Subject Access Request to North Wales Police

North Wales Police asks you to make a subject access request through its online form, and it is free. Its privacy notice designates the email address and postal address above for the same purpose: it says that to exercise any of the rights in its rights section, of which the right of access is one, a request should be made using those details. A request made in writing is valid whatever route a controller prefers, and our free letter builder will draft one. North Wales Police publishes this whole route in Welsh as well as English, and the Welsh application form is a genuine Welsh form rather than a handoff to an English one. One page on the Welsh side is not a translation. The Welsh version of the information rights page carries an internal review section that does not appear on the English page at all, a right to ask for a review within two months of the disclosure, and when this page was checked that section gave a different police force's data protection email address and postal address for it. The same Welsh page, with the same contact block, is served by every Welsh force, so it is a shared page that has not been localised rather than a mistake by this force. Use the email address and postal address above, which are the ones North Wales Police publishes in its own privacy notice in both languages. The force publishes its response time two different ways, and they do not say the same thing. The page that starts the request says it has one month to respond, or three months in complex cases. The information rights page says it usually responds within 30 days but that it can take up to two months extra, for example where the request is complex, where you have made several requests, or where it is processing the data for purposes other than law enforcement. One calendar month is the statutory period, not 30 days, and the extension runs from that month. Arrests, cautions and convictions on the Police National Computer are not this force's to give you. Its own guidance sends that request to the ACRO Criminal Records Office and says a request to a local force covers any other information it holds about you. If an employer has asked for a criminal record check, that is the Disclosure and Barring Service and not a subject access request at all. The force says you must apply to the police force in whose area it took place, and that this can mean applying to more than one force. Pages for Cheshire Constabulary and South Wales Police cover two of the neighbouring forces, and the police records hub explains which police record you actually need. The force's own advice tool has five branches for a request about yourself and four of them lead somewhere else: a police certificate for a visa, emigration or residency abroad goes to ACRO; a criminal convictions check for an employer goes to the DBS; a legal aid application goes to GOV.UK; and disclosure for a family court case goes to the force's Family Courts Team by email rather than through the request form. Only "other personal reasons" reaches the subject access route. A child can make this request themselves. The force says it will respond directly to the child where the child is able to understand their rights and make the request freely, and that it will accept and respond to a parent or guardian where that is in the child's best interests. It publishes no age threshold either way, which is worth knowing if you have read another force's page: Kent draws the line at 16 and ACRO at under 13. To ask on an adult's behalf you need their signed third-party permissions form, and the signature on it has to match the signature on their identity document. If your request is about live facial recognition, timing decides whether anything survives. The force's own data protection impact assessment says a biometric template that does not match anyone on the watchlist is deleted immediately, that a possible match and its biometric template are kept for at most 24 hours and are generally deleted immediately after the deployment ends, and that the watchlist itself goes the same way. Only the operator and engagement logs are kept for longer. Automatic number plate recognition data is kept for one year. Most staff with permission to search it can only reach data from the last 90 days, and access beyond that needs a senior officer's authorisation for serious, major or counter-terrorism investigations. A request made more than a year after the event will not find it. A collision report is a separate route and is not free. The force asks you to email a form and says it will be in touch about what information it can provide, what it will cost and how you can pay by BACS. Reports are only released once the case has been closed. The Office of the Police and Crime Commissioner is a separate data controller sharing the force's headquarters, and its own website publishes a department name the force does not use, together with a telephone number, as the way to ask the force for Police National Computer records. The force sends those records to ACRO, and publishes neither that department name nor that number itself. Use the details above.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.