Subject Access Request to PSNI

PSNI asks you to make a subject access request through its online form, and that is the only route its subject access page promotes. The form itself says it is not compulsory to use it, but PSNI publishes no postal or email route for making a request. The postal address above is the one PSNI gives in its privacy notice for exercising your rights; a request in writing is valid whatever a controller prefers, and our free letter builder will draft one. Once the reply comes back, you can check whether it is complete. PSNI's adult and child privacy notices print the postcode of that address as BT6 5LE. That is not a real postcode. PSNI's own contact page and its other-rights page both give BT5 6LE for the same building, and so does the ICO's register entry. Use BT5 6LE. PSNI runs four data protection mailboxes and none of them takes a subject access request. zEnhancedRightsRequests@psni.police.uk is for asking PSNI to delete, update or correct information. DataProtectionOfficer@psni.police.uk is for complaining about how PSNI handles your information. CorporateInfoBranch@psni.police.uk is for complaining about how your request was dealt with. DataProtection@psni.police.uk appears only in the privacy notices, as the general rights contact. The ICO's register carries a fifth, on the older psni.pnn.police.uk domain, which PSNI's own site does not use. The national record is ACRO's, and PSNI says so. Arrests, cautions, convictions, non-convictions, driving disqualifications and firearms certificate details sit on the Police National Computer, and PSNI states that a PNC request "must contact ACRO Criminal Records Office, and not PSNI". PSNI adds that ACRO cannot supply local material — incident reports, crime records, custody data — so wanting both means two requests. ACRO has its own page here. A local request returns what PSNI itself holds, subject to the limits on what a subject access request covers. Deleting DNA and fingerprints is a Northern Ireland process, not ACRO's. Every force in England and Wales sends early deletion to ACRO's record deletion service. PSNI does not. Biometrics taken under the Police and Criminal Evidence (Northern Ireland) Order 1989 are reviewed by PSNI's own Biometrics Ratification Committee, which covers DNA samples and profiles, fingerprints, palm prints and custody photographs — and PSNI says approving early deletion "will not amend that individual's criminal record". PSNI does not issue certificates of good conduct or police clearance certificates, and routes police certificates for Australia, the Bahamas, Belgium, Canada, Chile, New Zealand, South Africa and the United States to ACRO. It does say, in its own words, that "in our experience foreign embassies will accept a police reply with details of any convictions and cautions supplied in response to a subject access request" — but that is PSNI describing what embassies have accepted, not a certificate, and for any other country PSNI says to ask the embassy first. Employment checks are AccessNI's, and requiring you to make a subject access request instead is an offence. PSNI states that its Corporate Information Unit does not provide criminal history checks for employment vetting, and that it is a criminal offence for an employer or recruitment agency to require you to make a subject access request as a condition of employment. Northern Ireland's route is AccessNI, on 0300 200 7888 — the certificate routes differ across the UK — and working with children overseas needs an International Child Protection Certificate. A child may be answered instead of a parent. PSNI says it will consider whether a child is mature enough to understand their rights, and "if we are confident that the child can understand their rights, then we will respond to the child rather than the parent". PSNI publishes no telephone route for making a subject access request. Its privacy notice gives 028 9070 0164 for Corporate Information, which is help with a request rather than a way to submit one, and it sits in the same address block as the incorrect postcode above.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.