Requests for the disclosure of personal data from the police and other agencies

Competent authorities such as the police, government departments including HMRC, and other local authorities or public bodies acting under regulatory powers, can request the release of personal information held by us for specified purposes.

Whilst we may be able to release information under Schedule 2, Part 1 of the Data Protection Act (DPA) 2018, this doesn't give an automatic right of access to information. The act states that public bodies can assess the merits of requests and decide whether or not to apply the exemption. 

There's no obligation on us to disclose information, even in cases where the exemptions apply. If we have genuine concerns about releasing any personal information (for example, it may have other legal obligations such as the information being confidential) then we may ask for a court order requiring release of the information.

Recipients will become the data controller in respect of any personal information that is disclosed to them following a request.  Therefore, the recipient must adhere to all relevant data protection legislation in the handling of the disclosed personal information.

How to make a request

Organisations wishing to request disclosure of personal information held by us must complete the correct request form.

  • For the police, the authorising officer must be ranked police inspector or higher.
  • For other 'relevant bodies' the authorising officer must be a senior manager.

Please note: if the form hasn't been fully completed and authorised, you'll be asked to resubmit the request. Where we don't have enough detail to decide whether disclosure is necessary, the application will be refused. We'll notify you if we don't hold the requested information, or if your request for disclosure is refused. 

The purpose of the form(s) is to enable us to respond to requests for the disclosure of personal data by providing the necessary information to locate the data in question. It also allows us to make an informed decision concerning the request for release of the information.

Information can be requested under the Data Protection Act 2018 (previously s29 DPA 1998) under the following:

Schedule 2 Part 1, Paragraph (2)(1) Crime and Taxation

Requests to access personal data can be made without the consent of the data subject for the purposes of the:

  • prevention or detection of crime
  • apprehension or prosecution of offenders
  • assessment or collection of a tax or duty or an imposition of a similar nature

To submit a request under the DPA 2018 Schedule 2, Part 1(2) you need to:

Schedule 2 Part 1, Paragraph (5) (1-3) information required to be disclosed by law or in connection with legal proceedings

Schedule 2 Part 1, Paragraph (5) (1-3) of the Data Protection Act 2018 allows us to disclose personal information where it's required for legal proceedings. Applications for disclosure of information relating to civil cases are considered on a case-by-case basis.

To submit a request under the DPA 2018 Schedule 2 Part 1, Para (5) (1-3) you need to:

How we process your disclosure request

Your request will be assessed to ensure that it falls within the scope of Schedule 2, Part 1(2) or (5) of the Data Protection Act 2018 and is proportionate to the reason the information is being requested.

There is no statutory time limit within which local authorities are expected to respond to requests made under Schedule 2, Part 1 but we'll aim to provide the requested information as soon as possible.

Where to send your request

Requests can be submitted via email to

We recommend that you use a secure email solution for sending personal or confidential information to us.

Further information

For further information on making requests to a public body and the reasons we must take into consideration when deciding to release information, please see the Information Commissioner's Office guidance about exemptions.

Please note: there's no obligation on us to disclose information under this provision.