Police officers may sometimes contact University staff and ask for information about a student, member of staff, or another person connected with the University.
This may happen by email, telephone or through a formal police information request.
If you receive a police request for information
Do not provide the requested information yourself.
Please forward the request as soon as possible to:
Data Protection / Information Governance
and copy in
Safeguarding
This applies even where:
- you know the person the police are asking about;
- the information appears straightforward;
- the police officer says the matter is urgent;
- the information is already available to you;
- the request is only for confirmation of something such as attendance, address or student status.
The University has processes in place to ensure that police requests are dealt with lawfully, securely and consistently.
Why Might the Police Ask the University for Information?
Police may request information for a range of legitimate law-enforcement and safeguarding purposes.
This can include:
- investigating or preventing crime;
- locating a missing or vulnerable person;
- establishing someone's whereabouts;
- verifying information or an alibi;
- investigating domestic abuse, stalking or harassment;
- investigating sexual or violent offences;
- protecting a child or adult at risk;
- managing public protection concerns;
- investigating threats to public safety; or
- complying with a court order, warrant or other legal requirement.
The fact that the police have requested information does not necessarily mean that the person concerned is suspected of committing an offence.
They may be:
- a victim;
- witness;
- missing person;
- person at risk;
- relative or associate of someone involved in an investigation; or
- another person whose information is relevant to police enquiries.
Why Should I Not Respond Directly?
A police officer asking for information does not automatically mean that the University is legally required to provide everything requested.
Before information is shared, the University may need to establish:
- that the request is genuine;
- the identity and authority of the requesting officer;
- the purpose of the request;
- why the information is required;
- whether disclosure is lawful;
- whether the information requested is necessary and proportionate;
- whether less information could meet the same purpose;
- whether sensitive or third-party information is involved;
- whether the person should be informed about the disclosure; and
- whether the request creates separate safeguarding concerns.
The ICO advises that organisations should only provide information that is necessary for the law-enforcement purpose and not excessive, and can ask the police for further information where the reason for a request is unclear.
This is why requests must be considered through the University's designated process rather than answered individually by members of staff.
Why Are Data Protection and Safeguarding Both Involved?
Data Protection / Information Governance
Data Protection will help determine whether the information can lawfully be disclosed.
This may include consideration of:
- the lawful basis for sharing;
- special category personal data;
- criminal offence data;
- data minimisation;
- confidentiality;
- third-party information;
- applicable exemptions; and
- secure disclosure arrangements.
Data protection legislation does not prevent appropriate information sharing with police, but sharing must still be justified and appropriately recorded.
Safeguarding
A police request can also provide the University with important new safeguarding information.
For example, the University may discover through the request that a student or staff member:
- is missing;
- may be at risk of harm;
- is experiencing domestic abuse;
- is the subject of stalking or harassment;
- may present a risk to another person;
- is involved in a serious safeguarding investigation;
- is connected with a child or adult safeguarding concern; or
- may require immediate University support or risk management.
Safeguarding therefore needs to consider what the police request means for the person and the wider University community, independently of the decision about whether information should be disclosed.
If the Police Telephone You
Do not provide personal information during an unexpected telephone call.
You may take the officer's:
- name;
- rank;
- collar or warrant number;
- police force;
- team/unit;
- contact details;
- crime or police reference number; and
- a brief explanation of what they are requesting and why.
Then advise the officer that University procedure requires the request to be submitted in writing through an official police route.
This may be:
- a WA170 form;
- the police force's equivalent disclosure form; or
- a formal request sent from an official police email address.
Once received, forward it to Data Protection / Information Governance and Safeguarding.
Do not confirm information during the call
This includes seemingly simple questions such as:
- “Is this person a student?”
- “Are they on campus today?”
- “What is their address?”
- “What is their timetable?”
- “Do you have a phone number for them?”
- “Are they living in University accommodation?”
Even confirming that the University holds information about somebody can amount to a disclosure of personal information.
What If the Police Say It Is Urgent?
Ask the officer to explain the nature of the urgency.
An information request being labelled urgent does not necessarily mean that it is an emergency.
Most police information requests can still be submitted quickly in writing and considered through the University's normal escalation arrangements.
You should:
take the officer's details → obtain the written request → immediately escalate it to Data Protection and Safeguarding.
Do not allow pressure to respond quickly to bypass appropriate verification and information-sharing checks.
Emergency Exception
There may be rare circumstances where there is a genuine emergency and delaying information sharing could place somebody at immediate risk of serious harm.
Examples may include:
- an immediate threat to life;
- a person who is missing and believed to be at imminent risk;
- an immediate threat of serious violence;
- an urgent child safeguarding situation;
- an ongoing emergency where police require information to locate or protect somebody.
Data protection law does not prevent necessary and proportionate information sharing in an emergency.
Where this occurs:
- Do not ignore or delay the request simply because it has not followed the usual written process.
- Establish as much information as possible about the officer and the emergency.
- Contact Safeguarding and Data Protection immediately.
- Where possible, independently verify the police contact.
- Share only necessary information and proportionate to addressing the immediate emergency.
- Ensure the decision and information shared are recorded as soon as possible afterwards.
Important
A police investigation being serious is not the same thing as an immediate emergency.
The emergency exception should be used where delay itself creates a genuine and immediate risk.
If You Receive a Police Request by Email
Do not reply with the information requested or attach University records.
Instead:
- preserve the original email and any attachments;
- do not forward it more widely than necessary;
- send it to Data Protection / Information Governance;
- copy Safeguarding; and
- tell the police officer, if appropriate, that their request has been passed to the University's relevant teams for review.
You do not need to decide whether the information can be disclosed.
Court Orders, Warrants and Other Formal Legal Requests
If you receive a warrant, court order, statutory notice or other formal legal demand for information, do not attempt to interpret or respond to it yourself.
Send it immediately to:
Data Protection / Information Governance
Safeguarding
and, where appropriate, Legal Services.
Some legal instruments may require the University to disclose information, but the scope and validity of the request should be checked before records are released. The ICO distinguishes these compulsory disclosures from ordinary police requests, where an organisation must still determine whether sharing is appropriate.
What Happens After You Escalate the Request?
Data Protection and Safeguarding will coordinate the response.
This may include:
Verification → Safeguarding Review → Purpose Assessment → Data Protection Review → Necessity & Proportionality Assessment → Disclosure Decision → Secure Response
The University may:
- provide the information requested;
- provide only part of the information;
- provide a summary rather than complete records;
- redact information about other people;
- ask the police for clarification;
- require additional legal authority; or
- decide that disclosure is not justified.
Only the information that is relevant, necessary and proportionate should be shared.
Quick Guide for Staff
Police ask you for information
⬇
Do not disclose or confirm personal information
⬇
Obtain officer details and written request
⬇
Send to Data Protection / Information Governance
AND
Safeguarding
⬇
The University verifies, assesses and responds
Emergency?
If there is an immediate threat to life or serious harm, escalate to Safeguarding immediately and follow emergency procedures. Do not allow the normal written-request requirement to delay action needed to protect somebody.
Key Message
Police information requests should be handled centrally, not individually.
If you receive one, your role is to:
receive it → preserve it → do not disclose → escalate it to Data Protection and Safeguarding.
This protects:
- the person whose information is being requested;
- other people whose information may be contained in University records;
- the integrity of the police investigation;
- the University's safeguarding responsibilities; and
- you as the member of staff receiving the request.
If in doubt, do not disclose. Escalate.