“Enforced subject access” to criminal records becomes illegal from 10 March

Forcing someone to supply the results of a “subject access request” made to the police, Disclosure and Barring Service or Secretary of State for Justice under s.7 of the Data Protection Act 1998 will become a criminal offence from 10 March. 

First, it will be an offence to impose such a requirement on someone in connection with their recruitment, continued employment or contract for the provision of services. 

A similar offence will apply to those concerned with the provision of goods, facilities or services to the public or a section of the public, should such a requirement be imposed as a condition of providing or offering to provide goods, facilities or services.

In both cases, it will also be an offence to make such a request to a third party for the same information.

A defence is available if the requirement was authorised or required by law, or if it was in the public interest.  However, the prevention or detection of crime is expressly excluded from the definition of “public interest”.

These new offences do not change the existing rules and procedure through which a person’s criminal record (if any) can be confirmed through the Disclosure and Barring Service.

The ICO’s guidance on enforced subject access is now available here.

Our content explained

Every piece of content we create is correct on the date it’s published but please don’t rely on it as legal advice. If you’d like to speak to us about your own legal requirements, please contact one of our expert lawyers.

Posted by


Mills & Reeve Sites navigation
A tabbed collection of Mills & Reeve sites.
My Mills & Reeve navigation
Subscribe to, or manage your My Mills & Reeve account.
My M&R


Register for My M&R to stay up-to-date with legal news and events, create brochures and bookmark pages.

Existing clients

Log in to your client extranet for free matter information, know-how and documents.


Mills & Reeve system for employees.