Section 7 of the Data Protection Act 1998 gives you the right to find out what personal information the UK criminal justice system, including police forces, might hold about you. A request for your personal information is called a ‘subject access request’. It does not cover criminal records checks for employment purposes, known as a DBS check (previously a CRB check). If a criminal records check is required for your work, then your employer should explain how to apply for this.
You should make your request in writing. You can apply using standard application forms available from the police but there is no requirement to do so.
You should normally make your request to your local police force, which will be able to access all the information held centrally. If you no longer live in the UK, contact the police force for the area where you last lived.
If you have been in contact with the police because you were a witness or victim, or because of a traffic accident, then this information may not be available to other police forces. In these cases you should contact the particular police force you dealt with.
You will need to provide the police with:
- a request in writing, or a copy of their form filled in correctly;
- a fee for £10 (this is the maximum fee and covers all information);
- proof of your identity; and
- a photograph (only if you are requesting CCTV footage).
The police do not have to fulfil your request until they have received any information they reasonably need to identify you and find the information you want. The police application forms will explain what details they will need to find the information you have requested, and what proof of ID they will need to see. For example, they may ask you when you have been in contact with the police and why, and whether you have lived in another part of the UK. Using the form will help the police to find all your information and may therefore speed up your request.
The Data Protection Act includes exemptions which allow the police not to release information in some circumstances. In particular, they do not have to release information to you if this ‘would be likely to prejudice the prevention or detection of crime’ in a particular case. This could include situations where information relates to an ongoing investigation.
The police may also have to edit the information they send you to remove information about other people.
The police must deal with your request promptly, and at most within 40 days of receiving the request, the fee and any other information they need to identify you and find the information you have requested.
Keep a copy of your request. If you do not receive your information in 40 days, then you should contact the police again.
You can also request your personal information held by other organisations such as:
- HM Prison Service
- HM Court Service
- The Crown Prosecution Service (CPS)
Frequently asked questions
- There is inaccurate personal information held on my DBS file (previously CRB). What can I do?
- Can an organisation release information about me to the police?
- How can I request official criminal justice information?
1. There is inaccurate personal information held on my DBS file (previously CRB). What can I do?
If you have any concerns about the accuracy of personal data on your DBS file, you will need to raise it in writing with the Chief Constable of the police force responsible for the entry. You should be clear about exactly what you believe is inaccurate and what they need to do to correct it, providing evidence of the inaccuracies, where available. The Chief Constable should provide you with a full explanation about the information on your record.
2. Can an organisation release information about me to the police?
The Data Protection Act 1998 does not stop organisations from releasing personal information. Any organisation may be asked to release personal information because it is needed to prevent or detect a crime, or to catch and prosecute a suspect: information needed for these purposes will be exempt from parts of the Act. Organisations are most likely to get requests like this from the police, but they may get requests from other organisations that have a crime prevention or law enforcement function – for example, the Department for Work and Pensions Benefit Fraud Section.
Organisations may release personal information on a case by case basis, for the purposes of preventing or detecting a crime, or catching and prosecuting an offender. In these circumstances they don’t have to let an individual know their information has been shared, or provide them with access to it, if it would be likely to prejudice (that is, significantly harm) an ongoing investigation.
3. How can I request official criminal justice information?
The Freedom of Information Act gives you the right to request official information about the criminal justice system held by public authorities, including UK police forces and prisons. You might not be supplied with the information you requested if it is exempt under the Freedom of Information Act. Find out how to make a request.
The public authority has 20 working days to respond. If the public authority fails to respond to your request within 20 working days, you should ask them for an internal review. If you are still not satisfied, we may be able to help.
Police forces, prisons and other criminal justice organisations have already released some information under the Freedom of Information Act either in the normal course of business or in response to specific requests. Before making a request, check the appropriate website to see if they have already published the information you require. You can find police force websites by using the UK Police Service website. This provides links to all geographic and non-geographic police forces in the UK.
External link: Criminal records, court records and police records
Author: Information Commissioner’s Office