Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In the UK, you can ask a retailer for a copy of the personal information it holds about you under the UK GDPR. A request to a police force is handled under the Data Protection Act 2018 Part 3 when the information is being used for a law-enforcement purpose. In both cases, write clearly, identify yourself, define the records and date range you need, and keep proof of what you sent.
The routes are not interchangeable. A retailer normally has one month to respond and may extend a complex UK GDPR request by up to two further months with timely notice. A Part 3 police request must normally be answered within one month and has no equivalent complexity extension. Police disclosures can also be restricted to protect an investigation, another person, legal privilege or national security.
Retailer and police requests at a glance
| Aspect | Retailer | Police force |
|---|---|---|
| Usual legal route | UK GDPR right of access for general processing | Data Protection Act 2018 Part 3 for processing for a law-enforcement purpose |
| What you can seek | Your personal data and information about how it is used | Your personal information processed for prevention, investigation, detection or prosecution of crime, or execution of criminal penalties |
| How to make it | Written request to the privacy, data-protection or customer-service contact is practical; no special wording is required | Verbal or written request is legally valid and can be sent to any part of the force; using its published data-protection contact is usually fastest |
| Normal deadline | One month; a complex or numerous request can gain up to two additional months if the extension is explained within the first month | One month at the latest; the UK GDPR complexity extension does not apply to law-enforcement processing |
| Identity checks | Proportionate evidence may be requested where there are reasonable doubts | Proportionate evidence may be requested, including authority evidence when someone applies for another person |
| Possible restrictions | UK GDPR exemptions, other people’s data and legal privilege can limit what is disclosed | Part 3 restrictions can protect policing, other people’s data, legal professional privilege and national security |
| Escalation | Ask the controller or data-protection officer to review, then complain to the Information Commissioner’s Office | Use the force’s review or complaints route, complain to the Information Commissioner’s Office and consider court enforcement or legal advice where appropriate |
What a subject access request gives you
A subject access request (SAR) is a request for your own personal information. It also normally gives you supplementary information about the purposes of processing, the categories of information involved, who receives it, how long it is kept, where it came from and your relevant data-protection rights. The purpose is to let you understand how and why information about you is used and to check whether that use is lawful.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteA SAR is not a general right to an organisation’s entire file. It does not automatically entitle you to an unredacted witness statement, another person’s personal data, internal material unrelated to you or every document in a criminal case. The organisation can provide extracts, a data schedule or other material instead of a complete original document when that is what is needed to disclose your personal information lawfully.
Prepare before sending
Find the right contact
For a retailer, check its current privacy notice for the privacy, data-protection or customer-service address. For a police force, use the published data-protection or SAR contact if one is provided. A police request is valid even if sent to another part of the force, but the specialist route helps it get logged and routed without avoidable delay.
Choose a useful scope
Say which time period, locations and channels you mean. Retail examples include online orders, loyalty-account records, store transactions, CCTV, telephone recordings, live chats, complaints, fraud indicators and profiling. Police examples include incident or crime numbers, custody records, stop-and-search references, vehicle details, officers, stations and a date or incident range.
Ask for a copy of the information rather than only confirmation that information exists, unless confirmation is all you need. A focused request is easier to search and less likely to trigger a clarification pause, while still allowing you to add a sentence asking the organisation to include other personal information clearly connected with the stated period or incident.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
Collect identifiers
- Full name and any former names or aliases.
- Date of birth where relevant.
- Current and previous addresses used with the organisation.
- Email addresses, telephone numbers, account or loyalty numbers.
- Order, complaint, incident, crime, custody or stop-search references.
- Vehicle registration or other identifiers relevant to a police record.
- The preferred secure electronic format and a safe email address.
Plan for identity or authority checks
An organisation may ask for proportionate proof of identity if it reasonably doubts who is making the request. It should not routinely demand identification when it is already confident of your identity. If you are acting for someone else, expect to provide evidence that you have authority to do so. Send only what is reasonably needed and use a secure channel.
How to make a retailer SAR under the UK GDPR
- State the right you are using. Write that you are requesting access to your personal data under the UK GDPR. No prescribed legal phrase or form is required.
