Guidance

Victim information requests: draft code of practice (accessible)

Published 1 December 2025

Presented to Parliament pursuant to Section 44D (6) of the Police, Crime, Sentencing and Courts Act 2022, as amended by Section 28 of the Victims and Prisoners Act 2024

December 2025

Preamble

1. This Code of Practice relates to the introduction of a new statutory duty in Chapter 3A of the Police, Crime Sentencing and Courts Act 2022 (as amended by the Victims and Prisoners Act 2024) referred to as “the Act” in this Code. It should be read alongside the explanatory notes for Chapter 3A. This Code of Practice is issued pursuant to section 44D of the Act, which provides that the Secretary of State must prepare a Code of Practice for authorised persons about victim information requests and compliance with Chapter 3A.

2. The Code will ensure a greater understanding of the duties set out in sections 44A-44C of the Act. Compliance with these duties will support the overall aims of maintaining and improving the trust and confidence of the public in policing.

3. This Code applies to all authorised persons named in section 44E and 44F of the Act. It is a publicly available document and should be readily accessible by any authorised persons who may wish to review it ^{[footnote 1]}.

Part 1: Introduction

4. This Code of Practice provides practical guidance to authorised persons on complying with the duties set out in Chapter 3A of the Act ^{[footnote 2]}.

5. The Code specifies what constitutes a necessary and proportionate ‘Victim Information Request’ (VIR), the circumstances in which the duties set out in sections 44A-44C of the Act apply, and best practice for giving notice to victims and third parties. This will assist in ensuring that authorities exercise their functions in accordance with the law and protect the privacy of those whose information is being requested. The code also sets out when “counselling information requests” will be necessary and proportionate, as required by section 44D(2) of the Act.

6. This Code will refer to a ‘Victim Information Request’ as a ‘Third Party Material (TPM) request’, as this term is more commonly known operationally. In the context of this Code of Practice, “a TPM request” will refer to requests for material relating to a victim of crime held by a third party. (See paragraph 16 for a definition).

7. The authorised persons listed in paragraph 18 and 19 of this Code must have regard to the Code when making a TPM request to ensure they are complying with the duties.

8. The Code will provide support for authorised persons when engaging with the CPS (or the Service Prosecuting Authority (SPA) within the Service Justice System) on a TPM request. Where this code refers to the CPS, the SPA is the appropriate body within the Service Justice System. It also outlines considerations to make when working with vulnerable victims and specific considerations to be made when making counselling information requests.

9. Whilst the Code provides an overview of the existing legal framework, it will not provide specific detail about the application of these laws and should be read in conjunction with the guidance listed in Part 3 of this Code. This Code does not supersede or replace guidance/codes that accompany other pieces of legislation and only aims to clarify the application of the duties in section 44A-44C of the Act.

10. The duties set out in this Code do not include the powers granted by Chapter 3 of the Act relating to the extraction of information from electronic devices. The Code of Practice ^{[footnote 3]} regarding these powers should be consulted where you are seeking information relating to extraction by law enforcement from an individual’s mobile phone or other digital device.

Victim information requests: Key terms

11. A Victim Information Request (VIR) is defined as “a request by an authorised person to another person to provide information which relates to a third person who the authorised person has reason to believe is or may be a victim or at risk of being a victim” (section 44A(2) of the Act)

12. Section (1) of the Victims and Prisoners Act 2024 ^{[footnote 4]} defines a “victim” as a person who has suffered harm as a direct result of:

• (a) being subjected to criminal conduct, or
• (b) one or more of the circumstances mentioned in subsection (2) of that Act

13. “Criminal conduct” is conduct which constitutes an offence (section 1(4)(b) of that Act). Section 1(2) sets out additional circumstances where a person may be a victim, such as where the person has directly experienced the effects of criminal conduct at the time the conduct occurred.

14. For the purposes of assessing necessity and proportionality to prevent, detect, investigate or prosecute crime, “crime” refers to a ―

• (a) conduct which constitutes one or more criminal offences in England and Wales, or
• (b) conduct which, if it took place in England and Wales, would constitute one or more criminal offences (section 44A(6) of the Act)

15. Where these measures apply to service police, crime has a separate and distinct definition.

16. This information is commonly referred to as TPM which is defined in the Attorney General’s Disclosure Guidelines as “…material held by a person, organisation, or government department other than the investigator and prosecutor, either within the UK or outside the UK. Third parties are not directly involved in the case in question but may hold information relevant to it” ^{[footnote 5]}.

17. In criminal investigations, TPM often includes records with an expectation of privacy due to their personal nature, such as medical, education, and social service records, that are held by a third party.

Who are the duties applicable to?

18. The duties set out under sections 44A-44C of the Act apply to the following authorised persons in England and Wales (and to the service police in the whole of the UK (section 44F) (and overseas) when making a TPM request about a victim in the context of the prevention, detection, investigation, or prosecution of crimes, as specified in section 44E of the Act:^{[footnote 6]}

• (a) a constable of a police force in England and Wales
• (b) a member of staff appointed by the Chief Officer of Police of a police force in England and Wales
• (c) an employee of the Common Council of the City of London who is under the direction and control of a chief officer of police
• (d) a constable of the British Transport Police Force
• (e) an employee of the British Transport Police Authority appointed under section 27 of the Railways and Transport Safety Act 2003
• (f) a constable of the Ministry of Defence Police
• (g) a National Crime Agency officer
• (h) a person designated by the Director General of the Independent Office for Police Conduct under paragraph 19(2) of Schedule 3 to the Police Reform Act 2002
• (i) a person who has been engaged to provide services consisting of or including the obtaining of information for the purposes of the exercise of functions by a person mentioned in any of the paragraphs (a) to (i)

19. Section 44F provides that a member of the Royal Navy Police, the Royal Military Police or the Royal Air Force Police (collectively referred to in this Code as ‘service police’), any person designated by the Service Police Complaints Commissioner (SPCC) under regulation 36(2) of the Service Police (Complaints) Regulations 2023 ^{[footnote 7]} and any person who has been engaged to provide services consisting of or including the obtaining of information for the purposes of the service police or SPCC’s functions must also comply with the new duties when making a request for information about a victim for the purpose of preventing, detecting, investing, or prosecuting crimes. With regard to these persons , the duties extend and apply in the whole the UK and when operating overseas. The reference to crime is a reference to conduct which constitutes one or more:

• (a) service offences within the meaning of the Armed Forces Act 2006, or
• (b) SDA offences within the meaning of the Armed Forces Act 2006 (Transitional Provisions etc) Order 2009 (S.I. 2009/1059).” (section 44F(3) of the Act)

20. The Secretary of State has the power to amend the list of authorised persons by regulations made by statutory instrument so as to add, remove or modify a reference to a person (section 44E(2)).

Part 2: Purpose of these duties

21. Section 44A of the Act sets out that TPM requests about a victim may only be made when authorised persons:

• (a) have reason to believe that the person to whom the request is made holds the information sought 44A(3)(a)
• (b) have reason to believe that the information sought is relevant to a reasonable line of enquiry(as per the Attorney General’s Guidelines on Disclosure 2024 44A(3)(b) ^{[footnote 8]}
• (c) are satisfied that the request is necessary and proportionate to achieve the purpose of preventing, detecting, investigating, or prosecuting crimes. A necessary and proportionate request ensures that the victim’s right to privacy is balanced with the defendant’s right to a fair trial. 44A(3)(c)
• (d) Where the request relates to a victim’s counselling information, the authorised person must, additionally, have reason to believe that the information sought is likely to have substantial probative value to a reasonable line of enquiry (see paragraph 86-93). This test does not apply to other forms of TPM. 44A(4)

22. To determine if a request is proportionate, the authorised person must be satisfied that: - (a) there are no other means of obtaining the information sought (section 44A(8)(a)), or - (b) there are such other means, but it is not reasonably practicable to use them (section 44A(8)(b).

23. Please refer to Part 4, “Necessity and Proportionality”, for further guidance on this duty and “Counselling Information Requests” for guidance on the specific process to be followed when making requests for counselling records about a victim.

24. Section 44B of the Act ensures that the victim about whom the TPM request is made is adequately informed that the request is being made, unless inappropriate to do so. For example, it may be inappropriate to notify a victim if to do so would prejudice the investigation (in which case the reason should be recorded for future proofing purposes, such as audits, complaints or FOI requests).

25. Victims should be notified of what information is being sought, why it is being sought, and how the information will be dealt with. Notice must be given in writing, on or before the date on which the victim information request is made (section 44B(3)). Where possible, victims should be given adequate advanced notice to allow them time to consider and reflect on the notice. If that is not reasonably practicable, as soon as is reasonably practicable after that date. The authorised person should consider how failing to give adequate notice could impact the victim.

