Privacy notice

This Privacy Notice explains how the Met processes personal data relating to members of the public. It also outlines the steps we take to ensure that personal data is protected and describes the rights individuals have in relation to the data we process.

View the child-friendly version of the privacy notice.

Personal data is any data that can be used to identify a living individual, on its own or in combination with other available information. References to names, identification numbers and location data would all be personal data. Processing means anything we do with the data and includes collecting, storing, and sharing.

1. Data Controller

The Commissioner of Police of the Metropolis, Sir Mark Rowley, is the Data Controller for any personal data processed by the Met, and can be contacted via email:
[email protected].

2. Data Protection Officer

The Data Protection Officer (DPO) for the Met can be contacted via:

Email: [email protected]

Or write to us:
c/o MPS Data Office
PO Box 313
Sidcup
DA15 0HH

3. What information do we collect about you?

The Met collects personal data from multiple sources in performing its statutory law enforcement functions. We also process personal data that is collated during our administrative functions, for example staff administration, procurement, property management, advertising and media.

From time to time, we may invite you to take part in an online survey. These  are hosted on our third-party research partner’s platform and helps us gather feedback from stakeholders and members of the public. If you take part, we only collect personal information with the explicit consent and we only keep it if needed. 

The personal data we collect and use will include personal data and special category personal data.

Types of personal data we process may include information such as:

• personal details such as name and address
• sound and visual images, including Body Worn Video with the ability to live stream, and Facial Recognition
• financial details
• intelligence material
• digital data including Automatic Number Plate Recognition (ANPR), communication data taken from mobile phones, laptops etc
• feedback, complaint, incident and accident details
• employment details

Special category personal data may include:

• racial or ethnic origin
• political opinions
• religious beliefs, or those of a similar nature
• trade union membership
• physical or mental health
• sexual health or orientation
• genetic or biometric data

The Met will only use the minimum amount of personal information necessary to carry out a particular activity.

Any communication with an Met employee, volunteer, or contractor is subject to Lawful Business Monitoring (LBM). LBM is the proportionate monitoring and recording of communications and system activity for legitimate business purposes, such as maintaining security, meeting regulatory and legal obligations, and ensuring appropriate use of Met systems and information.

999 calls and emergency incidents

All calls that are made in and out of our Met Control Room are recorded, including 999 calls. They are recorded so that they can be played back if we need to check the details, or to provide an emergency response. The recordings are sometimes used as evidence in court cases and also sometimes for the purposes of training, this is so that the Met can continue providing a better service to the public.

No warning is given that the calls are recorded at the time of making the call as this would obviously cause delay in an emergency. When you call 999 it is vital that your number is recorded by the Met control room, so that we can contact you again if we need further information from you during the incident or for the purposes of police investigation. Even if you have blocked 'caller ID' on your phone, your number will still be shown to the telephone exchange operator. This is a safety feature to enable us to find out an approximate location of the emergency.

The personal information we are likely to collect during a 999 call or at an incident include:

• caller’s telephone number and name where required
• the address of the incident, which may be the address of your property
• victim’s names, injuries, details of any medical support given, age and gender.

We may need to collect and use sensitive information, such as health details, where this is necessary to meet our obligations.

When we respond to an incident, we may share relevant information with other organisations involved in the response, such as the ambulance service or other emergency services. In some situations, we may also collect and share medical information (for example, details about injuries or urgent health needs) to help the ambulance service provide you with appropriate care. We do this where it is necessary to protect your vital interests, in other words, to protect your life or prevent serious harm.

4. Whose personal data do we handle?

In order to carry out our functions, we process information relating to a wide variety of individuals including:

• victims
• witnesses
• people convicted of an offence
• people suspected of committing an offence
• complainants, correspondents and enquirers
• consultants and other professional experts
• suppliers
• job applicants

We also process data relating to existing and former Met employees.

Information is likely to be held in various forms, including electronically in emails and in the Met's electronic filing system and databases as well as in paper-based records. It may also be held in other electronic forms such as CCTV.

5. Why do we use personal data?

The Met processes personal data for law enforcement purposes as outlined in Part 3 of the Data Protection Act 2018, which are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. We also process data for the purposes of safeguarding national security, including National Security Vetting for Met staff.

