Subject access - further guidance


The following information should help you with your subject access request. If you have any other questions about accessing your information, please contact us.


About my subject access

Making your request

About your disclosure



About subject access

What are my rights?

You have the right to be told what information, if any, is held about you and a copy of it. This information must be provided to you within one month, so long as you have provided satisfactory proof of your identity.

It’s important to know that there are some exemptions to this right, which means that some information will not be provided. For example you don’t have a right to be told about information that identifies others or relates to someone else. Also, you don’t have a right to personal data that, if provided, would be likely to prejudice a policing purpose.

What is the lawful basis?

The Data Protection Act (DPA) 2018 states that those who record and use personal data, such as the police service, must be open about how the information is used.

They must also follow the six data protection principles of good practice, which state that personal data must be:

• processed fairly and lawfully
• processed for limited purposes
• adequate, relevant and not excessive
• accurate and up-to-date
• not kept longer than necessary
• secure

The DPA creates a right for individuals to access their personal data, in order to be aware of and verify the lawfulness of the processing.

You can read more about the Data Protection Act 2018 on the Information Commissioner’s Office website.

Who can make a subject access request?

Anyone can make a subject access request for their own information. You can only make a request on behalf of another adult in an official capacity and you must provide us with a copy of the relevant legal document. This might be a power of attorney document, a signed letter of authority or an authorisation document.

If you are an adult, such as a parent, looking to exercise the child’s right to subject access on their behalf we may request further details to check that you are making the request genuinely on behalf of the child. Responses to requests made on behalf of the child will be sent directly to the child in their name.

Can a child make a subject access request?

Yes. ACRO will accept subject access requests received from a child providing that we are satisfied that the child is capable of understanding their right to access and that the child has made the request freely. Responses will go back to the child directly.

If you are an adult, such as a parent, looking to make a request on behalf of a child, please read 'who can make a subject access request?' above.

What is a data subject?

In this context, it is you, or the person that you are acting on behalf of. The Information Commissioner’s Office defines the data subject as: “the individual whom particular personal data is about.”

What is personal data?

The Information Commissioner’s Office defines personal data as:
“Any information relating to an identified or identifiable living individual. An identifying characteristic could include a name, ID number or location data.”

How does it work?

If you want to find out what information is held about you on police systems, you need to make a subject access request. There are two routes to do this, depending on the information you need.
If you would like to know what information is held about you on the Police National Computer (PNC), such as convictions, you will need to make a subject access request via ACRO here.

If you would like to know what information is held about you on a local police force system, such as statements or details about specific incidents, you will need to contact the relevant police force.

What is the PNC?

The PNC is the Police National Computer. It is a national database of information available to all UK police forces and law enforcement agencies. The information held on the PNC includes, but is not limited to: details of arrests, impending prosecutions, convictions, non-convictions such as penalty notices, cautions, final warnings, reprimands, individuals disqualified from driving, vehicle details, information relating to the issue of firearms certificates, and certain types of stolen property.




Making your request

How can I make a request to ACRO?

You can submit a request online or download a request form and submit via post. Alternatively you can contact our Customer Services team for more information.


What will I receive from ACRO?

You will receive a document, known as a subject access disclosure, which will contain details (where applicable) such as:
• your name
• date of birth
• address history
• impending prosecutions
• cautions
• final warnings
• reprimands
• convictions
• penalty notices
• information relating to the issue of firearms certificates

The disclosure may also include details of any arrest that did not result in a conviction. So if you are arrested but the police took no further action, or you were found not guilty at court, the details regarding this may appear on your disclosure.

The disclosure won’t provide you with information held about you on local police force systems, such as statements, incidents you’ve been involved in, or records of interviews. If you want information like this, you will need to contact the relevant police force.

Will the disclosure show spent convictions?

Yes. All conviction history from the PNC is provided, with the exception of certain information as explained above. For this reason, the Rehabilitation of Offenders Act 1974 and the ACRO step-down model, do not apply.

This means that any convictions you believe to be spent (i.e. a certain amount of time has lapsed since conviction) will appear on the disclosure.

Why can’t I just make one request to ACRO for information on the PNC and police force systems?

The PNC does not contain all information gathered by individual police forces. ACRO cannot access individual police force systems and for this reason you will need to contact the relevant force(s) directly.

I started my request online, but didn’t submit it, can I still access it?

No. Information from incomplete requests, requests that timed out, or that have not been submitted, is deleted.

What identification do I need to provide?

You must provide proof(s) of identity which clearly show:

• your name;
• date of birth; and
• current address.

Not all identity documents will include your date of birth and current address, so you may need to send us more than one.

It will help us process your request if at least one proof of identity is photographic, such as your passport or driving licence.

If you need to send multiple documents they must be in separate files, each one no more than 2MB in size. The format of your proof(s) must be either JPG, GIF, TIF or PDF. If we can’t read your document due to low image quality then your request may be delayed.

