You are entitled to request information held about you from a third party. For example, you may wish to be provided a copy of your crime report to progress an insurance claim following the theft of a vehicle.
You could simply give the party holding the information, for example, a police constabulary, CONSENT to provide the information to another. Or you could provide your insurance company, or their representatives, CONSENT to obtain the information from the constabulary.
However, some police services are reluctant to make such disclosures and would prefer the insurer (or their agent) to use an ‘agreed’ process, a Memorandum of Understanding (MoU). But this comes with its own problems:
- The MoU does not apply to every insurer. Not all insurance companies are treated equally by the police
- The MoU does not guarantee the information will be disclosed within a set period
- There is a cost. For providing what is often a brief account, with scant information and would take little time to check, redact (if necessary) and disclose, a charge of about £150 can be made by the police
Conversely, a SAR request:
- applies to all constabularies, can be utilised by an insured/victim. An insurer can also be given authroity to make a ‘Third Party SAR’; an insured/victim can be authorised to make a SAR on the subject’s (insured’s) behalf
- The information is required to be disclsoed within a calendar month, subject to some exemptions
- There is no cost.
The issue of TP SAR’s is currently, as of early 2026, with the ICO as Essex constabulary, which charges over £150 per disclosure, has challenged the process.
I should be noted that disclosures can be subject to some difficulties.
For example, if a SAR is made, the constabulary may respond ‘investigation ongoing’. Whilst les slikley with a vehicle theft report as these are often quickly closed with little enquiry undertaken, should this be the response, a new SAR will need to be made, the process recommenced.
The ICO has advised, 05/2026, Case Reference IC-513402-Z3F0:
- If a constabulary declines to disclose the information for a valid reason i.e. ‘the investigation is ongoing’, that SAR is effectively killed at this stage.
- The data controller, the constabulary, would be considered to have complied with their obligations since a lawful response had been provided.
- A new/fresh SAR would need to be submitted upon completion of the investigation in question. There is no provision within the legislation to compel the data controller to partially comply with a request during an ongoing investigation.
- There is no way to avoid submitting a new SAR since the initial SAR, in the eyes of the legislation so to speak, the initial SAR has received a lawful response and is complete/closed