Subject Access Request to the Ministry of Defence Police

The Ministry of Defence Police is the Ministry of Defence's own civilian police force, and this page is about the records it holds as a police force: incidents, arrests, intelligence and CCTV at the defence sites it guards. It is a statutory force created by the Ministry of Defence Police Act 1987, with officers who have the full powers of constables on the defence estate and, since the Anti-terrorism, Crime and Security Act 2001, when assisting a local force or dealing with an emergency. Three other things are often meant by "Ministry of Defence" records and none of them comes here. A military service record — your own or a relative's — has its own free application on GOV.UK and is a much larger share of the requests the department receives. Everything else the department holds is the Ministry of Defence page. And the Service Police are a different thing again: the Royal Military Police, the Navy Police, the Royal Air Force Police and the Defence Serious Crime Command police the armed forces under the Armed Forces Act 2006, and the MOD publishes a separate privacy notice for them naming itself, rather than a chief constable, as the controller. The MDP is not a Home Office force and has no local area. It is stationed across the UK at sites including Faslane and Coulport, Aldermaston and Burghfield, Devonport and MOD Whitehall, so the force that dealt with you depends on where the site was rather than where you live. General responsibility for enforcing the criminal law still rests with local forces, and the MDP publishes that it does not routinely deal with missing person cases or with offences such as murder — so if your matter was investigated by a territorial force, ask that force instead. The MDP is not on the 101 system either; its 24-hour control centre is a separate number. Its own privacy notice says the MDP Chief Constable is the data controller, and the Data Protection Act 2018 lists the chief constable of the Ministry of Defence Police as a competent authority in his own right. Even so, the force holds no ICO registration of its own, and no number is shown above because none would be correct. The department's registration, Z5343420, is the Secretary of State for Defence's; it names the British Army, the Royal Air Force, the Royal Navy and the Ministry of Defence, and it does not name the police force. The British Transport Police and the Civil Nuclear Constabulary are each registered in their own right; the MDP is not. Where to send it. The MOD's subject access request form, MOD Form 1694, routes requests by who is asking. A member of the public goes to the MOD HQ SAR Coordinator at Whitehall, which is the address above and is the same desk that handles requests to the department generally — so say clearly in your request that you are asking for Ministry of Defence Police records. Someone who served in the MDP and wants their own personnel file is sent instead to Ministry of Defence Police Headquarters, Palmer Pavilion, RAF Wyton, Huntingdon PE28 2EA. The MOD also runs an online service a member of the public can use, and the force's own page points at it, though the service never mentions the police force. You can also write the request yourself for free. Two cautions on addresses. The form gives the Wyton building as "Palmer Building" while the force's website, its GOV.UK page and its privacy notice all give "Palmer Pavilion" — the same headquarters, spelled two ways. And the MOD's own governance page for the force still prints an older headquarters address at Wethersfield in Essex, which the force's current pages have all moved away from; use the addresses on this page instead. MDP-DPA@mod.gov.uk is published by the force, but never as a way of making a subject access request — its own right of access section names no contact at all. Across the MOD's pages that address is given for Freedom of Information requests, for general enquiries about how the force handles data, and for complaints. Use it to chase or complain, not to apply, which is why no email address appears above. The MDP publishes no retention period for any of its policing records — nothing for body-worn video, CCTV, ANPR or custody. It confirms that its Project Servator deployments use CCTV and Automatic Number Plate Recognition, and its privacy notice defers to the College of Policing guidance on the Management of Police Information and to its own Retention and Disposal Schedule — but the link to that schedule points at an internal MOD SharePoint site the public cannot open, so there is no window anyone outside the department can work to. If footage matters, ask early. Two periods are published: contact-tracing data collected under NHS Test and Trace in 2020 was kept for at least three weeks, and the MOD says the details you put on the request form are kept for a minimum of two years in case you enquire again. If the answer is late or thin, you can check what you got back. Requests about someone who has died are not subject access requests — MOD Form 1694 says it "should only be used to request information about a living individual" — and there is no equivalent of the Access to Health Records Act for policing records.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.