26. Section 44C of the Act sets out that requests made to third parties who hold TPM about a victim must be made in writing; and specify the information sought, the reasons for seeking the information and how the information will be dealt with once obtained (unless it would be inappropriate to do so).

27. These duties do not supersede or change existing legislation, as set out in Part 3 of this Code, regarding TPM requests in general, but aim to codify and clarify existing expectations, and establish clear and consistent best practice for authorised persons when making a TPM request about a victim.

Legal impact of these duties, and effect of the Code

28. In making a TPM request about a victim or deciding whether to make such a request (including in giving notice under section 44B or deciding whether to give such notice) an authorised person must have regard to the Code of Practice for the time being in force (section 44A(9)).

29. This Code expands upon the policy underpinning the legislative provisions. The contents of the Code are not legally binding though, as set out above, the Act requires authorised persons to have regard to the Code. The Code does not of itself impose additional legal obligations, nor is it an authoritative statement of the law.

30. A failure on the part of authorised persons to act in accordance with the Code does not of itself render the person liable to any criminal or civil proceedings. However, the Code is admissible in evidence in criminal or civil proceedings, and a court may consider a failure to act in accordance with the Code, including in determining the admissibility of the evidence obtained in the proceedings as specified in section 44D of the Act.

31. Any failure to comply with the duty or follow this Code is likely to have serious negative consequences for the victims whether resulting in unnecessary requests of personal information, or by the sharing of information.

32. Authorised persons should act in accordance with any guidance such as codes of conduct or ethics issued by their organisation. Where the authorised person is a police officer or member of police staff the following may apply:

• (a) In England and Wales, failure to follow the Code and use the powers lawfully could result in a breach of the College of Policing Code of Ethics ^{[footnote 9]}, for example the second standard to use powers and authority lawfully and proportionately and in a way which will respect the rights of all individuals.

33. Chapter 3A of the Act does not create new powers to obtain or share TPM either for the authorised persons who may request the data or the third party who shares data in response to such a request. Rather, it imposes statutory restrictions and procedural safeguards around the use of existing powers to make requests by authorised persons. Those requesting and sharing data will require the legal powers to do so.

Part 3: Existing legislative framework and guidance

34. TPM can be requested by the police at any stage during an investigation. The police have recognised broad common law powers to carry out their duty of detecting and investigating crime, including seeking access to information and disclosing information in support of their policing purposes ^{[footnote 10]}. As a result, most requests to third parties for material in the first instance rely on these powers.

35. A third party is typically under no obligation to provide access to material, but most will seek to cooperate where possible. If the third party refuses to provide the material requested, the authorised persons specified in Part 1 of this Code could seek to take other steps to obtain the information. For example, authorised persons may obtain a court order or seek a witness summons as a last resort.

36. In some instances, the Crown Prosecution Service (“CPS”) or the Defence (in any criminal proceedings) may seek TPM regarding a victim ^{[footnote 11]}. These requests are still made through the authorised person. It is therefore the responsibility of the authorised person to ensure that there is lawful basis for these requests. Authorised persons can refer to their local police force procedures for further information on requests originating from CPS (the Service Prosecuting Authority within the Service Justice System) and the Defence.

37. Sections 44A-44C of the Act must be complied with alongside other legal obligations and duties, including the following:

• (a) Human Rights Act 1998 (HRA) ^{[footnote 12]} and European Convention on Human Rights (ECHR) ^{[footnote 13]}
• (b) The Criminal Procedure and Investigations Act 1996^{[footnote 14]} and the Code of Practice^{[footnote 15]}
• (c) Data Protection Act 2018 (DPA)^{[footnote 16]} and UK GDPR^{[footnote 17]}
• (d) The Equality Act 2010^{[footnote 18]}

38. Authorised persons should consider the responsibilities for disclosure of any TPM obtained that may arise and should be familiar with the following guidance:

• (a) The Attorney General’s Guidelines on Disclosure ^{[footnote 19]}
• (b) Crown Prosecution Service (CPS) Pre-Trial Therapy Guidance^{[footnote 20]}
• (c) The Victims’ Code^{[footnote 21]}

Human Rights Act 1998 (HRA) and European Convention on Human Rights (ECHR)

39. The HRA ^{[footnote 22]} gives effect in UK law to the rights set out in the ECHR. Section 6 of The HRA makes it unlawful for any public authority to act in a way which is incompatible with a Convention right.

40. Article 8 of the ECHR sets out the right to respect for their private and family life, home, and correspondence. It provides that there shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society. This includes, among other things, where interference is necessary for the prevention of disorder or crime and for the protection of the rights and freedoms of others ^{[footnote 23]}.

41. Authorised persons must carefully consider:

• (a) whether the TPM request will amount to an interference with the exercise of a person’s rights under Article 8, and
• (b) if so, whether that interference is justifiable (with consideration of the test set out in Article 8 and summarised above).

42. TPM, such as medical records and social service records, are likely to contain sensitive information about the individual. Authorised persons should consider the impact of intrusion into the private life of the victim at all points in the decision-making process – when determining what information is needed to support a reasonable line of enquiry (where applicable), and in determining if the request is necessary, proportionate and that there are no other, less intrusive, means of accessing the required information.

43. When considering Article 8, the authorised person must also consider compliance with other Convention rights, including Article 6 of the ECHR. Article 6 of the ECHR sets out the fundamental right of the accused to a fair trial. It is necessary for authorised persons to consider how the information sought (or a decision not to seek such information) may impact on that right. The Attorney General’s Office has produced guidance on the balance between Article 8 and Article 6 Rights ^{[footnote 24]}.

The Criminal Procedure and Investigations Act 1996 (CPIA)

44. The CPIA and its Code of Practice ^{[footnote 25]} contain provisions designed to ensure that where a criminal investigation is conducted, all reasonable steps are taken for the purposes of the investigation. The CPIA Code makes clear that when conducting an investigation, the investigator should pursue all reasonable lines of inquiry, whether these point towards or away from a suspect. This could include obtaining TPM relevant to the investigation. What is reasonable in each case will depend on the particular circumstances.

45. The CPIA Code of Practice sets out the manner in which police officers are to record, retain and reveal to the prosecutor material obtained in criminal investigation and which may be relevant to the investigation and related matters.

46. The CPIA is designed to ensure that every accused person has the right to a fair trial. It ensures the rights of each party within the investigation and ensures all involved in the investigation have the right to fair disclosure. Part 1 of the CPIA 1996 is concerned with the duties of disclosure on the prosecutor and the accused in criminal proceedings. This is designed to ensure that there is fair disclosure of material to the accused which may be relevant to an investigation, and which does not form part of the prosecution case. In some instances, this may be the basis for the law enforcement request for information. ^{[footnote 6]}

47. The judgment in Alibhai & Ors, v. R [2004] EWCA Crim 681 ^{[footnote 27]} sets out that there is no absolute obligation to obtain information relating to victims that are held by third parties and there must be a “margin of consideration” as to what is required in each specific case. A request for TPM may not always be necessary or appropriate.

48. The Criminal Procedure and Investigations Act 1996 (as amended by the Armed Forces Act 2006) permits the Secretary of State by order to make provisions which are equivalent to those in Part 1 of the CPIA 1996

Data Protection Act 2018 (DPA)

49. Part 3 of the DPA[[18]] ^{[footnote 28]} governs the processing ^{[footnote 29]} of personal data by competent authorities (including the police) for law enforcement purposes i.e. the prevention, investigation, detection or prosecution of criminal offence or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. As a result, all requests by the police for TPM must be processed in compliance with Part 3 of the DPA.

50. Section 3(4) of the DPA defines “processing” in relation to information, as meaning “any operation or set of operations which is performed on personal data or on sets of personal data such as collection, recording, organisation structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”.

51. Any processing information handled in accordance with the DPA 2018 must ensure that any information which has been received from a third party is minimised and that only the data that is needed for the purpose it is being requested is retained.

52. Authorised persons named in section 44E of the Act should consider if they need to complete or update an existing Data Protection Impact Assessment.

Data processing for law enforcement purposes

General overview of DPA responsibilities

53. Part 3, Chapter 2 of the DPA outlines six data protection principles which must be complied with when processing data for law enforcement purposes, summarised below:

• (a) The processing of personal data for any of the law enforcement purposes must be lawful and fair.
• (b) The law enforcement purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and personal data so collected must not be processed in a manner that is incompatible with the purpose for which it was collected.
• (c) Personal data processed for any of the law enforcement purposes must be adequate, relevant, and not excessive in relation to the purpose for which it is processed.
• (d) Personal data processed for any of the law enforcement purposes must be accurate and, where necessary, kept up to date, and every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the law enforcement purpose for which it is processed, is erased, or rectified without delay.
• (e) Personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for the purpose for which it is processed.
• (f) Personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, “appropriate security” includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).