The legal basis for processing law enforcement data is that it is necessary for the performance of functions. The Met's functions are primarily established under the Police and Criminal Evidence Act 1984 and the Police Act 1996 and the Police Reform Act 2002, and include any powers or duties conferred by an enactment, and include:

• protecting life and property
• preserving order
• preventing the commission of offences
• bringing offenders to justice
• any duty or responsibility arising from common or statute law

We will only use personal information when the law allows us to and where it is necessary and proportionate to do so.

We may also process data for non-law enforcement purposes such as when we recruit and vet potential employees, for staff administration, managing media relations and when we provide educational programmes and support. Where we process data for non-law enforcement purposes, the processing is likely to be based on the following grounds:

• it is necessary for performing the contract
• to comply with a legal obligation
• it is in the public interest to do so; or for official purposes
• we have a legitimate interest to do so, and it is necessary and balanced against your own interests, rights and freedoms
• there may be rare occasions where it becomes necessary to use your personal information to protect your vital interests (or someone else's vital interests).

Where we process special categories of personal data, we will do so in accordance with the specific conditions of processing set out in the Data Protection Act 2018. It is likely that we will use special category data in the following circumstances:

• where we have your explicit consent
• where we are required to do so under employment laws
• where it concerns a medical diagnosis, or the medical assessment of your working capacity when you are in the process of applying to work for us
• where it is for the purposes of the exercise of the Met's functions, and it is in the substantial public interest

We also collate data via Met social media accounts (such as X, Facebook, YouTube), for the assessment of feedback on the Met's performance and interactions by members of the public.

6. Asking for your consent to process personal data

The Met may ask for your explicit consent to lawfully process your data where there are no other appropriate grounds. This will only happen in specific and limited circumstances and won’t usually be relevant to law enforcement data. When we do require consent, we will explain clearly what we are asking for and how we will use it.

We will also tell you how we will process your data, how long we will keep it for, and the steps we will take to delete it. Consent must be freely given, specific and informed and there must be a genuine choice about offering your data.

You have the right to withdraw consent at any time where we are processing or have processed your personal data based on your consent. Details on how to withdraw can be obtained by contacting us by email: [email protected].

7. How long do we keep personal data?

We keep personal data only for as long as it is necessary for the purpose for which it was collected, and in accordance with our legal obligations.

Retention periods vary depending on:

• the type of information
• the purpose for which it is held
• the outcome of any investigation or proceedings
• ongoing policing or safeguarding needs

In particular:

• records relating to crime, intelligence, public protection, custody, and investigations are retained, reviewed, and disposed of in line with national police retention frameworks, including the Police Information and Records Management, Code of Practice 2023
• information may be subject to periodic review to determine whether it remains necessary, and proportionate to retain
• information that is no longer required is securely deleted, restricted, or anonymised where appropriate

8. Who will we share data with?

The sharing of data is a primary business function. For example, it may be necessary to share data with other law enforcement agencies, both nationally and internationally, and with partner agencies working on crime reduction and prevention initiatives. We may also share data with a range of other bodies such as the press and media, service providers, current, past and prospective employers, voluntary sector organisations, financial institutions and regulatory bodies.

The Met takes steps to ensure that any disclosures of personal data, however obtained, comply with the provisions of the Data Protection Act 2018 and United Kingdom General Data Protection Regulations UK GDPR). This includes ensuring that any disclosures are necessary and proportionate. Disclosures will be made on a case-by-case basis, using the personal data appropriate to a specific purpose, and with necessary safeguards in place.

Where you have provided your personal data to us for the purposes of the police constable recruitment process, your data, including biographical monitoring information, will be shared with the College of Policing.

It will be stored on their secure network or within their Assessment Information Management System. From this information, your name, email address and candidate reference number will be uploaded to the new online assessment platform for constable recruitment and shared with the third-party provider hosting the system in order to progress your application virtually.

Some of the bodies or individuals to which we may disclose personal information are situated outside of the European Union (EU). If we do transfer personal data to outside of the EU, we undertake to ensure that there are appropriate safeguards in place to certify that it is adequately protected as required by the legislation.

We will also disclose personal information to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and by court order.

9. How do we keep your data secure?

Your personal data will be processed securely. We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions. The security, confidentiality and integrity of your data is of utmost importance, and will generally be stored within UK servers on either standalone drives or cloud-based solutions. 

