Subject Access Request to Merseyside Police

Merseyside Police processes subject access requests through the online form above, and it is the only route the force describes step by step. Its own guidance says you can also make a request "by telephone, email, by post, or in person", and then prints no telephone number, email address or postal address against any of those four channels. The postal address above is the one the force publishes for its Data Protection Officer in its privacy notice, last updated 30 January 2025, and a request made in writing is valid whatever route a controller prefers. If you would rather write than use the form, our free letter builder will draft one. There is no email address on this page, and that is deliberate. Merseyside Police publishes one data protection mailbox, Data.Protection.Officer@Merseyside.police.uk, and its privacy notice offers it to anyone "with concerns over the way that Merseyside Police handles their personal data or for further details on any of the above" rather than as a way to make a request. The same mailbox and the same named officer also serve the Office of the Police and Crime Commissioner for Merseyside, which is a separate organisation with its own data protection registration. It is a shared contact rather than the force's request inbox. That matters if you start from the Information Commissioner's public register, because the register points the wrong way. The force's own entry, Z4888071, lists no data protection contact at all, while the Police and Crime Commissioner's entry lists the shared mailbox. The registration number on this page is the force's own: Merseyside Police publishes it itself on its What is the Data Protection Act? page. Two of the force's own pages describe the deadline differently. The request page says one month, or three months in complex cases. Its information rights page says Merseyside Police "usually respond within 30 days" and that it "can take up to two months extra". Thirty days is not one calendar month, and the entitlement is the statutory one set out above rather than either of the force's phrasings. If your month has run out, you can check where you stand. Getting a record removed is a different process, and it is not Merseyside's to run. The force states that the ACRO Criminal Records Office "operates a record deletion service on our behalf", that "your enquiries for the removal of data should always go direct to ACRO rather than to us", and that court convictions are not eligible for deletion at all. ACRO has its own page here, and it is also where the national Police National Computer record comes from. If you want live facial recognition material, timing decides whether there is anything left to ask for. Merseyside Police publishes that if you were not on a watchlist your biometric data is "immediately and automatically deleted"; that watchlist images and alerts are "deleted within 24 hours after each day of deployment"; and that the underlying CCTV footage is "deleted within 31 days, the same as standard public cameras". A request made a couple of months after a deployment will find none of it. A road traffic collision report is a separate request and it is not free. Merseyside Police makes one available only where someone was injured and the injury was reported to the police within 30 days of the collision, takes the request on a downloadable form by email, charges a search fee that has to be paid before it starts work, and says a report can only be released once the case has been closed. It quotes up to 12 weeks from the date it banks your payment for a copy of the report, and up to 21 days for third party details. Family proceedings have their own route. The force runs an advance notice process for sharing information with the court and other parties, such as children's social care, ahead of a planned hearing, rather than handling it as a subject access request. Merseyside Police states in its own words that it is against the law for an employer, or a potential employer, to ask you to make a subject access request as a condition of your employment, and says they should ask for a criminal conviction check or a Disclosure and Barring Service check instead. More on that here. You cannot use this route to get somebody else's information. The force says the subject access process "is confidential between the applicant and the police" and that "we cannot provide details of another person this way". To apply on someone's behalf you need their signed third party permissions form, and the signature on it has to match the one on their identity document. Merseyside Police covers four local policing areas, not five: Liverpool, Sefton, Wirral, and Knowsley and St Helens combined, across 647 square kilometres. Anything that happened outside that area means asking the force that dealt with it instead, and the police hub explains which one. One local exception worth knowing: the Port of Liverpool Police, which polices the dock estate, is a separate organisation with its own data protection registration and holds its own records. A request to Merseyside Police will not reach it.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.