Subject Access Request to Northumbria Police

Northumbria Police asks you to make a subject access request through its own online form, and it is free. Its privacy notice also says you can request access to your personal data "using the contact details in this privacy notice", which is what makes the postal address and email address above usable routes. Nothing in the force's request section publishes either of them: that section offers a request "by telephone, email, by post, or in person" and then gives no number, no address and no mailbox for any of them. Bedlington, not the headquarters, is where information rights sits. The ICO register gives the force's registered address as Middle Engine Lane in Wallsend, and that is a working police station, but the force's own privacy notice, its publication scheme page and its stations list all put the Information Management Department at Schalksmuhle Road. Send a letter to Bedlington. The address above is published with a named officer, in a privacy notice the force says it last updated in August 2023. The same building and postcode also appear on the force's publication scheme page addressed to its Information Management Department, so if you would rather not write to an individual whose post may have changed, that is the force's own alternative wording for the same place. Our free letter template produces a letter you can send either way. The force also gives a telephone route, and it is worth knowing what it is before you use it: its privacy notice says to call 101 and ask for the Information Compliance Unit. 101 is the national non-emergency policing number shared by every force in England and Wales, not a data protection line, so this page does not list it as a place to send a request. The online route opens by asking why you want the information, and four of the five answers lead somewhere that is not a subject access request: a visa or emigration goes to an ACRO police certificate, an employer goes to a basic DBS check, a legal aid application goes to GOV.UK, and a family court case goes to a separate disclosure route that needs the court's permission first and charges a fee. Only "other personal reasons" reaches the subject access form. You never have to justify a request for your own data, so that is the branch to take if none of the others describes what you actually want. Two things about the online form the force discloses in its privacy notice and nowhere near the form itself. It says it may be able to see what you type even if you never submit, because the site saves part-completed forms periodically. And it says completed online forms are sent automatically to the national police IT team responsible for the National Police Chiefs' Council Digital Policing Portfolio as well as to the force. Neither is a reason not to use the form; both are reasons to write a letter instead if you would rather the request stayed between you and this force. Identification has to be scanned or copied in colour, because the force says it does not accept black and white. Where a request covers body-worn video, CCTV or a custody photograph, it asks specifically for a passport or photo driving licence rather than any two documents. The force publishes four different response times across four documents: one month or three months in complex cases on the page in front of the form, "usually within 30 days" plus up to two months extra on its information rights page, normally one month with no extension mentioned in the privacy notice, and one month plus two more in the commissioner's own information rights document, with the clock starting only once identity is confirmed. One calendar month is the statutory period, extendable by up to two further months. Arrests, cautions and convictions sit on the Police National Computer nationally, and the force says those requests go to ACRO Criminal Records Office, free, rather than to it. A request to Northumbria Police returns what this force holds — incident reports, custody records, body-worn video, 999 and 101 recordings — so if you want both you make both requests. Which police record you need sets out the difference. The force says plainly that a subject access request cannot be used to get at somebody else: "The subject access process is confidential between the applicant and the police. We cannot provide details of another person this way." A collision report is a separate, chargeable and slower route, with a downloadable form emailed to a dedicated mailbox rather than an online application. The force asks for a search fee before it starts, warns that other charges vary and that an incomplete form attracts an extra administration fee, takes payment through GOV.UK Pay, works to 35 days from receipt of payment, asks for at least eight weeks where CCTV or body-worn video is involved, and releases a report only once the case is closed — and no earlier than a month after any court date. Requesting your own fingerprints for use abroad is a third route again, with its own published fees. None of that applies to a subject access request, which is free. The force states that an employer, or a potential employer, cannot ask you to make a subject access request as a condition of employment, and that it is an offence for anyone providing goods, facilities or services to ask you to do so. Nobody can require you to do this.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.