What happens next?

You are entitled under the Data Protection Act to receive an answer without undue delay and at the latest within a month but hardly anyone ever receives a response from the  Metropolitan Police in that time.

If you do not receive a response within one month, email the Public Access Office on subjectaccessrequest@met.police.uk and ask for an explanation, using the following wording:

Subject: Non-response to my subject access request

I am writing further to my letter of [date] in which I made a subject access request because I have not received any response from your organisation.

As the statutory time limit for responding to my subject access request (one month) has now expired, I would be grateful if you could provide a response as soon as possible.

If I do not receive a response from your organisation within 14 days, I will submit a ‘request for assessment’ to the Information Commissioner’s Office (ICO).

Yours faithfully


You may then receive a ‘delay letter’ from them. If you do, we urge you to immediately make a complaint to the Information Commissioner’s Office (ICO) – and to let us know.

Repeated failure to respond to Subject Access Requests is unlawful and makes a mockery of the idea of greater openness and transparency that the Data Protection Act is supposed to encourage.

We want to lobby the Information Commissioners Office to use its enforcement powers against the Metropolitan Police, by showing the number of times the one month deadline is routinely ignored. This is why it is important to keep Netpol informed at info@netpol.org so we can apply pressure to the ICO to take action.

Making a complaint about a failure to respond.

The Information Commissioner’s Office has a complaints form that you can download in Word or as a PDF (English pdf_icon Welsh pdf_icon)

You need to return it by post or email with copies of your original Subject Access Request and any correspondence.

By email: If all your supporting evidence is available electronically, you can send the form by email.

  1. Save the Word version of the complaints form to your computer.
  2. Fill the form in and save it again.
  3. Open a new email, with ‘Report a concern’ in the subject line.
  4. Attach this form and any other documents you wish to send to the ICO. Please ensure your combined email attachments do not exceed 10 MB in a single email. You may send attachments over multiple emails, but please indicate this in the subject line.
  5. Send to casework@ico.org.uk
    Please note: email may not be secure.

By post: If your supporting evidence is in hard copy, you can print out the complaints form and post it (with your supporting evidence) to:

Customer Contact
Information Commissioner’s Office
Wycliffe House
Water Lane

 The ICO usually takes around two weeks just to allocate a case officer and, depending on the complexity of a complaint, can take several months to reach a decision. However, a failure to keep to the deadline is not a complicated complaint so if you haven’t heard anything within six weeks, once again let us know at info@netpol.org


What happens if the Subject Access request is rejected?

 There are a number of ways that the police can resist providing personal data:

  •  By claiming that disclosure would be likely to “prejudice ongoing criminal, civil or disciplinary proceedings”
  •  By claiming disclosure would be likely to “prejudice the prevention or detection of crime”
  • By claiming the Subject Access request is a “speculative search”
  • By claiming that a request would reveal “third-party personal data”
  • By claiming the request concerns unstructured personal data, which the costs of disclosing would exceed the relevant prescribed limit

If you receive a rejection, please contact Netpol at info@netpol.org so that we can seek legal advice.