The short answer
A useful response should be specific enough to check.
Identify the controller, data source, purpose, system version, audit trail, retention period and the exact right or complaint route being used.
For this question, a useful answer should identify controller, source, purpose, data used, system version, validation, sharing, retention and challenge route. A label without those particulars may describe an outcome, but it does not expose the decision trail.
Put it in writing
Six follow-up questions
Use only the lines that fit. A numbered request makes an incomplete answer easier to identify without turning the letter into an accusation.
- 01
Please answer this question directly: What model, version, configuration and threshold produced the result?
- 02
Please identify the person or role responsible for the answer and the date of the decision.
- 03
Please identify the legal power, published policy, procedure or test relied upon, including its current version.
- 04
Please identify controller, source, purpose, data used, system version, validation, sharing, retention and challenge route.
- 05
If any part cannot be answered, please state whether the information is not held, cannot be disclosed, or requires a different request route.
- 06
Please identify any review, correction, complaint or appeal route and the deadline that applies.
Why record it?
Preserve the answer and the route to it.
Memory changes, reference numbers join separate systems, explanations can drift, and retention periods may expire. The point is a usable chronology kept by the reader, not evidence submitted to this website.
- □Date, time, place and method of contact
- □Name, role, organisation and team, if provided
- □The exact question asked and exact answer where possible
- □Every incident, complaint, case and document reference
- □The decision or refusal, reasons given and decision-maker
- □Evidence offered, what was accepted and what was declined
- □Promised action, deadline and next contact
- □Original documents and files, including metadata where available
Official starting points
Where the answer may be buried
These links are selected for this topic, not offered as a complete statement of the law. Read the current page, its jurisdiction and any stated deadline.
Request your own personal data. Identification is required.
https://www.scotland.police.uk/access-to-information/data-protection/subject-access-requests↗Police ScotlandYour data protection rightsCheck routes for rectification, restriction and other data rights.
https://www.scotland.police.uk/access-to-information/data-protection/your-rights↗Police ScotlandData Protection OfficerContact the Data Protection Officer about Police Scotland data handling.
https://www.scotland.police.uk/access-to-information/data-protection/privacy-notice-contacting-police-scotland/↗Information Commissioner's OfficeGetting copies of your informationPlain-language UK guidance on subject access requests.
https://ico.org.uk/for-the-public/getting-copies-of-your-information-subject-access-request/↗Possible routes
The route depends on what is actually wrong.
Ask the decision-maker or organisation for the decision, reasons, authority and reference in writing.
A subject access request is different from an FOI request for policies, statistics or other recorded information.
Identify the exact statement, why it is inaccurate, the supporting record, and every later system or decision that may contain it.
Check the reviewer's actual remit. Some bodies review complaint handling but do not reinvestigate the original event.
Do not assume one process stops another deadline. Complaint, review, appeal, tribunal and court time limits can run separately.
