Subject Access Request to Lincolnshire Police

Lincolnshire Police covers the county of Lincolnshire, and its own area pages cover seven districts: Lincoln, Boston, East Lindsey, North Kesteven, South Holland, South Kesteven and West Lindsey, so Lincoln, Skegness, Louth, Horncastle, Grantham, Stamford, Bourne, Spalding, Gainsborough and Market Rasen. North Lincolnshire and North East Lincolnshire, including Scunthorpe and Grimsby, are policed by Humberside Police: the force's own area page for West Lindsey describes them as bordering its area rather than being in it. Check which area you were in before you apply. The force asks you to apply through its online form, and that is the route it supports first. Writing is a published route rather than a workaround: its privacy notice designates the Data Protection Team's email address and postal address "for all types of requests available under the Data Protection Act 2018", and its information rights page says you can apply by telephone, email, post or in person. The request is free, and our free letter template will draft the letter if you would rather write than use the form. There is no telephone number on any of those pages. The force's own subject access request form gives 01522 947125, but that is for advice on completing the application rather than for making the request: the same form says Lincolnshire Police will not give you information held on police systems over the telephone or by email before your request is completed. The force runs two data protection mailboxes and they are not interchangeable. The one above is the one designated for requests. DPO@lincs.police.uk is offered separately for questions or concerns about how the force processes your data, and it is also the address for asking for an internal review if you are unhappy with how a request was answered. Its own pages give two different deadlines. The subject access page says the force has one month, or three months in complex cases. The information rights page says it usually responds within 30 days and can take up to two months extra. Thirty days is not a calendar month, and the legal position is one month, extendable by two more. Timing decides whether some material still exists. Non-evidential body-worn video is deleted after 31 days and the force says deleted footage cannot be recovered, so ask quickly if that is what you want. Automatic number plate recognition reads are held for a year on the national system, while the force's own local systems keep only a rolling seven days. The force publishes no retention period for its CCTV: its policy governs use, retention and analysis but gives no figure, and its privacy notice defers to the national police retention schedules without giving any. One warning about the body-worn video page, which is where the 31 days comes from: further down, under the heading asking whether you or an outside organisation can obtain footage, it says requests for footage are considered under the Data Protection Act 1998. That Act was replaced in 2018, and the same page cites the 2018 Act correctly further up. Disclosure for family court proceedings is a different route and is not free. The force charges an initial £106.80 for the first two hours it takes to process the request and £34.70 for every two hours after that, and asks for that request in writing to Data Protection, Information Management Unit, Lincolnshire Police Headquarters, Deepdale Lane, Nettleham LN2 2LT. A subject access request for your own data costs nothing. Your national criminal record, and a police certificate for a visa, emigration or residency abroad, come from ACRO rather than from this force, and Lincolnshire says so itself. A check an employer has asked for is a DBS check, and requiring you to make a subject access request instead is an offence. A request to Lincolnshire returns what it holds locally, and its privacy notice lists what that can include: complaint, incident and accident details; offences and criminal proceedings; physical identifiers including DNA and fingerprints; images from body-worn cameras, CCTV and facial recognition; criminal intelligence; and the opinions and assessments officers have recorded about the people they dealt with. Norfolk Constabulary covers the county across the Wash to the south east, and other forces are listed on the police records hub.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.