Police force

Subject Access Request to Hertfordshire Constabulary

What Hertfordshire Constabulary holds about you, where to send the request, and what to expect back.

GetMySAR is an independent service and is not affiliated with, endorsed by, or acting on behalf of Hertfordshire Constabulary. The contact details below are published so you can make a request yourself free of charge.

Where to send your request

Verified 30 August 2026

Postal address: Kevin Sharp Head of Information Management Bedfordshire Police Headquarters Woburn Road Kempston Bedford MK43 9AX
Email: dataprotection@bedfordshire.pnn.police.uk
Their own SAR form: Open Hertfordshire Constabulary’s request form
ICO registration: Z4894869
ID they ask for: Hertfordshire Constabulary asks for two documents, one from each of its two lists, and says identification should be in date, valid and not expired. For proof of identity it lists a passport (the pages with photograph and personal details), a driving licence, a birth certificate or an adoption certificate. For proof of address it lists a utility bill other than a mobile telephone bill, a bank statement, a credit card statement, a landline telephone bill, a council tax bill, a letter from a job centre or from the Department for Work and Pensions, HM Revenue and Customs, the Ministry of Justice, the Home Office, UK Visas and Immigration, the Probation Service or a police force, or a driving licence if you did not use it as proof of identity — each showing your name and address and dated within the last three months. It says documents must be scanned or copied in colour and that it does not accept black and white. Where a request covers body-worn video, CCTV, a custody photograph or anything else containing an image, it asks that proof of identity is a passport or photo driving licence, and will accept student ID, company ID or a national ID card if you hold neither. If you apply by post it asks you not to send originals, because they will not be returned. A request made on someone else's behalf needs their signed third-party consent form, with a signature matching their identity document, and two documents for each of you. The online form makes an email address compulsory and gives you two hours to complete each step.

Source: Hertfordshire Constabulary published information. Organisations change these details — tell us if this is out of date.

Specific to Hertfordshire Constabulary

The force you are asking is Hertfordshire Constabulary, and the address and email address above are in Bedfordshire. That is correct. Hertfordshire, Bedfordshire and Cambridgeshire run a strategic alliance, and one shared Information Rights Unit at Bedfordshire Police Headquarters handles data protection for all three. The forces remain separate controllers — the shared privacy notice says the three Chief Constables "are registered as the data controllers for their respective forces" — so a request about something that happened in Hertfordshire is a request to Hertfordshire Constabulary, whichever building the post goes to. The force calls itself Hertfordshire Constabulary and also uses "Hertfordshire Police" about itself; either name reaches it. Check the registration number on this page against the force's own, because they do not match and the one above is Hertfordshire's. The force's data protection page says "This last part applies to Hertfordshire Constabulary" and then gives its registration number as Z4882190 — which the Information Commissioner holds for the Chief Constable of Cambridgeshire Constabulary, one of its two partner forces. Hertfordshire's own registration is Z4894869. It matters more than a typo: the Cambridgeshire registration expires in September 2026 and Hertfordshire's runs to September 2027, so anyone checking the force's status from its own page is looking at the wrong force's entry and at a registration about to lapse. The email address above is on a legacy police domain, on a notice the force says it last updated in August 2021, and it is the only data protection mailbox published anywhere on the site. Every other team there uses a current address — collisions, legal disclosure and facial recognition all end .police.uk without the older middle segment. The unit itself is current: the force's July 2026 facial recognition assessment names the same head of information rights. If an email bounces, use the online form or write to the postal address rather than guessing at a newer address. The postal address above names an individual, because that is how the force's privacy notice publishes it, and it is the address the notice's right of access section points at. The force's publication scheme page gives the same building addressed to a department — "Information Rights Department, Bedfordshire Police HQ, Woburn Road, Kempston, Bedfordshire, MK43 9AX" — so if you would rather not write to a named person whose job title the force's own 2026 documents give differently, that is its alternative wording for the same place. The constabulary asks you to make the request through its online form, and it is free unless it decides a request is clearly unfounded or excessive. Its request section offers a request "by telephone, email, by post, or in person" and then gives no number, no address and no mailbox for any of them — the contact details above come from the privacy notice instead. If you would rather write than use the form, our free letter template produces a letter you can send. The online route opens by asking why you want the information, and four of the five answers lead somewhere that is not a subject access request: a visa or emigration goes to an ACRO police certificate, an employer goes to a basic DBS check, a legal aid application goes to GOV.UK, and a family court case needs a Private Law Police Disclosure Order from the court and a fee before the force will process it. Only "other personal reasons" reaches the subject access form. You never have to justify a request for your own data, so that is the branch to take if none of the others describes what you actually want. Two things about the online form the force discloses in its privacy notice and nowhere near the form itself. It says it may be able to see what you type even if you never submit, because the site saves part-complete forms periodically. And it says completed online forms are sent automatically to the central police IT team responsible for the National Police Chiefs' Council Digital Policing Portfolio as well as to the force. Neither is a reason not to use the form; both are reasons to write instead if you would rather the request stayed between you and this force. The force publishes three different response times across three pages: one month, or three months in complex cases, on the page in front of the form; "usually within 30 days" plus up to two months extra on its information rights page; and normally one month from receipt in the privacy notice. Thirty days is not a calendar month. One month, extendable by up to two more, is the statutory position, and the force must tell you within the first month if it is extending. Arrests, cautions and convictions sit on the Police National Computer nationally, and the force says those requests go to ACRO Criminal Records Office, free, rather than to it. A request to this force returns what it holds locally — incident reports, custody records, body-worn video, 999 and 101 recordings. If you want both, you make both requests. The force also states that employers cannot require an employee or contractor to make a subject access request as a condition of their employment or contract, which is an offence. If you think you were scanned by one of the force's live facial recognition deployments, ask quickly. Its own impact assessment says images and biometric templates of people not on the watchlist are deleted immediately after a deployment and in any case within 24 hours, that possible-match images are kept for a maximum of 24 hours, and that the underlying CCTV footage is deleted within 31 days unless it has to be kept for an investigation or a complaint. The same document records the force's concern that deleting the watchlist after 24 hours "may result in the force being unable to comply with a subject access request", and says it can reconstruct one from a back-end record. A collision report is a separate, chargeable route and not a subject access request. The force takes those by email to its collisions unit, says fees are payable and that it will confirm them once you get in touch, warns that requests can take from a few weeks to months, and releases a report only once the case has concluded. A subject access request for what the force holds about you is free. Other forces are listed on the police subject access request page.

