Subject access - further guidance
The following information should help you with your subject access request. If you have any other questions about accessing your information, please contact us.
About my subject access
Making your request
About your disclosure
About subject access
What are my rights?
You have the right to be told what information, if any, is held about you and a copy of it. This information must be provided to you within one month, so long as you have provided satisfactory proof of your identity.
It’s important to know that there are some exemptions to this right, which means that some information will not be provided. For example you don’t have a right to be told about information that identifies others or relates to someone else. Also, you don’t have a right to personal data that, if provided, would be likely to prejudice a policing purpose.
What is the lawful basis?
The Data Protection Act (DPA) 2018 states that those who record and use personal data, such as the police service, must be open about how the information is used.
They must also follow the six data protection principles of good practice, which state that personal data must be:
• processed fairly and lawfully
• processed for limited purposes
• adequate, relevant and not excessive
• accurate and up-to-date
• not kept longer than necessary
The DPA creates a right for individuals to access their personal data, in order to be aware of and verify the lawfulness of the processing.
You can read more about the Data Protection Act 2018 on the Information Commissioner’s Office website.
Who can make a subject access request?
Anyone can make a subject access request for their own information. You can only make a request on behalf of another adult in an official capacity. To do so, you must provide us with a copy of the relevant legal document. This might be a power of attorney document, a signed letter of authority or an authorisation document.
If you are an adult, such as a parent, looking to exercise the child’s right to subject access on their behalf we may request further details to check that you are making the request genuinely on behalf of the child. Responses to requests made on behalf of the child will be sent directly to the child in their name.
Can a child make a subject access request?
Yes. ACRO will accept subject access requests received from a child providing that we are satisfied that the child is capable of understanding their right to access and that the child has made the request freely. Responses will go back to the child directly.
If you are an adult, such as a parent, looking to make a request on behalf of a child, please read 'who can make a subject access request?' above.
What is a data subject?
In this context, it is you, or the person that you are acting on behalf of. The Information Commissioner’s Office defines the data subject as: “the individual whom particular personal data is about.”
What is personal data?
The Information Commissioner’s Office defines personal data as:
“Any information relating to an identified or identifiable living individual. An identifying characteristic could include a name, ID number or location data.”
What is the PNC?
The PNC is the Police National Computer. It is a national database of information available to all UK police forces and law enforcement agencies. The information held on the PNC includes, but is not limited to: details of arrests, impending prosecutions, convictions, non-convictions such as penalty notices, cautions, final warnings, reprimands, individuals disqualified from driving, vehicle details, information relating to the issue of firearms certificates, and certain types of stolen property.
Making your request
How can I make a request to ACRO?
It is quicker and easier to apply online. If you are unable to do so, you can apply by post.
What will I receive from ACRO?
You will receive a document, known as a subject access disclosure, which will contain details (where applicable) such as:
• your name
• date of birth
• address history
• impending prosecutions
• final warnings
• penalty notices
• information relating to the issue of firearms certificates
The disclosure may also include details of any arrest that did not result in a conviction. So if you are arrested but the police took no further action, or you were found not guilty at court, the details regarding this may appear on your disclosure.
Will the disclosure show spent convictions?
Yes. All conviction history from the PNC is provided, with the exception of certain information as explained above.
This means that any convictions you believe to be spent (i.e. a certain amount of time has lapsed since conviction) will appear on the disclosure.
Why can’t I just make one request to ACRO for information on the PNC and police force systems?
The PNC does not contain all information gathered by individual police forces. ACRO cannot access individual police force systems and for this reason you will need to contact the relevant force(s) directly.
I started my request online, but didn’t submit it, can I still access it?
No. Information from incomplete requests, requests that timed out, or that have not been submitted, is deleted.
What identification do I need to provide?
We require one of the following:
- Driving licence
- National ID card
If you do not have one of the above documents, you will need to provide authentic documentation that enables us to verify your full name and
date of birth.
If you need to send multiple documents they must be in separate files, each one no more than 2MB in size. The format of your proof(s) must be either JPG, GIF, TIF or PDF. If we can’t read your document due to low image quality then your request may be delayed.
If you are making a request on behalf of someone else, you must provide their proof(s) of identity as described above, in addition to your proof(s) of identity.
Please note that the proof(s) of identity submitted for the data subject (the person you are making the request on behalf of), must show their signature, so we can cross reference it with their signature on the proof of identity.
Why do I need to supply proof of ID?
We need to be confident that we provide your personal data to the correct person, which is why we ensure we have sufficient proof of identity before we disclose any information. It also helps us to ensure we make a correct match on the PNC.
I’ve been asked to make a subject access request, what should I do?
You are not obliged to provide your disclosure to anyone else for any purpose, including employment or the provisions of goods or services.
Asking someone to make a subject access request for this purpose is known as enforced subject access. Whoever has asked you may be committing an offence under Section 184 of the Data Protection Act 2018. You have not committed any offence in submitting your request and your request will still be processed.
If you let us know within section 6.2 of your request form details of the person or organisation that has asked you, we may refer them to the Information Commissioner’s Office (ICO). The ICO may investigate further with a view to prosecuting whoever has asked you.
If you need information from the PNC in relation to employment vetting, see the section below ‘can I use subject access for employment?’
How long will it take to get a reply?
Your request will be processed within one calendar month from the date we receive all required information. Please note that ACRO cannot be held responsible for any delay caused by the delivery service used to send the disclosure.
If we need any further details to process your request we will contact you. We will be unable to process your request until the required details have been provided.
Can I use subject access for employment?
No. It is a criminal offence for a current or prospective employer, or recruitment agency to require you to make a subject access request as a condition of employment or for the provision of goods or services. This is known as enforced subject access, which can be reported to us for referral to the ICO.
The criminal records check arrangements provided for employment purposes by the Disclosure and Barring Service (DBS), Disclosure Scotland and Access Northern Ireland (AccessNI) should be used.
For more information about disclosure for employment, please see the following:
If you live in England, Scotland or Wales: Disclosure Scotland
If you live in Northern Ireland: AccessNI
If you intend to, or work as a paid employee, or volunteer for an organisation that involves work with children, the elderly or vulnerable adults: DBS
Please note, only registered bodies can apply for disclosure via the DBS.
About your disclosure
I have not received my disclosure, what should I do?
If you have not received your disclosure after the above timescales contact our Customer Services team.
Why is my information from Police Scotland not included?
Criminal History Scotland (CHS) is not checked as part of the ACRO subject access process. You will need to apply directly via Police Scotland.
Can I use my subject access disclosure for immigration purposes?
If you need a visa to travel to Australia, Belgium, Canada, Cayman Islands, New Zealand, South Africa or the United States of America, you will need to apply for an ACRO Police Certificate.
If you require a disclosure for immigration to a country other than these, you should contact the relevant embassy/high commission for advice on whether an ACRO Police Certificate is acceptable. ACRO does not provide subject access disclosure for immigration. The disclosure is intended for personal use only.
The information on my subject access disclosure is wrong, what should I do?
ACRO can’t amend any PNC information on a subject access disclosure as we do not own it. If you believe the information held on the PNC is incorrect, you will need to contact the force that owns the information and speak with the data protection officer.
I have a dispute or complaint, what should I do?
See our terms and conditions for details of the disputes and complaints process.
Further guidance about data protection is available from the Information Commissioner’s Office.