The ICO’s investigation into Police Scotland’s handling of subject access requests (SARs) is a useful reminder for every organisation that receives them: a defensible process matters before a regulator asks how it works. The investigation is live, so it is not a finding that Police Scotland has breached the law. It does, however, put SAR intake, deadline tracking and staff training firmly in view.
What the ICO has said about Police Scotland
In its 11 September 2026 statement, the ICO says it is investigating Police Scotland’s compliance when handling SARs. The investigation is considering whether the organisation has failed, or is failing, to comply with its obligations under Articles 12 and 15 of the UK GDPR and section 45 of the Data Protection Act 2018, including the statutory timescale for responding.
The statement is carefully limited. The ICO says the investigation is live and that opening it does not mean it has reached a conclusion about whether Police Scotland breached its duties. It has announced no fine, reprimand, enforcement notice or other finding against Police Scotland in this statement.
Why SAR handling needs an operational system
A subject access request can arrive through many routes: an inbox, web form, customer-service conversation, HR contact or letter. If staff do not recognise it and route it promptly, the organisation can lose valuable time before the privacy team even sees it. The starting point should be a clear intake route and a simple rule for escalating anything that may be a request for personal data.
UK GDPR Article 12 sets requirements for transparent communication and responding to data-subject requests, while Article 15 sets out the right of access. For law-enforcement processing, section 45 of the Data Protection Act 2018 contains the relevant right of access framework. Organisations should make sure the people who triage correspondence know which regime applies and when specialist advice is needed.
Four controls managers should check
1. Record the request when it arrives
Keep a central register with the date received, requester, business area, identity-verification status, scope, owner and response deadline. Record the original message and the route through which it arrived. A central record makes it possible to see whether a request was acknowledged and allocated promptly, rather than relying on an individual mailbox.
2. Make deadlines visible
Use a tracked date for the statutory response deadline and reminders before it becomes urgent. If the scope is complex or clarification is needed, document what was asked, when it was asked and how that affects the work. Do not treat a spreadsheet or case-management tool as the control by itself: someone must own the queue and review overdue or high-risk cases.
3. Evidence extensions and communications
Keep a decision record for any extension, including the reason, the assessment of complexity and the communication sent to the requester. Preserve copies of acknowledgements, clarification requests, partial responses and final responses. This evidence helps the organisation explain its handling if the requester complains or the regulator asks for a case history.
4. Train the first line of response
Front-line teams do not need to determine every legal question, but they do need to spot a possible SAR and send it to the right owner. Training should use realistic examples from shared inboxes, HR, customer service and complaints. It should also explain why staff must avoid promising a response date or closing a request without the privacy team’s instruction.
What an investigation means for other organisations
An announced investigation is a signal to test your own process, not a reason to assume the organisation under investigation is at fault. Review a sample of recent SARs from receipt to closure. Look for missing intake dates, unclear ownership, deadline changes without reasons, inconsistent identity checks and communications that were not saved to the case file.
Managers should also ask whether reporting shows the reality of the queue. Useful measures include open requests by age, cases approaching deadline, overdue cases, extensions by reason, and the time taken between receipt and allocation. Trend data can expose a capacity or training problem before it becomes a regulatory concern.
For wider context on practical staff capability, see our staff-training checklist. If your organisation needs a broader baseline, our GDPR training can help teams understand the responsibilities that sit behind day-to-day data handling.
Questions to ask this week
- Can every team member identify and route a possible SAR?
- Where is the authoritative receipt date recorded?
- Who reviews requests approaching their deadline?
- Are extensions and requester communications documented consistently?
- Can you produce a complete case history for a recently closed request?
Frequently asked questions
Has the ICO found that Police Scotland breached data-protection law?
No. The ICO statement describes a live investigation and says that opening an investigation does not mean it has reached a conclusion.
What should an organisation do when it receives a SAR?
Record it promptly, verify identity where appropriate, allocate an owner, track the response deadline and preserve the communications and decisions made during the case.
Why does staff training matter for SAR compliance?
Requests often arrive outside a specialist privacy team. Staff who recognise and route them quickly help protect the organisation’s ability to respond within the applicable statutory timescale.