54. Once the information requested under section 44A(3) of the Act for the purpose of preventing, detecting, investigating or prosecuting crime, has been received, the authorised person must comply with Part 3 of the DPA when processing this information.

55. Data protection principles 1 and 3 are of particular relevance to TPM requests:

• (a) processing must be lawful and fair
• (b) personal data processed for any of the law enforcement purposes must be adequate, relevant, and not excessive in relation to the purpose for which it is processed

56. The Information Commissioner’s Opinion ^{[footnote 30]} explains that relying upon a victim’s ‘consent’ in justifying the processing of their data is unlikely to comply with data protection legislation. Because of the perceived power imbalance between the police and a victim, it is unlikely the high threshold of fully informed and freely given consent can be achieved. Hence, the most appropriate approach is to rely on a non-consent lawful basis.

57. In line with the Data Protection Principles ^{[footnote 31]} authorised persons must ensure that the personal data they are processing:

• (a) is adequate to properly fulfil their stated purpose
• (b) has a rational link to that purpose; and
• (c) is limited to what is necessary

58. This will need to be considered when requesting, processing, and retaining data alongside the Management of Police Information (MOPI) Code of Practice ^{[footnote 32]}.

59. Under section 35 of the DPA, special conditions apply when processing for law enforcement purposes is ‘sensitive processing’ ^{[footnote 33]}. ‘Sensitive processing’ means:

• (a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership
• (b) the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual
• (c) the processing of data concerning health
• (d) the processing of data concerning an individual’s sex life or sexual orientation

60. For ‘sensitive processing’ for law enforcement purposes, the authorised person must be able to demonstrate that the processing is ‘strictly necessary’ and that you can satisfy one of the conditions in Schedule 8 ^{[footnote 34]} of the DPA (statutory purposes for reasons of substantial public interest, administration of justice, protecting individual’s vital interests, safeguarding of children and individuals at risk, personal data already in public domain, legal claims, judicial acts, preventing fraud, archiving etc). This type of data needs to be treated with extra care, as collecting it is more likely to interfere with the fundamental rights of an individual or open them up to discrimination ^{[footnote 35]}. Whether the processing of sensitive information is “strictly necessary” will depend upon the facts of each case.

61. The Information Commissioner can investigate and/or take enforcement action if they are alerted of a data breach. The Information Commissioner may use measures such as targeted audits and assessments of individual forces to combat concerns over failure to comply.

62. This Code does not provide a full analysis of all aspects of applicable data protection obligations. Authorised persons should refer to the ICO guidelines ^{[footnote 36]}, and their own guidance on responsibilities under the DPA ^{[footnote 37]}.

The Equality Act 2010

63. Authorised persons must ensure they act in accordance with the Equality Act 2010, including the Public Sector Equality Duty ^{[footnote 38]} which requires public authorities to have due regard to the need to eliminate discrimination, advance equality of opportunity and foster good relations between people when carrying out their duties.

The Attorney General’s guidelines on disclosure

64. The Attorney General’s Disclosure Guidelines ^{[footnote 39]} outline the high-level principles which should be followed when the disclosure regime (framework established under the Criminal Procedure and Investigations Act 1996) for criminal investigations and trials is applied throughout England and Wales. This guidance details that TPM should only be requested in a case if it has been identified as relevant to an issue in the case. This will depend on the circumstances of the individual case, including any potential defence, and any other information informing the direction of the case. Access to TPM should never occur as a matter of course. It should never be assumed that because of the nature of an offence that is being investigated that particular types of material will need to be accessed. There will be cases where no investigation of TPM is necessary at all, and others where detailed scrutiny is needed. There must be a properly identifiable foundation for the inquiry, not mere conjecture or speculation.

Crown Prosecution Service (CPS) Pre-trial therapy guidance

65. This guidance ^{[footnote 40]} provides information on how Pre-Trial Therapy records should be requested and processed. Pre-trial therapy is considered a counselling service for the purpose the duties under this Act and therefore are subject to the enhanced relevance test of ‘substantial probative value’.

The Victims’ Code

66. The Code ^{[footnote 41]} sets out the services that must be provided to victims of crime by organisations, including the police, in England and Wales. This includes providing information to the victim, so they can understand and engage with the criminal justice process. The Code also requires that the police explain where victims can get further information about the criminal justice process and the services they are entitled to as a victim under the Code. Service Police should refer to the Victims’ Code for the Armed Forces ^{[footnote 42]}.

Part 4: Duties under Section 44A

Requesting victim information that is necessary and proportionate, in pursuit of a reasonable line of enquiry

67. Section 44A of the Act sets out the requirements which must be met when making a TPM request about a victim.

68. Requesting TPM about a victim should be the last resort and only considered when all other less intrusive methods to obtain the sought information have been exhausted or are deemed not reasonably practicable to pursue.

69. A TPM request about a victim must only be made where the authorised person:

• (a) has reason to believe that the person they are asking has the information they are seeking (section 44A(3)(a)
• (b) believes that the information is relevant to a reasonable line of enquiry they are pursuing and will pursue (section 44A(3)(b), and
• (c) is satisfied that requesting the information is both necessary and proportionate to help prevent, detect, investigate or prosecute crime (section 44A(3)(c).
• (d) In addition, a counselling information request must only be made if the authorised person has reason to believe that the information sought is likely to have substantial probative value to a reasonable line of enquiry which is being pursued, or is to be pursued, by the authorised person or another authorised person (Section 44A(4)) (see paragraphs 86-93).

Reason to believe the information is held by the person to whom the request is made

70. Authorised persons requesting TPM must have reason to believe that the information contained within the request is relevant to an issue in the case (section 44A(3)(b)), and held by the third party they are requesting from (section 44A(3)(a)) as per the Attorney General’s Guidelines on Disclosure 2022 ^{[footnote 43]}. The threshold test for being able to make a request is where the authorised person has “reason to believe” that the person is a victim – this is a reasonable grounds/belief test, not that they must be established to be a victim beyond reasonable doubt. Any decision to request TPM should be made having considered all pertinent information available at the time, considering the accuracy of the information available and based on more than mere suspicion or speculation on the part of the authorised person.

Relevant to a reasonable line of enquiry

71. Authorised persons must have reason to believe that the TPM request is relevant to a reasonable line of enquiry, and they are bound by the Code of Practice made under section 23 of the Criminal Procedure and Investigations Act 1996 (‘the CPIA’). This places a duty on investigators in England and Wales to pursue all reasonable lines of enquiry whether they point towards or away from the suspect.

72. What constitutes a ‘reasonable’ line of enquiry, and a relevant request for TPM, will depend on the context of the case. A fair investigation does not mean an endless investigation. Authorised persons must give thought to defining and articulating the limits of the scope of their investigations. When assessing what is reasonable and relevant, thought should be given to what is likely to be obtained because of the line of enquiry and how it can be obtained. An authorised person may seek the advice of the prosecutor when considering which lines of enquiry should be pursued where appropriate. When assessing relevance, there must be a properly identifiable foundation for the enquiry, not mere conjecture or speculation.

73. Authorised persons may need to discuss the case with the CPS, as set out in Part 7 of this Code, to determine the reasonable lines of enquiry, and agree the scope of the request. Prosecutors are reminded of the need to provide guidance and support to authorised persons in identifying relevant TPM. Where possible, there should be early engagement with the defence in identifying lines of enquiry to be pursued and any TPM relevant to an issue in the case.

Necessity and proportionality

74. For the TPM request to be necessary the authorised person must be satisfied that:

• (a) the information sought is required to achieve the relevant purpose, e.g., preventing crime
• (b) the purpose cannot be achieved by other less intrusive means

75. For the request to be proportionate, authorised persons must:

• (a) consider if the purpose justifies the intrusion into the person’s privacy
• (b) consider the defendant’s absolute right to a fair trial
• (c) minimise the amount of information requested

76. For example, it may be proportionate to request specific information for serious crimes, such as murder or kidnapping (abduction), but not for lower-level crime, such as anti-social behaviour or minor damage.

77. Whilst each case must be carefully considered, it is highly unlikely that a request for the lifetime records of a victim will meet the necessity and proportionality test ^{[footnote 44]}. This is due to the volume and range of information that may be stored in such records. It is unlikely that all such information will be necessary or proportionate to the line of enquiry.

78. Regarding counselling information authorised persons must start from the presumption that requests for such information are not necessary and proportionate. However, this presumption may be rebutted under the conditions set out in paragraph 84.

