Your information rights

You have the right to ask us if we're processing your personal data and, if so, to access your personal data. This is known as your right of access. Making a request is known as a right of access request or subject access request.

UK GDPR Article 15 DPA 2018 (Section 43) gives you this right.

But we may restrict access, in full or in part, in some circumstances. For example:

• if disclosure impacts on the rights and freedoms of others
• if it impacts on an ongoing investigation
• to protect national security, or
• if it's clearly unfounded

If we do restrict access to your personal data, in full or in part, we'll tell you why. We won't tell you if this would undermine the reason for the restriction.

Your rights

You have the right to appeal to the Information Commissioner's office (ICO). You can also lodge a complaint. If you think we've broken data protection laws, you can take us to court.

Further information on your information rights is available here:

Right of rectification (change or update)
Right of erasure (deletion)
Right to restriction of processing
Right to object

Requests from children

Children can apply for access to their personal data. They must be able to understand their rights and make the request freely. We'll respond directly to the child. Where it's in the best interests of the child, we'll accept and respond to a parent or guardian.

Requests on behalf of others

To make an application on someone else's behalf, you need to ask them to fill in and sign the third-party permissions form (PDF, 91KB) to give their permission. You need to either upload a photo or scan of the completed form or share it with us when you make your application.

The signature on the form must match the one on their identity document (ID).

Employers can't ask employees or contractors to submit a request for personal data as a condition of their employment or contract. It's also an offence for anyone to ask you to do so if you provide goods, facilities or services.

Help us find your data

You don't have to complete the application below. But if you do, it gives us all the information we need to help us respond to your request quicker. In any case, you need to give us enough information to help us locate your personal data.

This is particularly important if or when we hold a lot of data. If you don't give us enough information, this may delay our response to your request.

What happens next

We'll confirm that we've received your request. We usually respond within 30 days. But it can take up to two months extra. For example:

• if your request is complex
• you've made several requests, or
• if we're processing the data for purposes other than law enforcement

This is in line with GDPR rules.

How to apply

• Verbally
• By post
• Online