Subject Access Request to Thames Valley Police

Thames Valley Police asks you to make a subject access request through its online request form, and its guidance adds that a request can be made "by telephone, email, by post, or in person" — then prints no telephone number, email address or postal address on any request page. The postal address above is the one the force's Public Access Office uses for information-rights correspondence; it appears identically on the force's record-deletion page and its own subject access form, though no current page ties it to subject access in terms. A request in writing is valid whatever route a controller prefers, and our free letter template will draft one. If you use the form, note its timer: "You must complete each step of the form within two hours." There is no email address on this page because the force does not publish one for making a request. Its privacy notice offers publicaccess@thamesvalley.pnn.police.uk for concerns about how your information has been handled — on the legacy Police National Network domain — and sends access requests to the online form instead. The force's entry in the ICO's public register lists a different mailbox again, InformationGovernanceTeam@thamesvalley.police.uk, which appears nowhere on the force's own site. Neither address corroborates the other, which is why neither is above. A subject access request to the force is free: its own guidance carries a price column reading "Free" against both a local police force and ACRO. The force's own pages give the deadline three different ways: "We usually respond within 30 days. But it can take up to two months extra" on its information rights page, "We have one month to respond to your request (or three months in complex cases)" on the request page, and "within a month" on its downloadable form. Thirty days is not one calendar month, and the statutory position — one month, extendable by two more where a request is complex — is the one that binds. Getting a record removed is not this force's to do. Thames Valley Police says on its record deletion page that the ACRO Criminal Records Office "operates a record deletion service on our behalf", that "your enquiries for the removal of data should always go direct to ACRO rather than to us", and that court convictions are not eligible for deletion. ACRO is also where the national Police National Computer record comes from. If live facial recognition caught you, the clock has probably already run. The force publishes on its live facial recognition page that if no match was made your photograph and facial template "are immediately and automatically deleted after being captured"; that where a match is made the biometric data is deleted no later than 31 days after the operation concludes; and that the CCTV footage created for the purpose is "kept for up to 31 days" except in rare evidential cases. A request made two months after a deployment will find nothing. A police report after a road traffic collision is a separate request, not a subject access request. Thames Valley Police takes it on its collision report page, requires payment — it publishes no amount, and its form marks the price as to be confirmed — and quotes up to 12 weeks from the date it banks your payment for a copy of the report, up to 21 days for third party details, and says reports are only released once the case has been closed. Police information for family court proceedings has its own route and its own fee. The force's Family Court Disclosures Bureau takes a completed form, a cheque for £91.65 and any court order by post, at least 30 working days before the scheduled hearing date. A subject access request does not produce this disclosure. Applying for someone else means their signed third-party permissions form — the signature must match the one on their identity document — and two forms of identification for both of you: four documents in all, not two. Children can apply for their own data: the force says a child who can understand their rights and makes the request freely will be answered directly, and that it will accept and respond to a parent or guardian where that is in the child's best interests. The force states that employers cannot ask employees or contractors to submit a request for personal data as a condition of their employment or contract, and that it is an offence for anyone to ask you to do so if you provide goods, facilities or services. Thames Valley Police is the sole territorial force for Berkshire, Buckinghamshire and Oxfordshire — there is no separate Oxford, Reading or Milton Keynes force. Anything that happened elsewhere is held by the force whose area it happened in, a separate controller with its own route. If you are not sure whether the record you want is national or local, the force's own guidance says "If you're not sure, you can apply to both."

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.