ICO opens investigation into Police Scotland's handling of subject access requests

The Information Commissioner's Office has opened an investigation into Police Scotland's handling of subject access requests, seeking to establish whether the force has failed, or is failing, to comply with its obligations under Articles 12 and 15 of the UK GDPR and section 45 of the Data Protection Act 2018, including responding to requests within the statutory timescale.

An ICO spokesperson, confirming the investigation in a statement on 11 September, said a subject access request is a fundamental right that allows people to know what information organisations hold about them and how it is being used. The spokesperson said the ICO was unable to comment further while the investigation was live.

The ICO said that opening an investigation does not mean it has reached any conclusion about whether Police Scotland has breached its duties, and that the statement was not intended to predetermine the outcome. Where it identifies compliance failures, its regulatory tools include advice, assessment notices, warnings, reprimands, enforcement notices and fines of up to £17.5 million or 4% of annual worldwide turnover, whichever is higher. Before issuing a fine, enforcement notice or reprimand, the ICO sends a preliminary decision to the organisation to allow it to respond.

Article 15 UK GDPR gives individuals the right to obtain confirmation that their personal data is being processed, a copy of that data and supplementary information about the processing. Article 12 requires controllers to respond without undue delay and in any event within one month, extendable by a further two months where requests are complex or numerous. Section 45 of the DPA 2018 provides the equivalent right of access for personal data processed for law enforcement purposes under Part 3 of the Act, which governs much of a police force's processing, subject to restrictions where disclosure would prejudice an investigation or prosecution. Police forces routinely handle requests that engage both regimes, since a single request may cover data held for law enforcement purposes and data held for general purposes such as HR, complaints or vetting.

In October 2025 the ICO issued an enforcement notice to South Wales Police after finding it had responded to only 29% of SARs within the statutory timeframe between April 2023 and March 2024, and had 352 overdue requests as of August 2025, one dating back nearly two years.

The force was ordered to clear the backlog by June 2026. Sally Anne Poole, the ICO's head of investigations, said at the time that delays on that scale were unacceptable and that public bodies must uphold data rights.

Police Scotland is the second largest police force in the UK by officer numbers, serving a population of around 5.5 million. Its published guidance on subject access states that exemptions may prevent disclosure where criminal proceedings, a complaint against the police or a Police Investigations and Review Commissioner investigation is ongoing, and directs dissatisfied requesters to the ICO.