- Identify yourself. Include the account, email, postal address and other identifiers the retailer used. Attach proportionate identity evidence only if requested or genuinely needed.
- Describe the search. Give the date range, stores, websites, delivery channels and record types you want. List separate categories such as orders, CCTV, calls, chats, complaints, fraud flags or profiling so the search team can route each one.
- Specify delivery. Ask for the response in a secure electronic format and explain any accessibility or file-format need.
- Keep evidence. Save the request, attachments, delivery confirmation and every clarification exchange.
- Answer questions promptly. If the retailer cannot understand a broad request or holds a large volume of information, it may ask you to clarify. The response clock can wait while it is waiting for the clarification it reasonably needs.
Retailer timing and fees
The normal response period is one month. The period can wait until the retailer has proportionate identity evidence or clarification that it needs. If the request is complex or numerous, the retailer can take up to two additional months, but it must tell you about the extension and explain it within the first month.
Your first SAR is normally free. A reasonable administrative fee is limited to a request that is manifestly unfounded or excessive. Further copies of information already supplied can attract a reasonable fee. A retailer should explain the basis of any fee rather than using a charge as a routine barrier.
How to make a police subject access request under Part 3
Identify the policing purpose
Police processing for a primary law-enforcement purpose is generally covered by Part 3 of the Data Protection Act 2018. Law-enforcement purposes include prevention, investigation, detection or prosecution of criminal offences and execution of criminal penalties. Do not assume that a police-held record is automatically in Part 3; records held for ordinary administration can be under the UK GDPR instead.
Send a clear request
- Use plain language. Say that you want your personal information and a copy of it. You do not have to use the expressions “subject access request”, “right of access” or “section 45(1) of the DPA”.
- Choose written or verbal contact. Part 3 does not impose a formal method. A written request to the force’s data-protection contact gives you a reliable record, while a verbal request can still be valid.
- Give identifiers and a range. Include names and aliases, date of birth, addresses, incident or crime numbers, custody or stop-search references, vehicle details, involved officers or stations and the relevant dates.
- Describe the records. Identify the incidents, databases, statements, custody material, stop-search records, correspondence or other categories you want searched. Explain if you need a copy rather than confirmation.
- Provide authority evidence if applicable. If you apply for another person, include evidence of your representative authority when the force asks for it.
- Retain the audit trail. Keep the submitted request, delivery or call details, identity documents, follow-up questions and the eventual response.
Police timing
A Part 3 request must be answered without undue delay and at the latest within one month of receipt, or within one month of receiving identity evidence, representative-authority information or a fee where one is lawfully requested. There is no UK GDPR two-month complexity extension for information collected or used for law-enforcement reasons.
Identity, clarification and the start of the clock
The response period does not effectively run while the controller is waiting for information it reasonably needs to establish identity, authority or the scope of a very broad request. The Information Commissioner’s Office describes the UK GDPR position this way: the one-month period starts once the organisation has what it needs from you. Send requested evidence promptly, but challenge a demand that is disproportionate or unrelated to confirming your identity.
Clarification should help the organisation search, not force you to guess its internal legal labels. You can describe events, dates, account numbers and record types in ordinary language. If the organisation asks you to narrow a request because it holds a large volume of data, reply with a practical date range or priority list and state whether you still want the remaining categories searched.
When one person’s records fall under different rules
A police force may hold information about you for general administration and for law enforcement at the same time. The primary purpose for processing the particular information at the time of the request determines whether UK GDPR or Part 3 applies. Different parts of one response can therefore be handled under different regimes.
Ask the force to identify, as far as it can without undermining a restriction, which legal route was applied to each withheld or supplied category. This helps you understand why one set of records arrived under the ordinary access rules while another was limited under Part 3.
Best Value
- Updated Compliance: While the new rule takes effect on 7/19/2024, training and compliance dates don’t start until 1/19/2026, giving your team ample time to prepare with this thorough guide to OSHA regulations (29 CFR 1910.1200(j)).
- Comprehensive Safety Training Handbook: Prepares your employees for 25 of OSHA’s hottest safety topics, from Confined Space Entry to Workplace Violence, ensuring they are equipped with vital safety knowledge for a safer work environment.