Requests for counselling information

79. For the purposes of section 44A(5) of the Police, Crime and Sentencing Act 2022, the specified counselling services for the purposes of a counselling information request is a service, remunerated or voluntary, which offers psychological, therapeutic or emotional support aimed at improving a victim’s emotional, psychological and mental health.

80. Counselling services may be offered by both registered and unregistered individuals. While registration with a professional body can indicate adherence to certain standards and guidelines, it is not a requirement for all counselling providers. Below is a non-exhaustive list of individuals who may undertake activity that falls within the definition of counselling.

Registered on a statutory register

• (a) a person registered with the General Medical Council,
• (b) a person registered with the Health and Care Professions Council,
• (c) a person registered with the Nursing and Midwifery Council, or
• (d) a person registered with Social Work England, or

Registered on an accredited voluntary register

• (e) a person registered on a voluntary register accredited by the Professional Standards Authority for Health and Social Care.

Unregistered

• (f) an independent domestic violence adviser for the purposes of section 16 of the Victims and Prisoners Act 2024,
• (g) an independent sexual violence adviser for the purposes of section 16 of the Victims and Prisoners Act 2024,
• (h) an independent stalking advocate for the purposes of section 16 of the Victims and Prisoners Act 2024, or
• (i) a minister of religion.
• (j) Other unregistered persons

81. There is no standardised method for counsellors to take notes or maintain records. Typically, these records serve as aids during therapy sessions and are not intended for medical assessments or for interpretation. Given their sensitive and confidential nature, if alternative means exist for obtaining the information, such avenues should be explored first. It may be challenging to demonstrate the necessity and proportionality of requesting this information.

82. In making such requests, authorised persons will need to be considerate of the sensitivity of this type of material and how it may impact the wellbeing and experience of victims by considering Part 8 of this Code on vulnerable victims. As such, counselling information requests are subjected to a distinct approach, as outlined below. This approach ensures that requests for counselling records consider the unique circumstances of the case and recognise the importance of respecting individuals’ privacy and therapeutic relationships.

Presumption and rebuttal

83. Authorised persons should start with the presumption that requests for counselling information are not necessary and proportionate.

84. To rebut this presumption (and so determine that requesting counselling information is necessary and proportionate) authorised persons must consider the following factors (as well as any other relevant information):

• (a) whether there is compelling evidence or reasonable grounds to suggest that the information contained within the counselling notes is likely to have substantial probative value (see paragraph 86-93) to the investigation and cannot be reasonably obtained through other means
• (b) whether all less intrusive alternatives for obtaining the required information have been exhausted or deemed impractical
• (c) whether there are any specific circumstances or factors unique to the case that justify accessing the counselling notes
• (d) whether they have carefully considered the potential consequences for the victim’s privacy and wellbeing, as well as the potential views of the victim, and have concluded that the benefits of accessing the counselling notes outweigh these concerns
• (e) whether there is information to suggest the failure to obtain the records could adversely affect the accused’s right to a fair trial

85. By making the above considerations, authorised persons should be able to determine whether a request for counselling notes is necessary and proportionate as part of a reasonable line of enquiry. It is recommended a record of these considerations is kept.

Substantial probative value

86. In addition to meeting the necessity and proportionality test, authorised persons must satisfy a further test of likelihood of “substantial probative value” to a reasonable line of enquiry when requesting counselling records (section 44A(4)).

87. “Substantial probative value” refers to the meaningful evidential significance of the information contained within the counselling records.

88. The “substantial probative value” test focuses on the likelihood that the evidence will add significant value or substance to the point being investigated. It goes beyond just relevance to assess the weight and worth of that evidence in the context of the investigation, imposing a higher threshold than for other types of material and going beyond the relevance test set out by the CPIA Code of Practice ^{[footnote 45]}.

89. Assessing the “substantial probative value” of counselling records is inherently fact-sensitive and requires a careful consideration of the specific circumstances and objectives of the investigation. It is strongly recommended authorised persons seek early advice from the CPS as set out in Part 7 of this Code.

90. In assessing “substantial probative value” authorised persons should consider whether the information being sought within the counselling records:

• (a) relate to key aspects of the investigation essential for advancing the reasonable line of enquiry being pursued
• (b) is likely to provide meaningful support to the investigative narrative such as corroborate or refute the existing narrative
• (c) has the potential or is likely to substantially contribute to establishing or refuting critical facts of the investigation
• (d) might reasonably be considered capable of undermining the case for the prosecution against the accused, or of assisting the case for the accused
• (e) there is likelihood it may significantly influence the outcome or direction of the case under investigation, considering its potential to corroborate or contradict other evidence gathered

91. The following factors are not sufficient on their own to establish whether the information within the counselling records is likely to have “substantial probative value”:

• (a) that the record exists
• (b) that the records relate to therapy or counselling that the victim has received or is receiving
• (c) that the records merely: relate to the incident under investigation, and / or contain an account of the facts of the offence by the victim
• (d) that the relevance of the counselling records to the investigation is purely speculative or conjectural
• (e) that there is speculation that the records may relate to the credibility or reliability of the victim, solely based on their receipt of counselling
• (f) that the records may relate to the reputation of the victim
• (g) that the records relate to the sexual activity of the victim with any person, including the accused
• (h) that there is a possibility that the records may reveal allegations, unrelated to the offence under investigation, of abuse to the victim by a person other than the accused
• (i) that the records were made close in time to a complaint or the activity forming the subject matter of the investigation

92. These considerations may be used as guidance but are not exhaustive. Authorised persons will be required to make thorough considerations on a case-by-case basis before making a request for counselling records about a victim.

93. In making a request for counselling records, authorised persons should upgrade the level of seniority required to review and approve requests for counselling records. This may include a Chief Inspector, and (in the case of the service police) an Authorising Service Police Officer who should be of or above the rank of Lieutenant Commander (Royal Navy), Major (Army or Royal Marines), or Squadron Leader (Royal Air Force), or Chief Inspector equivalent.

Risk of obtaining other information

94. When making a TPM request, authorised persons must consider whether there is a risk of obtaining information other than information necessary to achieve the purpose for which the request is being made (section 44A(7)).

95. Other information might include:

• (a) personal information in the TPM that is about the victim but not necessary for the purpose
• (b) information in the TPM that is about a third party and not necessary for the purpose – for example, when a parent(s) details are contained in their child’s medical records

96. If there is a risk that excess information to what is necessary will be obtained for the request to be proportionate, an authorised person must be satisfied that all other avenues for accessing the information have been exhausted or are deemed not reasonably practicable to pursue.

97. Information which has been obtained from a third party and is deemed not relevant to the investigation must be deleted or discarded appropriately unless there is a lawful basis to retain it. Any decisions regarding the retention or deletion of information should be considered in line with relevant disclosure guidelines ^{[footnote 46]}.

98. The test of what is reasonably practicable during an investigation is an objective fact-sensitive test, taking account of all the relevant circumstances. This is intended to ensure that in certain cases, for example where there is a time critical need for the information to protect life or prevent harm, that authorised persons can seek TPM.

99. Where alternative methods are used to obtain the information, any existing legislation and relevant local guidance should be followed. Delays to an investigation due to the request or return of alternative forms of information alone would not provide sufficient justification not to pursue an alternative method, unless there was a real and immediate risk of harm.

100. If, after considering necessity and proportionality (including the risk of obtaining other information), the authorised person is satisfied that the request is proportionate, they can proceed but should minimise the risk of obtaining other information as far as is practically possible. This should include use of date ranges or other specifics in the request to identify necessary information.

Part 5: Duties under Section 44B

Provision of information to the victim about whom the information is being requested

101. Section 44B of the Act requires notice of the request to be given to the victim about whom the information is sought and sets out the requirements of such notice.

Written notice

102. The authorised person must provide the victim with a written notice (in hard copy or electronic form), specifying:

• (a) the information that is sought (section 44B(2)(a))
• (b) the reason why the information is sought, (e.g., how it constitutes a reasonable line of enquiry, and how it meets the necessity and proportionately requirements) (section 44B(2)(b))
• (c) how the information will be dealt with once it has been requested. (e.g., who it will be shared with and how long it may be retained for) (section 44B(2)(c))

103. In addition, as best practice it is recommended that authorised persons include the following additional information in the written notice that will aid the person in understanding the process and their rights:

• (a) what a TPM request is
• (b) why the consent of the victim, to make the request, has not been sought

• (c) the other, less intrusive methods, the authorised person has considered to obtain this information, and if any were identified, why they have not been followed

• (d) how any collateral information obtained will be managed

104. Further details about cases where the victim is a child, or an adult without capacity, are explained in Part 8 of this Code. Where there is any doubt as to their understanding, additional support should be provided to the victim to assist them in giving their views.

