Get access to your personal data held by the criminal justice system

The right of access allows you to obtain personal information held about you by organisations, including police forces and the wider criminal justice system.

• How to make your request
• When to re-submit a request
• When does the right of access not apply?
• What to do if you disagree with the outcome or remain dissatisfied
• What can I do if there is inaccurate information on my DBS certificate?
• Can an organisation release information about me to the police?
• Making a freedom of information request about the criminal justice system

How to make your request

In most cases, you should make your request to your local police force which would hold records on local systems. However, if you would like access to information held on national police systems, such as the Police National Computer (PNC), you would need to contact ACRO.

If you no longer live in the UK, contact the police force for the area where you last lived.

If you have been in contact with the police because you were a witness or victim, or because of a traffic accident, then this information may not be available to other police forces. In these cases you should contact the police force you dealt with at the time.

Although you don’t have to use them, police application forms will help you understand what details you need to provide so they can find the information you have requested. It will also outline what proof of ID they will need to see. For example, they may ask you when you have been in contact with the police and why, and whether you have lived in another part of the UK. You can make a request verbally or in writing. If you make your request verbally, we recommend you follow it up in writing to provide a clear trail of correspondence. It will also provide clear evidence of your actions.

To exercise your right of access, follow these steps:

Step 1

• Identify where to send your request.
• Think about what personal data you want to access.

Step 2

• Make your request directly to the organisation.
• State clearly what you want.

You might not want all the personal data that the organisation holds about you. It may respond more quickly if you explain this and identify the specific data you want.

When making an access request, include the following information:

• Your name and contact details.
• Any information used by the organisation to identify or distinguish you from other people with the same name (account numbers etc).
• Any details or relevant dates that will help it identify what you want.

For example, you may want to ask for:

• your interview statements;
• footage of you captured through CCTV/ other recordable devices
• custody records; and
• correspondence between the police and other organisations, such as those providing support to you.

Step 3

• Keep a copy of your request.
• Keep any proof of postage or delivery.

When to re-submit a request

You can ask an organisation for access more than once. However, it may be able to refuse access if your request is, as the law says, ‘manifestly unfounded or excessive’.

If you are thinking of resubmitting a request, you should think about whether:

• it is likely that your data has changed since your last request
• enough time has passed for it to be reasonable to request an update on how your data is being used, or
• the organisation has changed its activities or processes recently.

When does the right of access not apply?

Schedule 2, Part 2, Paragraph 14 of the Data Protection Act 2018 states that:

The listed GDPR provisions do not apply to personal data processed by (a) an individual acting in a judicial capacity or (b) a court or tribunal acting in its judicial capacity.

This means that, for example, a judge's handwritten notes prepared for legal proceedings are exempt from disclosure under the right of access.

You cannot request personal data that forms part of a judicial decision or in documents relating to an investigation or proceedings which have been created by or on behalf of a court of other judicial authority. This is because there are other access routes through which you can obtain this information – the Criminal Procedure Rules - which govern the disclosure of material for cases going through the court process.

 The law also allows the police to withhold information in some circumstances. For instance, they can restrict your right to access if this is necessary for the “prevention, detection, investigation or prosecution of criminal offences” or the “execution of criminal penalties”.

In addition, the police may also have to edit the information they send you to remove information about other people.

What to do if you disagree with the outcome or remain dissatisfied

If you are unhappy with how the organisation has handled your request, you should first make a complaint to it.

Having done so, if you remain dissatisfied you can make a complaint to the ICO.

You can also seek to enforce your rights through the courts. If you decide to do this, we strongly advise that you seek independent legal advice first.

What can I do if there is inaccurate information on my DBS certificate?

Your right to access does not cover criminal records checks for employment purposes, known as a DBS check (previously a CRB check). If a criminal records check is required for your work then your employer should explain how to apply for this appropriately.

If you have any complaints about the accuracy of personal data on your DBS certificate, you can raise this with the DBS. This could include incorrect personal details, incorrect conviction information or other discrepancies.    

See the DBS website for more information.

If the inaccuracy relates to an offence you did not commit, this would have to be raised with the local police force. If you are concerned about an entry in the Police National Computer (PNC) record, you will have to raise this with ACRO.

For support and advice on criminal records, contact Unlock or NACRO.

Can an organisation release information about me to the police?

Data Protection legislation allows organisations to share personal information if it is needed to prevent or detect a crime, or to catch and prosecute a suspect.

Organisations are most likely to receive requests like this from the police, but they may also be from other organisations that have a crime prevention or law enforcement function - for example, the Department for Work and Pensions Benefit Fraud Section.

In these circumstances they don't have to let an individual know that information has been shared, or provide access to it, if this is likely to prejudice an ongoing investigation.

Making a freedom of information request about the criminal justice system

The Freedom of Information Act gives you the right to request information about the criminal justice system held by public authorities, including UK police forces and prisons. You might not be supplied with the information you requested if it is exempt under the Freedom of Information Act. You can find out how to make a request here.

Police forces, prisons and other criminal justice organisations have already published some information under the Freedom of Information Act either in the normal course of business or in response to specific requests. Before making a request, check the appropriate website to see if they have already published the information you require. You can find police force websites by using the UK Police Service website. This provides links to all geographic and non-geographic police forces in the UK.