Subject Access Request to Kent Police

Kent Police names the team and says outright what it is for. Its privacy notice gives the Public Disclosure Team as "Kent Police's Team dealing with information rights", and its right of access sections end "to exercise this right please email: public.disclosure@kent.police.uk" as the alternative to the online form. That is a clearer designation than most forces manage, and it is why both the address and the mailbox above are given as places to send a request rather than as general enquiry points. Check the registration number on this page against the force's own, because they do not match and ours is the one that belongs to the force. Kent Police's data protection page states a registration number that belongs to the Kent Police Federation Office — the staff association, which is a separate organisation and a separate data controller. The number above, Z4886266, is the one the Information Commissioner holds for the Chief Constable of Kent Police. The force publishes three different addresses for its data protection function: the Palace Avenue one above, given in the privacy notice for information rights; an address at Coldharbour, London Road, Maidstone on its sixteen specific privacy notices; and its headquarters at Sutton Road, which its own pages describe as the Controller's address rather than the team's. Use the one above — it is the only one the force attaches to the words "dealing with information rights". If you would rather write than use the form, our free letter template produces a letter you can send. Kent says the right may be exercised verbally or in writing, and repeats that in five separate rights sections — and then publishes no telephone number for it anywhere. Its own guidance offers a request "by telephone, email, by post, or in person" without giving a number for any of them. If you do make a verbal application, the force says you may be asked to confirm the written record an officer or member of staff makes of it at the time. Kent's privacy notice links out for the national criminal record, and that link is broken: the address it uses for ACRO applications now returns an error rather than a page. Arrests, cautions and convictions sit on the Police National Computer nationally and those requests do go to ACRO, free — use our ACRO page or ACRO's own current site rather than the link on the force's page. A request to Kent Police returns what this force holds — incident reports, custody records, body-worn video, 999 and 101 recordings — so if you want both you make both requests, and which police record you need sets out the difference. The force sets out its rights twice over, once under Part 3 of the Data Protection Act for records it holds for law enforcement purposes and once under the UK GDPR for everything else, and says in terms that you have fewer rights under the first. Most of what a police force holds about an incident sits under law enforcement processing. It is worth reading both sections rather than assuming which one covers your records. Kent publishes a threshold for refusing a request as excessive, which few forces do: an application it estimates would take more than 30 hours of work to answer in the first month, or multiples of that afterwards. If your request is broad, narrowing it to particular dates, incidents or record types makes that refusal less likely, and the force says it will come back to you to seek clarity rather than simply refusing. The request itself is free, and two charges sit next to it that are not. The force says it may charge, based on administrative costs, for additional copies of information it has already disclosed to you, and it may charge a delivery fee if you ask for the response by courier or by a signed-for or special delivery postal service. Ordinary delivery of your first copy is free. The force's own pages give three different response times: one month or three months in complex cases on the page in front of the form, "usually within 30 days" plus up to two months extra on its information rights page, and a statutory timescale of "between one and three months" in the privacy notice — which then says the Act gives it no opportunity to extend, and immediately explains how it decides whether an extension is required. One calendar month is the statutory period, extendable by up to two further months, and the force must tell you within the first month if it is extending. The online route opens by asking why you want the information, and four of the five answers lead somewhere that is not a subject access request: a visa or emigration goes to an ACRO police certificate, an employer goes to a basic DBS check, a legal aid application goes to GOV.UK, and a family court case goes to a route that needs a sealed court order and for which the force says it will ask you to pay its reasonable charges. Only "other personal reasons" reaches the subject access form. You never have to justify a request for your own data, so that is the branch to take if none of the others describes what you actually want. Children can make their own request, and Kent sets the line at 16 rather than the 13 that ACRO uses for a parent applying on a child's behalf. A 14-year-old is therefore treated differently by the two bodies for the same underlying record. A collision report is a separate route with a downloadable form emailed to a dedicated mailbox. The force does not publish the cost in advance — it says it will tell you once it has processed your request form — works to up to twelve weeks from the date it processes your payment, and releases a report only once the case has been finalised and closed. None of that applies to a subject access request. The force states that it is a criminal offence under the Data Protection Act for an employer to require an employee or contractor to obtain records this way as a condition of their employment or contract, and for anyone providing goods, facilities or services to the public to require it as a condition of providing them. Nobody can require you to do this.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.