105. Authorised persons must give the written notice, either in hard copy or electronic format, on or before the date on which the TPM request is made. (section 44B(3)). Where possible, victims should be given adequate advanced notice to allow them time to consider and reflect on the notice. The authorised person should consider how failing to give adequate notice could impact the victim.

Seeking the views of a victim

106. Once the victim has been informed of the TPM request, they should, where reasonably practicable, be able to make representations and have their views sought and recorded.

107. For the purposes of data protection victim consent is not the appropriate approach for a TPM request, as set out in paragraph 56 of this Code. It is best practice for authorised persons to encourage and support victims to share and record their views regarding the request. If the victim raises any objections to some or all the material being requested, the authorised person should discuss this with the victim and consider the objections and the impact on the investigation of not proceeding to request the material. Victims should be clearly informed that objecting to a TPM request will not result in their case being automatically discontinued. In some cases, the authorised person may still need to proceed with the request after considering the objections from the victim. This may include cases where the request is necessary to safeguard the victim, or in order to ensure the accused’s right to a fair trial. In these cases, where appropriate, the reason for continuing to pursue the request should be explained to the victim. Authorised persons should give due regard to the method of communication, and language used.

108. If the victim is a child or an adult without capacity, different considerations should be made. Further details are provided in Part 8 of this Code.

109. In all cases, the authorised person must consider the victims’ needs and vulnerabilities as outlined in Part 8 of this Code and take the action necessary to provide them the support needed to understand the request and share their views. Authorised persons may wish to involve several different professionals during this process, for example, a language interpreter, an intermediary, an Independent Domestic Violence Advisor (IDVA), a social worker or an Independent Sexual Violence Advisor (ISVA) to support the victim and ensure their needs are taken into consideration.an intermediary, an Independent Domestic Violence Advisor (IDVA), a social worker or an Independent Sexual Violence Advisor (ISVA) to support the victim and ensure their needs are taken into consideration.

110. The victim may require additional time to consider the request. Authorised persons should consider this and grant additional time where it is reasonable to do so. If more time is granted, it is the responsibility of the authorised person to record this and manage the request.

111. A record should be kept of the written notice, as it may be requested at a later stage to confirm that the victim was informed of the request, that their views were sought and accounted for.

112. Victims should be made aware that the TPM may be shared with the CPS, and that they will be informed if this is shared with anyone outside of the CPS. This may include the defendant defence counsel, suspect, and the court. Authorised persons are responsible for redacting personal (to which careful consideration should be given) and sensitive personal data from material received from third parties and information sent to the CPS, unless the disclosure of that data is required for a law enforcement purpose.

Exceptions where a notice is not required

113. The authorised person need not give notice under this section or specify a particular matter when giving notice, if the authorised person considers that doing so (section 44B(5)):

• (a) is not reasonably practicable in the circumstances (section 44B(5)(a));
• (b) might interfere with the investigation or enquiry for which the information is sought, or any other investigation or enquiry which is being pursued, or will be pursued in the future by the authorised person or another authorised person (section 44B(5)(b));
• (c) might risk causing serious harm to the victim or another person (section 44B(5)(c)).
• (d) It is expected that section 44B(5)(a) would apply in exceptional circumstances. Examples of these may include where there is a time critical need for the information to protect life or prevent harm.
• (e) If it has been decided that the victim will not be informed and therefore their views will not be obtained, this should be recorded in writing. It is best practice for this to be signed off by an appropriate authority.
• (f) If the victim cannot be located or contacted, and it is not reasonably practicable to wait for them to be located before requesting TPM, this should be recorded in writing, and signed off by the appropriate authority.
• (g) If a victim is missing, a next of kin, parent or guardian should be notified of the request but no views would be obtained.
• (h) If a victim is deceased, there is no obligation to notify anybody or obtain views.

Sign-off for a TPM request

114. As best practice, TPM requests should be reviewed and signed off by an appropriate authority. This can include; an Inspector (or above), an Authorising Service Police Officer is to be of or above the rank of Lieutenant (Royal Navy), Captain (Army or Royal Marines) or Flight Lieutenant (Royal Air Force), or Inspector equivalent. The Inspector rank reflects the level of consideration that is required when considering a request for personal data that may feel intrusive to the victim, particularly where concerns or objections are raised.

115. Authorised persons should upgrade the level of seniority required to review and approve requests for counselling records. This may include a Chief Inspector, and an Authorising Service Police Officer who should be of or above the rank of Lieutenant Commander (Royal Navy), Major (Army or Royal Marines), or Squadron Leader (Royal Air Force), or Chief Inspector equivalent.

116. It is recommended that the sign off should confirm:

• (a) that information contained within the request has been completed accurately
• (b) that the request contains the required information and considerations, and the rationale has been recorded
• (c) that the request is in pursuit of a reasonable line of enquiry, and relevant to an issue in the case
• (d) that the amount of information being requested has been minimised, and that clear parameters have been applied so this is not a generic request for material
• (e) that this is the most proportionate way to obtain the information and it is not reasonably practicable to use any less intrusive means
• (f) that the right support was provided to the victim, and that the appropriate authority is confident the victim fully understood the request
• (g) that where any objection has been raised by the victim, the request remains necessary and proportionate, and the objection has been noted in writing
• (h) that, for counselling information requests, the authorised person has made thorough considerations and has justified their assessment that the presumption that the request is not necessary or proportionate has been rebutted and that the information is likely to have “substantial probative value” (see paragraph 86-93).

117. If the form is rejected by the authorising officer, this decision should be recorded in the case file. If it is considered appropriate to continue with the request, another request form should be completed, and consideration should be given to why the initial request was not approved. The new request should be discussed again with the victim, and authorised persons should consider the impact of discussing the details of the offence again with the victim. Approval should be sought from an appropriate person for the new request.

The complaints process for the handling of a TPM request

118. Victims must be made aware of the complaints process should they have any concerns with the handling of their request. Complaints can be made through the following routes:

• (a) directly to the police force using the force’s local complaints procedure
• (b) The Independent Office for Police Conduct (IOPC) if the complaint is regarding the police ^{[footnote 47]} or in the case of the Service Police, the Service Police Complaints Commissioner (SPCC) ^{[footnote 48]}
• (c) The Information Commissioners Office (ICO) if the complaint is regarding how an individual’s data has been processed or used ^{[footnote 49]}.

Part 6: Duties under Section 44C

Provision of information to the third party from whom the information is being requested

119. Section 44C of the Act sets out what must be included in the content of a TPM request about a victim.

120. Authorised persons should determine and specify how the third party will provide TPM. This may include:

• (a) collecting a copy of the data in person
• (b) sending a copy of the data by secure email
• (c) sending a copy of the data by Royal Mail signed for delivery

Provision of information to the third party

121. The information provided to the third party must:

• (a) Section 44C(1)(a) Specify or describe the information sought (e.g., medical records from a specific date range, or a medical note)
• (b) Section 44C(1)(b) Specify the reason why the information is sought; and
• (c)- Section 44C(1)(c) Specify how the information will be dealt with once it has been obtained

122. In addition, it is recommended as best practice that authorised persons include the following additional information in the written notice that will aid the third party in actioning the request which may include:

• (a) any deadline by which the material should be provided, and a reason why the material is needed by then
• (b) if and how the victim would like to be contacted by the third party
• (c) confirmation that the views and concerns of the victim have been sought and recorded accurately; and
• (d) confirmation that the request has been signed-off by an appropriate authority

123. Authorised persons may not need to specify the reason why the information is sought or how it will be dealt with once it has been obtained, if they consider that doing so:

• (a) is not reasonably practicable in the circumstances (section 44C(2)(a)), or
• (b) might interfere with the investigation or enquiry for which the information is sought or any other investigation or enquiry which is being pursued, or is to be pursued, by the authorised person or; another authorised person (section 44C(2)(b)), or
• (c) might risk causing serious harm to the person to whom the information sought relates or another person (section 44C(2)(c))

124. Where it is not reasonably practicable to provide information relating to the investigation to the third party, a general statement detailing that there is an active criminal investigation may suffice.

125. A separate request should be made to each third party from whom material is being requested.

Third party response to the request

126. Authorised persons may ask the third party to provide any additional information they believe may be of relevance. The third party is the legal owner of the information and therefore has no obligation under CPIA or the DPA to release the requested material or additional material to an authorised person.

127. If the third party refuses the TPM request, authorised persons should seek to understand why the request was rejected and assess whether alternative means to obtain the information will be necessary. This may include a court order, or a witness summons ^{[footnote 50]} as a last resort. This should be communicated to the CPS via an Investigation Management Document ^{[footnote 51]} (or equivalent for SPA within the Service Justice System) allowing the authorised person to be transparent with the defence and court and ensure compliance with disclosure obligations.