Making a request to a police force

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

What people commonly ask for

Incident and crime reports where you are named
Custody records and detention logs
Intelligence entries and markers held against you
Body-worn video and 999 or 101 call recordings
Records of stop and search encounters

Watch out for

Section 45(4) DPA 2018 lets a force restrict access where disclosure would obstruct an inquiry, prejudice the prevention or detection of crime, harm public security, or affect the rights and freedoms of other people. A restriction has to be necessary and proportionate for the specific information at issue — it is not a reason to refuse the request as a whole, and the ICO's guidance on restricting the right of access under Part 3 sets out the test a force is supposed to apply.
Ongoing investigations are the most common ground for withholding. Records may become disclosable once proceedings conclude, and a force can tell you when it is worth asking again.
A force can refuse to confirm or deny that it holds anything at all, where confirming would defeat the purpose of the restriction. That is a recognised answer rather than an administrative failure.
Two exemptions sit alongside those restrictions: legal professional privilege — in Scotland, confidentiality of communications — which covers legal advice the force has taken, and safeguarding national security.
If a force does withhold something, it must normally tell you within a month that it has done so and why, and tell you that you can complain to the force, complain to the ICO, or ask a court to enforce the right. Silence is not one of the options.
Body-worn video and CCTV often contain other identifiable people, so expect redaction or blurring rather than full disclosure. And the right reaches your own personal data only — section 45 entitles you to personal data concerning you — so it is not a route to a recording of someone else, or to footage of an incident you had no part in.
Records about someone who has died are not a subject access request — data protection rights end at death, and unlike health records there is no Access to Health Records Act equivalent for policing. ACRO points people to a Freedom of Information request to the force that dealt with the matter. That is a different law with different tests, and the duty of confidence survives death, so it is the right door rather than a guaranteed answer.
It is a criminal offence under section 184 of the Data Protection Act 2018 for an employer, or for anyone providing goods, facilities or services to the public, to require you to obtain your own police record through a subject access request as a condition. Schedule 18 defines the records this covers by the bodies that hold them, and a record of a conviction or caution obtained from a chief constable is one of them. A job, a tenancy or an insurance policy made conditional on you producing your record this way is the offence, not a formality.

Your rights, whoever you are asking

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.

Send it to Hertfordshire Constabulary

You can do this yourself for free using the details above. If you would rather not handle the wording, the submission and the chasing, GetMySAR prepares, sends and follows up your request for a fixed £20 fee.

Free letter template Have GetMySAR handle it — £20

This page is general information about your right of access under UK data protection law. It is not legal advice. If your situation is complex or contested, consider speaking to a solicitor or contacting the Information Commissioner’s Office.