If you submit your request by post make sure you include copies of your proof of identity documents with your form.

If you are making a request on behalf of someone else, you must provide their proof(s) of identity as described above, in addition to your proof(s) of identity.

Please note that the proof(s) of identity submitted for the data subject (the person you are making the request on behalf of), must show their signature, so we can cross reference it with their signature on the proof of identity.

If you are unsure or unable to provide these, please contact us.

Why do I need to supply proof of ID?

We need to be confident that we provide your personal data to the correct person, which is why we ensure we have sufficient proof of identity before we disclose any information. It also helps us to ensure we make a correct match on the PNC.

Why does the request form ask for details of arrests, etc? Do I need to provide this?

You don’t have to provide these details, however it is helpful for us to ensure we provide you with the correct information.

I’ve been asked to make a subject access request, what should I do?

You are not obliged to provide your disclosure to anyone else for any purpose, including employment or the provisions of goods or services.

Asking someone to make a subject access request for this purpose is known as enforced subject access. Whoever has asked you may be committing an offence under Section 184 of the Data Protection Act 2018. You have not committed any offence in submitting your request and your request will still be processed.

If you let us know within section 6.2 of your request form details of the person or organisation that has asked you, we may refer them to the Information Commissioner’s Office (ICO). The ICO may investigate further with a view to prosecuting whoever has asked you.

If you need information from the PNC in relation to employment vetting, see the section below ‘can I use subject access for employment?’

How much does it cost?

It is free to make a subject access request.

How long will it take to get a reply?

Your request will be processed within one calendar month from the date we receive all required information. Please note that ACRO cannot be held responsible for any delay caused by the delivery service used to send the disclosure. Requests are processed in date order and can only be processed more quickly in exceptional circumstances.

If we need any further details to process your request we will contact you. In this case, your request will not be processed until the required details have been provided. If you do not provide this by the date shown on the ACRO email or letter, your request will be cancelled.

All disclosures to UK addresses are sent via 2nd class post and to overseas addresses by 1st class airmail. Please allow 10 working days for delivery within the UK and 14 days for delivery overseas. There is no option to send disclosures via courier or next day delivery.

If you have asked for your disclosure to be returned via email, it will be sent to the email address on your request form.

Can my disclosure be sent to an alternative postal address?

Yes. You can specify an alternative postal address on your request form.

Can I use subject access for employment?

No. It is a criminal offence for a current or prospective employer, or recruitment agency to require you to make a subject access request as a condition of employment or for the provision of goods or services. This is known as enforced subject access, which can be reported to us for referral to the ICO.

The criminal records check arrangements provided for employment purposes by the Disclosure and Barring Service (DBS), Disclosure Scotland and Access Northern Ireland (AccessNI) should be used.

For more information about disclosure for employment, please see the following:

If you live in England, Scotland or Wales: Disclosure Scotland

If you live in Northern Ireland: AccessNI

If you intend to, or work as a paid employee, or volunteer for an organisation that involves work with children, the elderly or vulnerable adults: DBS

Please note, only registered bodies can apply for disclosure via the DBS.

Can I use subject access as evidence of good character?

No. The UK does not have a process of providing evidence of good character. A subject access disclosure from ACRO will provide you with your information from the PNC, which is provided for your own knowledge.

About your disclosure

I have not received my disclosure, what should I do?

If you have not received your disclosure after the above timescales contact our Customer Services team.


Why is my information from Police Scotland not included?

Criminal History Scotland (CHS) is not checked as part of the ACRO subject access process. You will need to apply directly via Police Scotland.

How can I get my subject access disclosure legalised or apostilled for visa purposes?

ACRO does not provide a legalisation or authentication service. This is provided by the Foreign and Commonwealth Office (FCO) Legalisation Office. Please note, if you need to get your disclosure legalised or apostilled, you will need to select a postal disclosure as this will provide you with a wet signature.

Can I use my subject access disclosure for immigration purposes?

If you need a visa to travel to Australia, Belgium, Canada, Cayman Islands, New Zealand, South Africa or the United States of America, you will need to apply for an ACRO Police Certificate.

If you require a disclosure for immigration to a country other than these, you should contact the relevant embassy/high commission for advice on whether an ACRO Police Certificate is acceptable.

The information on my subject access disclosure is wrong, what should I do?

ACRO can’t amend any PNC information on a subject access disclosure as we do not own it. If you believe the information held on the PNC is incorrect, you will need to contact the force that owns the information and speak with the data protection officer.

I have a dispute or complaint, what should I do?

See our terms and conditions for details of the disputes and complaints process.

How can I find out more about data protection?

This page is designed to guide you through the subject access request process for information held about you on the PNC. If you would like more details about data protection, and the relevant legislation, take a look at the Information Commissioner’s Office website.