128. Where requested information is no longer held by a third party (e.g., due to retention periods), authorised persons should consider whether this is still a reasonable line of enquiry and if so, consider whether there is an alternative means of accessing the information.

129. It may be necessary to invite third parties to preserve material ahead of a formal, written request from the authorised person. Authorised persons should explain to the third party; why this is necessary, what material should be preserved, and for what purpose. This should be detailed in writing and recorded.

130. Third parties are obligated to consider the lawful basis for sharing information with the authorised person and must determine this themselves ^{[footnote 52]}). They must also consider whether the sharing of the information is compliant with the data protection principles.

131. Where material is obtained from third parties, authorised persons should have regard to, and make note of, any handling instructions assigned to the material. This may include concerns about onward sharing of the data, and the storage or return of the material. Should the third-party response direct that that none of the material is suitable for onward sharing with the defence, irrespective of redaction, both the material itself and the form used to make the request should also be classified as Sensitive under CPIA. The third party’s view must also be passed to the prosecutor.

132. The third party may also attach conditions to the treatment of the data, and these should be described alongside the return of the information.

133. Authorised person should ensure that the information obtained is processed appropriately, in accordance with data protection legislation, including DPA 2018, and (where relevant) UK GDPR. ^{[footnote 53]}

134. If the third party will only allow the material to be viewed on site, this should be recorded in the case file by the authorised person. There may be occasions where the third party permits inspection of such material but will not allow the authorised person to retain copies. In those circumstances the authorised person should record and describe all the relevant material which has been inspected, in a document stored in the case file (including the Investigation Management Document). Where upon inspection material is not considered to be relevant because it is incapable of having any bearing on the issues in the case, a brief explanation should be noted.

135. If new lines of enquiry arise during an investigation, the authorised person should contact the third party through a new request, setting out the parameters. As laid out in section 44b of the Act the victim must be notified, and (as outlined above) this should be discussed with the victim and their views should be obtained.

Overseas requests for TPM

136. The guidance contained within this Code provides best practice and applies to Mutual Legal Assistance (MLA) where an authorised person requests TPM to assist an overseas criminal investigation, or proceedings pursuant to a mutual legal assistance request, or on a law enforcement basis. This Code should be considered alongside guidance specific to MLA.

137. Service police functioning overseas should follow this Code as best practice when requesting TPM.

Part 7: Engaging with the Crown Prosecution Service (CPS)

138. Authorised persons are encouraged to work collaboratively with the CPS when considering TPM.

139. Authorised persons are advised to seek ‘Early Advice’ from the CPS where appropriate. Early Investigative Advice or ‘Early Advice’ is the process of prosecutors providing guidance and advice to help police “to determine the evidence that will be required to support a prosecution or to decide if a case can proceed to court”. ^{[footnote 54]} The College of Policing ‘Early Advice Protocol’ should be followed to ensure a proportionate approach is taken in relation to gathering TPM. For example, it is strongly recommended to seek early advice in rape and serious sexual offence cases ^{[footnote 55]}.

140. Authorised persons should work with the CPS to agree whether information held by a third party would assist with pursuing a reasonable line of enquiry, and if so, any parameters which should be applied to the TPM request to ensure that the request is necessary and proportionate. Service police should refer to guidance from the Service Prosecuting Authority ^{[footnote 56]}.

141. Where appropriate, it is recommended that ‘Early Advice’ is sought in advance of making a request for TPM about a victim ensuring early engagement between CPS and authorised persons. Early Advice is also strongly recommended to aid with the assessment of necessity and proportionality and “Substantial Probative Value” of counselling information requests about victims as set out in Part 4 of this Code.

142. Authorised persons may be asked to make a request for TPM by the CPS and/or defence. It is the responsibility of the authorised person to ensure their compliance with the duties set out in this Code when making TPM requests. When it is not clear whether the TPM request is in line with the duties, authorised persons are advised to consider the following options:

• (a) escalating the concern to an appropriate authority and seek their guidance on whether the request is necessary and proportionate
• (b) discussing the concern with the CPS and/or defence and work collaboratively to redefine the request

Part 8: Use of the Code of Practice with vulnerable victims

143. The purpose of this part of the Code is to offer guidance on what authorised persons should consider when complying with the duties in section 44A-44C of the Act where the victim is vulnerable.

144. This part focuses on vulnerable victims of crime, who may have experienced trauma and who may need more support to understand the TPM request and share their views. In all cases where authorised persons are considering a request for TPM, they should consider if a person is vulnerable and whether more support is needed to understand the request.

145. Where the victim is a child or adult without capacity, an authorised person should follow the guidance set out in part 8 of this Code.

146. Authorised persons should be aware of their existing responsibilities to protect the rights of victims. Guidance can be found in the Victims Code ^{[footnote 57]}.

What does vulnerable mean?

147. There is no single legal definition of ‘vulnerable’. For the purposes of these duties, a victim can be considered vulnerable if they require some level of additional support in understanding a TPM request and sharing their views.

148. Authorised persons should be aware that someone may have an invisible and hidden vulnerability, or that they may try to hide their vulnerability. There are many reasons for this such as fear, shame, past experiences of engaging with authorised persons or because they do not view themselves as vulnerable. Authorised persons should consider if a person may be vulnerable in every case when determining how to comply with the duties set out in this Code.

149. The College of Policing have said that “a person is vulnerable if as a result of their situation or circumstances, they are unable to take care of or protect themselves, or others, from harm or exploitation” ^{[footnote 58]}.

150. In addition, authorised persons should consider if a person is vulnerable due to a protected characteristic, such as race and/or disability, where minority status may result in someone feeling less able to engage with them. When this is the case, they should be offered to be referred to a specialist organisation where the service or support is available.

151. Many victims experience stress and fear during the investigation of a crime. Stress can affect the quantity and the quality of the communication with, and by, the individual concerned. Authorised persons should be mindful of hidden vulnerabilities caused through disability, shock, or trauma.

152. Where a victim is deemed vulnerable, authorised persons should make them aware that they can have additional support to help understand the TPM request. Authorised persons should take all reasonable steps to ensure that this support is accessible. The support may come from a range of persons or specialist support services – for example, from a family member, a friend or, in a case of a sexual offence, an Independent Sexual Violence Adviser ^{[footnote 59]} or other specialised advisors, where the service is available.

153. Where the person does not speak English, the services of an interpreter should be provided. Where a person is deaf, it may be necessary to obtain the services of a British Sign Languages (BSL) interpreter if there is no other support available at the time. If there is any doubt as to whether the support available can facilitate communication to the required standard, a BSL interpreter should be provided.

154. The following list can be used as guidance for determining if a person may be vulnerable and whether they require additional, independent support when being informed about a TPM request about them. This is not an exhaustive list. The needs of the individual must be carefully considered on a case-by-case basis, considering both the nature of the investigation and their involvement in it. If the authorised person is unsure whether a person is vulnerable, it may be appropriate to assume that a level of vulnerability exists, particularly for victims where someone has been physically or mentally harmed.

155. Examples of people who may be vulnerable:

• (a) someone who has been the victim of a crime which may be particularly traumatic, such as rape or sexual assault
• (b) someone who has been the victim of violent crime
• (c) someone who has been the victim of domestic abuse
• (d) someone who has been the victim of stalking
• (e) someone who has been the victim of people trafficking
• (f) someone who is an asylum seeker or undocumented person
• (g) someone who fears repercussions from working with authorised persons to further an investigation – for example, a whistle-blower
• (h) someone who is suffering from fear or distress
• (i) someone who is suffering from a mental disorder
• (j) someone who has difficulty with social functioning
• (k) someone with a physical disability
• (l) someone on the autistic spectrum
• (m) someone with learning difficulties
• (n) someone who has difficulty in understanding what is being communicated to them (including language barriers)
• (o) someone who has difficulty reading or writing

156. Authorised persons should recognise that a victim may have several different vulnerabilities and that an offender may have taken advantage of these vulnerabilities as part of the crime. In their approach to engagement, authorised persons should consider how the vulnerabilities overlap and interact to provide the correct support. For example, the approach to someone who is vulnerable due to trauma and fear of repercussions of reporting a crime, will be different to someone who is vulnerable due to trauma and has learning difficulties, and is reporting a crime.

157. Authorised persons must follow any existing legislation and local guidance regarding vulnerable people as appropriate to the specific case, in addition to this Code.

Working with vulnerable people

158. The possibility that authorised persons will request personal and sensitive information has been found to be a principal reason why victims of rape may withdraw from the criminal investigation process or may choose not to report the crime at all. Authorised persons should therefore be mindful that victims of such crimes may be particularly concerned about requests for their information.