- In-Depth, Easy-to-Understand Content: Each chapter tackles key workplace hazards like Electrical Safety, Lockout/Tagout, Respiratory Protection, and more, helping to prevent injuries and illnesses while promoting safe practices.
- Interactive Learning with Quizzes: Engaging chapter review quizzes reinforce safety concepts, making it easier for employees to retain and apply the knowledge, with downloadable answer keys for easy tracking.
- Specifications: English, Softbound, full-color pages (272 pages) offer clear, visually appealing safety information for a diverse workforce, with home safety details included throughout.
Redactions and restrictions on police disclosures
Protecting an investigation or other policing work
Under Part 3, access can be restricted where disclosure would prejudice a law-enforcement purpose. For example, revealing a particular line of enquiry or operational method could interfere with prevention, investigation, detection or prosecution. The restriction must be based on the Part 3 rules; the force cannot simply substitute a UK GDPR exemption because it is more convenient.
Protecting other people and legally privileged material
The force may need to remove another person’s personal information, material covered by legal professional privilege or information whose disclosure would threaten national security. Redaction can be applied to a passage, page or data field rather than denying every item in the response.
What the force should explain
Where possible, the force should tell you what has been withheld, why the restriction was used and how to complain or seek court enforcement. It may limit the explanation if giving the reason would itself undermine the restriction. A short statement that material was withheld is not always enough; ask the force’s data-protection officer or complaints route to review an unexplained omission.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A SAR is not a substitute for court disclosure
If your goal is evidence for a civil claim, a SAR may not produce the material in the form or completeness required for litigation. A police SAR cannot be used to obtain an unredacted witness statement, another person’s data or every document in a criminal file. Depending on the case, the appropriate route may be disclosure ordered by a court, advice from a solicitor or another regulated advice service. Tell the adviser what you received and what was withheld so the procedural route can be assessed separately from your access right.
Quick Recap
What to do if the response is late or incomplete
- Check your records. Confirm the date the organisation received the request and the date any identity, authority or clarification was supplied.
- Send a focused chase. List the outstanding categories, missing date ranges, unexplained redactions or failure to provide the requested format. Ask for the data-protection officer or formal complaints route to review it.
- Request reasons. Ask which legal regime was applied, what searches were made and why any restriction or fee was considered necessary, while recognising that a police force may limit details that would defeat the restriction.
- Escalate externally. If the controller does not resolve the issue, complain to the Information Commissioner’s Office. Keep the full paper trail with your complaint.
- Consider enforcement or legal advice. Where rights have been restricted, the ICO guidance identifies court enforcement as an option. For litigation evidence or complex policing restrictions, obtain advice from a solicitor or another appropriate advice service.
Request templates you can adapt
Retailer wording
Subject: Request for access to my personal data
I am requesting access to my personal data under the UK GDPR.
Please search records linked to my name, email address, postal address and account or loyalty number. I am seeking information from [date range], including [orders, CCTV, calls, chats, complaints, fraud indicators or profiling].
Please provide a copy in a secure electronic format. If you need proportionate identity evidence or clarification, tell me exactly what is required.
My preferred contact details are [details].
Police wording
Subject: Request for my personal information
I am requesting a copy of my personal information held by the force. The request concerns [incident, crime, custody or stop-search reference] and the period [date range].
Please search records connected with my name, aliases, date of birth, addresses, vehicle details, relevant officers and stations. I am seeking [record categories].
Please tell me which information is supplied and identify, where possible, the reason for any restriction or redaction and the available review or complaint route.
If you need identity or representative-authority evidence, please specify what is required.
Final checklist
- Use the retailer’s or force’s current privacy or data-protection contact where available.
- State that you want your own personal information and request a copy.
- Include identifiers, date or incident ranges and the record categories that matter.
- Ask for a secure electronic response.
- Supply proportionate identity or authority evidence promptly when reasonably requested.
- Keep delivery proof, attachments, clarifications and the response.
- For police data, distinguish law-enforcement processing from ordinary administrative processing.
- Expect lawful redactions and do not treat a SAR as a replacement for court disclosure.
- Use the controller’s review route, then the Information Commissioner’s Office, and consider court or legal advice where appropriate.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
