Subject Access Request to Norfolk Constabulary

Norfolk Constabulary and Suffolk Constabulary share one data protection team, and the force publishes two different email addresses for it. The one above is the address its own data protection policy names for a subject access request: that policy, published in December 2024, says requests to exercise the right of access must be directed to the Data Protection Teams at DataProtection@norfolk.police.uk or the Suffolk equivalent. The force's privacy notice, which is older, gives compliance@suffolk.police.uk in its contact block instead, and the same policy scopes that address to rectification, erasure, restriction, objection and automated decisions, which is every right except access and portability. A request sent to either will probably reach the same team, because one team runs both forces, but the address above is the one the force's own policy asks for. The postal address above is Norfolk's own, at Wymondham. The two forces remain separate: a request about something that happened in Norfolk goes to Norfolk, and the registration number above is Norfolk's. The force asks you to make the request through its online form, and that is the route it actually supports. It is free. If you would rather write, the address and email address above are the ones its privacy notice designates for the right of access, and our free letter template will draft the letter. The force also lists telephone and in person as ways to make a request and publishes no number for either. Its Contact us page gives 999, 101, the 18001 textphone relay and Crimestoppers, and no data protection line at all, and 101 is the national non-emergency number used by every force in England and Wales rather than a Norfolk subject access line. If you do call it, say you are making a right of access request and ask for the Data Protection Team. Its own pages give the deadline three different ways: one month; one month, or three months for a complex request; and 30 days with up to two months extra. Those are not the same, and 30 days is not a calendar month. The legal position is one month, extendable by two more. There is a fourth version, and it is on the document that governs exactly the requests the identification rules above are about. The force's CCTV policy says it will respond to a subject access request within 40 days, and within 40 days of receiving the required information and a fee. Forty days and a fee were the position under the Data Protection Act 1998, which was replaced in 2018; a subject access request is free and the period is one calendar month. If you are asking for CCTV or body-worn video and the force quotes you 40 days or a fee, that is the wrong document. Timing decides whether some material still exists, and the force publishes more figures than most. Facial recognition captures that do not match its watchlist are deleted immediately and irretrievably, and one that does cause an alert is kept for 24 hours. CCTV in the force's own premises is kept for 60 days in its Police Investigation Centres and 31 days elsewhere, and custody CCTV runs on the same 60 days before being overwritten unless it has been saved as evidence. Footage kept as evidence lasts far longer, and the force sets that by the seriousness of the offence: six years, ten years or a hundred. Non-evidential body-worn video is deleted after 31 days through the system the force stores it in, though it publishes no body-worn video policy of its own to confirm that directly. Automatic number plate recognition data is stored for one year. If your request is about footage, ask straight away rather than assuming there is a window to rely on. Traffic camera footage is not the force's to keep. It tells you to ask National Highways for footage of a collision on a road it manages, and says the request has to be made within five days of the incident because the footage is only kept for seven. It also says CCTV held by someone else is usually kept for less than a month. A subject access request to Norfolk cannot reach either. Your national criminal record and a police certificate for a visa come from ACRO rather than from this force, and a check an employer has asked for is a DBS check. The force says so itself, and requiring you to make a subject access request instead is an offence. Its request tool routes four of its five reasons away before you reach the subject access form: a visa or emigration to ACRO, an employer's check to the DBS, legal aid to GOV.UK, and a family court case to a separate court-order process with a fee. Only "other personal reasons" reaches the form. Norfolk's registration number appears on only one page of its website, under a heading about meeting its obligations on a general advice page rather than anywhere near the request form, so it is easy to conclude the force does not publish one. A collision report is a separate, chargeable route and is not a subject access request. The force publishes three fees, for searching out a collision reference number, for limited particulars and for a full accident report, and says it takes up to eight weeks; check the current figures on its own page before you pay. A subject access request for what it holds about you is free. Cambridgeshire Constabulary is the neighbouring force to the west, Lincolnshire Police to the north west, and other forces are listed on the police records hub.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.