159. Authorised persons may need to go further to support and appropriately account for the needs of a vulnerable victim when informing them about a TPM request. For example, where an individual is in shock, such that they are unable to comprehend what they are being informed about, authorised persons may need to wait until such a time that the shock or effects of it have receded sufficiently for the person to understand. It must be assessed whether the individual is, at the time the notification is to be made, the person lacks capacity within the meaning of the Mental Capacity Act 2005 ^{[footnote 60]}. Under the Mental Capacity Act (MCA) 2005 ^{[footnote 61]}, temporary inability to make a decision because of an impairment of, or a disturbance in the functioning of, the mind or brain would still count as lack of capacity. For the purpose of this Code it is recommended that where an adult temporarily lacks capacity, notification and engagement with that victim in relation to the TPM request is not done until such a time that the person has capacity; the processes for an adult without capacity are intended primarily for use where an adult has a long-term lack of capacity and not for cases of fluctuating capacity where someone who would ordinarily be able to make decision for themselves is temporarily unable to do so. If it is not possible to wait until such time, then in cases of fluctuating capacity where notification relating to the TPM request is made at a point in time where the individual lacks capacity, the section below in relation to Children and Adults without Capacity must be followed.

160. Trauma can impact comprehension and communication, so it is important that authorised persons familiarise themselves with their organisational guidance on how to recognise and support and engage with victims who are suffering from trauma.

161. Authorised persons should strongly consider whether to seek the support of an independent advisor for the vulnerable person, for example, an Independent Guardian, an Independent Sexual Violence Advisor (ISVA), an Independent Domestic Violence Advisor (IDVA), a learning disability advocate or an Independent Mental Health Advisor (IMHA) where available to support to the individual. In all cases authorised persons should ensure that the victim feels comfortable with the choice of person as their independent advisor and their specific role. Authorised persons should also consider that professional advisors may be able to offer a different type of support than a family member or friend, and hence, they should decide on a case-by-case basis what support to seek.

162. Although an individual may seek support with understanding the TPM request and sharing their views, the views recorded must be theirs. Authorised persons should ensure the individual has sufficient time to understand the TPM request and share their views and concerns.

163. If, because of their vulnerability, the individual cannot understand the TPM request and written notice, the authorised person should offer the victim the option of having a person providing independent support read the TPM request and notice out loud to the individual if they are unable to read or comprehend the material on their own and explain it to them in clear and simple terms for example using everyday language, short sentences avoiding legal and technical jargon. If the person providing support is unavailable to do so, then authorised persons may need to explain the contents of the form and read it out loud to the victim.

164. If language is an additional barrier to understanding what is being asked of the individual, an interpreter should be made available. The victim may already have someone providing independent support and so they may be able to assist with this, however it is the responsibility of the authorised person to ensure an interpreter be made available.

165. In all cases when dealing with a vulnerable victim, the utmost sensitivity and support should be exercised to ensure that the vulnerable victim understands what they are being informed about and to ensure that their trauma is not further exacerbated because of engaging in an investigative process.

166. If you are unsure about the level of support a person requires you should consult a supervisor or review appropriate guidance in your organisation.

Privacy impact and vulnerable victims

167. It is highly likely that TPM regarding a victim will contain sensitive personal information about them or other persons, and authorised persons must consider the individual’s Article 8 right ^{[footnote 62]} to respect for their private life before any sensitive information is requested. Authorised persons should act in the knowledge that requesting access to this kind of information about a victim from a third party will be an incredibly difficult experience and particularly where the person is vulnerable. Victims of rape and sexual offences may be less willing to proceed with the criminal investigation process if they are concerned about their sensitive, personal information being disclosed during the investigation process and generally, victims may feel as if they are the ones being investigated.

168. In all cases, before making a TPM request, authorised persons must consider other, less intrusive methods for obtaining the required information. This is particularly important when there might be an acute privacy impact on a vulnerable victim.

Safeguarding and vulnerable victims

169. When making a TPM request in relation to a vulnerable victim, there are certain measures that should be taken to ensure they are adequately safeguarded.

170. Engaging in an investigation can be an especially traumatic experience for vulnerable victims. To account for this, authorised persons should make appropriate adjustments and consider the needs of the victim and where they will be most comfortable and able to communicate. Being in a police station may be intimidating, but equally it may be the case that they don’t want the police to attend their home address for many different reasons. In every case the individuals’ needs must be carefully considered.

171. A vulnerable victim and, if appropriate, their support representative, independent advisor, independent guardian family friend, should be referred to the relevant services (social services, counselling, independent guardian service etc) if ongoing professional support is necessary.

Children, and adults without capacity

172. This part of the Code gives guidance on cases where the victim is a child, or an adult without capacity. Children, and adults without capacity, may not be able to understand the request, and share their views and concerns themselves. This section sets out who should be informed of the request on their behalf (‘the alternative individual’) and what should be considered by the authorised person and the alternative individual.

Children

173. For the purposes of these duties, a child is a person under the age of 18.

174. The following people should be given the notice about a TPM request concerning victim information about a child:

• (a) a parent or guardian of the child, (section 44B(4)(a))
• (b) if the child is in the care of a relevant authority or voluntary organisation, a person representing that authority or organisation, (section 44B(4)(a))
• (c) if no person described above is available, an alternative adult who the authorised person considers appropriate (section 44B(4)(b))

175. “Parent” includes a biological parent, an adoptive parent, a step-parent who has been granted legal parental responsibility and a parent by virtue of the Human Fertilisation and Embryology Act 2008 (for example, a second female parent).

176. ”Guardian” means another person who has been granted legal parental responsibility, a person who has been appointed as a guardian by court order or by a will (where the parents are deceased), or a person who, in practice, carries out the day-to-day care of a child, such as a local authority approved kinship or foster carer. Authorised persons should be clear about and record the status of the parent or guardian who is making the decisions.

A person representing a relevant authority or voluntary organisation

177. If the child is in care and it is not appropriate for the notice to be given to a parent or guardian, then a person representing the relevant authority or voluntary organisation providing care to that child can receive the notice instead. This should, unless not possible in the circumstances, be a person known to the child. The same approach should be taken in other circumstances in which it would not be appropriate to give notice to the parent or guardian. For example, where there are safeguarding concerns, but the child remans in the care of the parent or guardian.

178. In all cases, the authorised person must satisfy themselves that there is no conflict of interest for the person who is required to represent the best interests of, or act for the benefit of, the child. In the case of where the suspect is someone within the same organisation that supports the child, for example their social worker, it is recommended that the support is obtained from a person unconnected to that organisation. Careful consideration must always be given as to the status of the person receiving the notice on behalf of the child and their role in the investigation.

179. A responsible person, who must be 18 or over, should only be used as a last resort if a parent or guardian, or a person representing a relevant authority or voluntary organisation is unavailable to be notified of the request. Unless inappropriate to do so, authorised persons should contact a parent, guardian or person representing the relevant authority or voluntary organisation responsible for the child before turning to another responsible person. Best practice is to wait for such a person to be available to be notified.

180. The responsible person should not be a suspect in relation to the enquiry for which the TPM request is being made and should ideally have an existing caregiving relationship with the child.

Obtaining the views of the child

181. The views of the child should always be obtained unless it is determined after a full consideration on their competence that it is impossible to do so. Authorised persons should have regard to the views ascertained. For 16- and 17-year-olds in particular the starting point should be an assumption that they have the capacity to state their views’ , taking account of the child’s age and maturity, particularly in the context of children between 16 and 17 years old.

182. A child’s competency to give their views depends on their understanding not their age ^{[footnote 63]}. It may not always be clear whether the child can express their views or understand what is being asked of them, and therefore the authorised person should consider:

• (a) their understanding of the issue
• (b) their understanding of the information which has been given
• (c) their understanding of any alternative options, such as disagreeing with the request
• (d) their ability to explain their reasoning around the views they have given

183. This consideration should be informed by principles such as Gillick Competence, recognising that a child’s ability to contribute meaningfully to decisions depends on their understanding, not their age. Even where full informed views cannot be given, the child’s voice should still be heard, respected, and supported through expert-informed approaches.

184. This means where appropriate, and where the child is reasonably locatable, their views should be sought and recorded. Authorised persons should have due regard to any views obtained before proceeding with the request as set out in paragraph 106.

185. Very young children and those with significant learning or mental health needs may be incapable of expressing an informed view on the TPM request. However, even if they cannot provide an informed view, their feelings, reactions, and emotional responses still matter and should be actively listened to, acknowledged, and considered in the decision-making process.