View our policies for:

• How the Met protects Special Category and Criminal Offence Personal Data
• How the Met protects Sensitive Processing for Law Enforcement Purposes

View our strategy for:

• How the Met protects its information and assets.

10. Is my data subject to automated decision making or profiling?

We do not normally make decisions about individuals that have legal effects or similarly significant impacts based solely on automated processing, without meaningful human involvement.

Where analytical or algorithmic tools are used:

• they are intended to support human decision making, not replace it
• Met employees remain responsible for decisions and outcomes
• appropriate checks, oversight, and governance arrangements are in place

If we use automated decision making in a way that would significantly affect you, and the law requires us to do so, we will provide you with further information about that processing unless an exemption applies.

11. Your rights as a data subject

Under the Data Protection Act 2018 you have several rights that you can exercise in relation to the data we process about you. Under certain circumstances, by law you have the right to:

The Right to be Informed

The Met has an obligation to tell you how we obtain your personal information and describe how it will be used, retained, stored and who we may share it with.

The Right of Access

This enables you to receive a copy of the personal information we hold about you and check that we are lawfully processing it and that it is accurate (commonly known as a Right of Access Request).

The MPS takes steps to ensure that any disclosures of personal data, however obtained, comply with the provisions of the Data Protection Act 2018 and UK General Data Protection Regulation. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we are allowed under the law to charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we can refuse to comply with the request in such circumstances.

We sometimes need to request specific information from you to help us confirm your identity and ensure your right of access (or exercise any of your other rights) is valid. This is an appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Further information about these rights can be found within the Data Protection Act 2018, and on the Information Commissioner’s Office (ICO) website.

The Right to Rectification

This enables you to have any incomplete or inaccurate information we hold about you corrected.

The Right to Erasure

This enables you to ask us to delete (or put beyond use and rendered inaccessible), or remove personal information where there is no lawful reason for us to continue to process it.

The Right to Restricted Processing

This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

There are other reasons why we may need to restrict your information rights. We would do this only if strictly necessary and in any case we would apply these restrictions in line with Sec. 44 (4), (5) and (6) of the Data Protection Act 2018.

To exercise any of these rights, please contact us via:

Email: [email protected]

Or write to us:
c/o Data Rights
PO Box 313
Sidcup
DA15 0HH

When we use personal data for law enforcement purposes, different data protection rules apply under Part 3 of the Data Protection Act 2018.

You may be able to access, correct, or in some cases delete or restrict how your data is used. However, these rights can be limited where necessary to protect investigations, public or national security, or the rights of others. Any limits are applied carefully and only where the law allows.

In limited circumstances, personal data may be processed jointly with UK intelligence services. This can only take place where it is formally authorised through a Designation Notice issued by the Secretary of State. Any processing carried out under these arrangements is governed by Part 4 of the Data Protection Act 2018, which applies to intelligence related processing.

If you believe your personal information has been used under these intelligence related arrangements, and you want to exercise any of your rights, you should send your request to:

Joint Controllership Enquiries
PO Box 361
Newcastle upon Tyne
NE12 2GZ

Please do not use the Met address for these enquiries.

Please note that a £10 fee applies to requests made under Part 4 of the Data Protection Act 2018.

If you are not satisfied with the outcome of any of the above-mentioned requests which you may have submitted to us, you are entitled to contact the ICO to lodge a complaint and/or to make a request under Section 51 Data Protection Act 2018 to check if the restriction or refusal was lawful.

You are also entitled to apply to a court under Section 167 Data Protection Act 2018, if you believe there has been an infringement of your rights as a data subject under Data Protection Act 2018.

For further information visit the ICO website, alternatively please contact:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

12. Cookies

Cookies are used on this website to improve user experience and for essential functionality; they are not used for identification purposes.

Learn more about how we manage cookies.

13. How to make a complaint

The Met tries to meet the highest standards when processing personal data, and we take enquiries very seriously. If you have any concerns about the way that we have handled your personal information, please bring it to our attention via:

Email: [email protected]

Or write to us:
c/o Data Rights
PO Box 313
Sidcup
DA15 0HH

You are also able to submit complaints to the ICO, advice on how to contact them based on the nature of your concern is available at www.ico.org.uk/concerns.

Last updated 21 August 2026.