Subject Access Request to Warwickshire Police

Warwickshire Police does not take subject access requests through an online form. It asks you to download its own subject access request form, complete it, and then either scan and email it to the address above or post it to the Information Compliance Unit. Both are printed inside the form rather than on the web page that links it. The request is free — the force's own notice says you do not have to pay to exercise your rights — and if you would rather write in your own words than use the form, our free letter template will draft the letter. Two data protection mailboxes and two postal addresses are published, and they are not interchangeable. The privacy notice lists the mailboxes one under the other: dataprotectionofficer@warwickshire.police.uk for questions or concerns about how your data is handled, and subjectaccess@warwickshire.police.uk, labelled in terms as the email for subject access requests. The postal address on that notice is the Data Protection Officer at Force Headquarters, Leek Wootton. The address above, addressed to the Information Compliance Unit at PO Box 4, is the one the force's form tells you to send a completed request to. Same postcode, different desk. The force gives the clock two different starting points, and the difference is worth knowing before you post. Its privacy notice says it will normally provide the information within one month of receipt of your request. Its form says one calendar month after receipt of a fully completed form and proof of identity — so the month runs from the day the force has a complete application, not from the day you send it, and a missing document restarts your wait. It can take a further two months where requests are complex or numerous, and says it will tell you within the first month if it does. The legal position is one month, extendable by two more. The force does publish a telephone route, and it is the national one. Its data protection policy lists six ways to make a request and the fourth is simply "Phone 101", adding that requests can now be made verbally. That is 101, the non-emergency number every force in England and Wales shares, not a subject access desk. The two numbers printed inside the form, 01788 856147 and 01788 853714, are for advice and guidance on completing the application, and neither appears anywhere on the force's website; the same form says the force will be unable to give you information held on police systems over the telephone or by email before your request is completed. So a call can help you fill the form in, and 101 will take a verbal request, but neither is a way to get your data faster than the form. Several things people ask this force for are not subject access requests, and the force routes them away itself. A police certificate for a visa or emigration goes to ACRO, and the form says in terms that it is not for that. A check for an employer goes to the Disclosure and Barring Service; if what you need is a criminal record check, that is a different process again. This route returns locally held information only, so your full national conviction history is not on it. Requiring you to use subject access for an employment check is an offence, and the force says so — but its form names the wrong provision, citing section 177 of the Data Protection Act 2018 twice. Section 177 is about guidance on seeking redress against media organisations; the offence is section 184. The form asks whether you were required to apply, tells you that you commit no offence by submitting the request, and says the force may pass the details to the Information Commissioner's Office. Some of what you might want does not last long, and none of the figures are in the privacy notice. Non-evidential in-car footage is overwritten roughly every eight hours, and the force's CCTV systems every 28 days. Body-worn video not marked as evidential is deleted automatically after 31 days. Automatic number plate recognition data is kept for twelve months nationally and for seven days on the force's own management server, and most staff can search only the first 90 days of it. Biometric information is the exception in the other direction: the force says the Protection of Freedoms Act 2012, amending the Police and Criminal Evidence Act 1984, lets it keep that indefinitely. If your incident was on a motorway or major A road the camera may not be the force's at all — National Highways keeps its own footage for only seven days and asks for requests within five, and that is a request to National Highways, not to the police. If you are asking for photographs, CCTV or body-worn video, send a portrait photograph of yourself as well — a passport-style one is what the force suggests — because it says it needs that to identify you in the footage. It is an extra document on top of the two proofs of identity, and leaving it out is a common reason these requests come back. The form's own section on the Chief Constable's rights warns that you will not be given personal data where releasing it would be likely to prejudice a criminal investigation, and that information identifying other people may be withheld — what a force can hold back is narrower than that sounds. If what comes back looks thin, our free response checker will tell you what is missing. A collision report is a separate, chargeable route and not a subject access request. From 2 February 2026 the force charges a non-refundable enquiry search fee of £46.60 before it will look, then £181.65 for a full collision report of up to 30 pages, £118.70 for a crime report, £48.20 for an incident or call log and £23.90 for a custody record. A subject access request returns what the force holds about you free of charge. Two practical warnings about posting it. Check the postage: the form's own checklist asks whether you have used the correct value of postal charge, and notes that the maximum UK letter size is 240 x 165 x 5 mm, a C5 envelope, with larger sizes charged at a higher rate — a completed multi-page form plus ID copies goes over that easily, and underpaid post is a silent failure. And the link the form gives for the force's privacy notice no longer works, so use the Privacy notice link in the footer of the force's own website instead. A request goes to the force that holds the record, and the force says so itself — exactly how to apply depends on which force you are applying to, and its instructions are for applications to it. If what you want happened over the county line it belongs to a neighbour: West Mercia, West Midlands, Staffordshire, Leicestershire, Northamptonshire, Thames Valley or Gloucestershire. Other forces are listed on the police subject access request page.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.