who holds the records: you ask the force that dealt with you, and the police hub sets out how to work that out. Gwent Police is bilingual and the whole of this route exists in Welsh, from the privacy notice through to the application form. The Welsh privacy notice is a faithful translation and carries the same Gwent address and mailbox as the English one. One Welsh page is not: the Welsh version of the force's information rights page carries a section that does not appear in English, about asking for an internal review, and when this page was checked that section gave a different police force's address and email address. Take the contact details above rather than any contact block you meet part-way through the Welsh route. The online route opens by asking why you want the information, and four of the five answers lead somewhere that is not a subject access request: a visa or emigration goes to an ACRO police certificate, an employer goes to a basic DBS check, a legal aid application goes to GOV.UK, and a family court case goes to the force's Family Courts Team by email. Only "other personal reasons" reaches the subject access form. Identification has to be scanned or copied in colour, because the force says it does not accept black and white. Where a request covers body-worn video, CCTV or a custody photograph, it asks specifically for a passport or photo driving licence rather than any two documents. The online form has to be completed within two hours per step. The force publishes three different response times across three pages: one month, or three months in complex cases, on the page in front of the form; "usually within 30 days" plus up to two months extra on its information rights page; and, in the privacy notice, one month with a further two months offered only for requests that concern general processing rather than law enforcement. One calendar month is the statutory period, extendable by up to two further months, and 30 days is the shortest of the three readings. If your month has run out, you can check where you stand. Arrests, cautions and convictions sit on the Police National Computer nationally, and Gwent Police's own guidance sends those requests to ACRO Criminal Records Office, free, rather than to it. A request to Gwent Police returns what this force holds - incident reports, custody records, body-worn video, 999 and 101 recordings - so if you want both you make both requests. A collision report is a separate route and it is not free. The force takes it on a downloadable form, using the email and payment methods described on that form, charges an application fee, and says a report can only be released once the case has been closed. None of that applies to a subject access request. Timing decides whether some material still exists. Gwent Police publishes no retention period for body-worn video or for its general CCTV: its privacy notice defers to national Management of Police Information guidance and its freedom of information pages to a retention schedule it does not publish. Some figures are published elsewhere. Automatic number plate recognition data is stored for one year, and most staff with permission to search it can only reach the last 90 days from collection. The force's facial recognition policies say an image captured on a mobile device, and the biometric data taken from it, are deleted immediately after a search is carried out, and set retention for probe images - which the force says typically come from CCTV, mobile phone footage or social media - at a minimum of six years for minor offences, ten years for significant ones and indefinitely for the most serious. For a road collision, the force points at National Highways for camera footage on roads in England, says that footage is kept only seven days and must be asked for within five, and states that Traffic Wales is unable to provide CCTV footage at all. The force states that employers cannot ask employees or contractors to submit a request for personal data as a condition of their employment or contract, and that it is an offence for anyone providing goods, facilities or services to ask you to do so. Nobody can require you to do this. Gwent Police covers 600 square miles and five local authority areas - Blaenau Gwent, Caerphilly, Monmouthshire, Newport and Torfaen. Anything that happened outside that area means asking the force that dealt with it instead.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.