Adults without capacity

186. In relation to England and Wales, a person is an ‘adult without capacity’ if, within the meaning of the Mental Capacity Act 2005 ^{[footnote 64]}, they lack capacity in relation to a TPM notice (i.e. to understand the TPM request and share their views). The assessment of whether they lack capacity to understand the notice should be made at the point in time when the authorised person intends to give the notice.

187. The processes for an adult without capacity are primarily intended for use where an adult has a long-term lack of capacity and not for cases of fluctuating capacity where someone who would ordinarily be able to make decision for themselves is temporarily unable to do so. In cases of fluctuating capacity, and the adult lacks capacity at the point in time when the notification is given (and it is not possible to wait until a point of time when the adult has capacity), then the processes for an adult without capacity must be applied.

188. In this regard, authorised persons must have in mind the principles set out in section 1 of the Mental Capacity Act 2005.

189. The following people must be given notice about a TPM request concerning information about an adult without capacity:

• (a) a parent or guardian of the victim

• (b) if the victim is in the care of a relevant authority or voluntary organisation, a person representing that authority or organisation
• (c) or if no person described above is available, any adult who the authorised person considers appropriate (ideally, a trusted other such as a friend or carer)

195. “Parent” includes a biological parent, an adoptive parent, a stepparent who has been granted legal parental responsibility and a parent by virtue of the Human Fertilisation and Embryology Act 2008. (for example, a second female parent)

190. “Guardian” means another person who has been granted legal parental responsibility, a person who has been appointed as a guardian by court order or by a will (where the parents are deceased), or a person who, in practice, carries out the day-to-day care of the adult without capacity. Authorised persons should be clear about and record the status of the parent or guardian who is making the decisions.

191. The term ‘Guardian’ includes adults who have been appointed to the role of guardian by a court.

A person representing a relevant authority or voluntary organisation

192. If the adult without capacity is in the care of a relevant authority or voluntary organisation and it is not appropriate for the notice to be given to a parent or guardian, then a person representing the relevant authority or voluntary organisation providing that care can receive the notice instead.

193. In all cases, the authorised person must satisfy themselves that there is no conflict of interest for the person who is required to represent the best interests or act for the benefit of the victim where they are an adult without capacity. In the case of where the suspect is someone within the organisation that supports the adult without capacity, for example a care worker, it is recommended that the support is obtained from a person unconnected to that organisation. In all cases, careful consideration must also be given to the status of the person receiving the notice and their involvement in the investigation.

Obtaining the views of the adult without capacity

194. Authorised persons should, so far as it is reasonably practicable to do so, ascertain the views of the adult without capacity and have regard to any views so ascertained, taking into account the conditions that affect their capacity.

195. Authorised persons should consider if any additional support is required for the adult without capacity, such as from a family member, social worker, Independent Guardian, Independent Sexual Violence Advisor (ISVA), Independent Domestic Violence Advisor (IDVA), a learning disability advocate or an Independent Mental Health Advisor (IMHA).

196. Some people’s ability to understand information fluctuates because of a condition that they have. In such cases, if possible, the victim should be notified of the TPM request, and the views of the victim should be shared when the person has the capacity to understand the request for themselves. It may also be helpful to discuss and record what the person would want if they lost capacity to understand the information (or similar information) in future, for example where it is anticipated that they will reach a stage due to a condition or illness that will prevent them from expressing a view or objection. This means that, if further information needs to be notified and a decision need to be taken in their best interests and for their benefit, the authorised persons can take the person’s wishes into consideration.

197. In cases where the victim is an adult without capacity, authorised persons should record all relevant information, including:

• (a) the basis of the assessment that the adult is without capacity
• (b) if the adult without capacity was asked for their views, what those views were
• (c) if the adult without capacity was not asked their views, why not

Key Terms and Definitions

Adult

A person aged 18 or over.

Adult without capacity / Vulnerable adult

An adult who, within the meaning of the Mental Capacity Act 2005, lacks capacity to understand a notice under section 44B.

Authorised persons

As set out in Part 2 of this Code.

Authorising Service Police Officer (required for counselling records)

A Service Police Officer of at least the rank of:

• Lieutenant Commander (Royal Navy)
• Major (Army or Royal Marines)
• Squadron Leader (Royal Air Force)

Child

A person aged under 18.

Collateral information

Information obtained through a TPM request that is not directly relevant to the investigation and must be managed or discarded appropriately.

Counselling service / Counselling services

A service, whether remunerated or voluntary, offering psychological, therapeutic or emotional support aimed at improving the service user’s emotional, psychological and mental health. See also Part 4 of this Code.

Crime

Conduct which constitutes one or more criminal offences in England and Wales, or conduct which, if it took place in England and Wales, would constitute one or more criminal offences.

Gillick competence

A legal concept used to determine whether a child (under 16 years of age) is able to consent to their own medical treatment, without the need for parental permission or knowledge.

Guardian

A person who has been granted legal parental responsibility, appointed by court order or by a will, or who carries out day-to-day care of a child or adult without capacity.

Harm

Includes physical, mental or emotional harm and economic loss.

Parent

Includes a biological parent, an adoptive parent, a stepparent who has been granted legal parental responsibility, and a parent by virtue of the Human Fertilisation and Embryology Act 2008.

Reasonable line of enquiry

A line of enquiry that points either towards or away from the suspect. What is reasonable depends on the case circumstances, the likelihood of obtaining relevant material, and its perceived relevance.

Registered social worker

A person registered as a social worker in a register maintained by:

• Social Care Wales (formerly Care Council Wales), or
• Social Work England.

Sensitive processing

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation.

Substantial probative value

Meaningful evidential significance of information that adds value to the investigation and contributes significantly to proving or disproving a crucial aspect of the case.

Third party material (TPM)

Material held by a person, organisation, or government department other than the investigator and prosecutor, either within or outside the UK. Third parties are not directly involved in the case but may hold relevant information.

To give notice

To notify and inform a victim in writing about a request for material concerning them, specifying the information sought, the reasons for the request, and how the information will be handled.

Victim

As defined in Section 1 of the Victims and Prisoners Act 2024.

Victim information request

A request by an authorised person to another person to provide information relating to a third person who the authorised person believes is or may be:

• a victim, or
• at risk of being a victim.

Voluntary organisation

A body (other than a public authority) whose activities are not carried on for profit.

Vulnerable individual

Someone who would require additional support when being informed about a third party material request concerning them.

1. See part one for the list of authorised persons in section 44E of the Act and a definition of an “authorised person”. ↩

2. Police, Crime, Sentencing and Courts Act 2022 (legislation.gov.uk) ↩

3. Extraction of information from electronic devices: Code of Practice (accessible) - GOV.UK (www.gov.uk) ↩

4. Victims and Prisoners Bill - GOV.UK (www.gov.uk) ↩

5. Attorney General’s Guidelines on Disclosure - GOV.UK (www.gov.uk) ↩

6. Section 44E(1) of the Act can be found at [X] ↩ ↩²

7. S.I. 2023/624: The Service Police (Complaints etc.) Regulations 2023 (legislation.gov.uk) ↩

8. Attorney General’s Guidelines on Disclosure - GOV.UK (www.gov.uk) ↩

9. Code of Ethics, College of Policing ↩

10. The Code of Practice on the Management of Police Information (MoPI) defines policing purposes as: Protecting life and property, preserving order, preventing the commission of ‘terrorist’ offences, bringing offenders to justice, any duty or responsibility arising from common or statute law. ↩

11. AG_Guidelines_2022_Revision_Publication_Copy.pdf (publishing.service.gov.uk) ↩

12. Human Rights Act 1998 (legislation.gov.uk) ↩

13. European Convention on Human Rights (coe.int), Article 8 ↩

14. The Criminal Procedure and Investigations Act 1996 ↩

15. Criminal Procedure and Investigations Act 1996 (Section 23(1)) Code of Practice ↩

16. Data Protection Act 2018 (legislation.gov.uk) ↩

17. UK GDPR ↩

18. The Equality Act 2010 ↩

19. AG_Guidelines_2022_Revision_Publication_Copy.pdf (publishing.service.gov.uk) ↩

20. Crown Prosecution Service (CPS) Pre-Trial Therapy Guidance ↩

21. The Victims’ Code ↩

22. The Human Rights Act 1998 ↩

23. European Convention on Human Rights ↩

24. AG_Guidelines_2022_Revision_Publication_Copy.pdf (publishing.service.gov.uk) ↩

25. Criminal Procedure and Investigations Act 1996 (Section 23(1)) Code of Practice (publishing.service.gov.uk) ↩

26. Alibhai & Ors v REGINA, 2004, EWCA Crim 681, England and Wales Court of Appeal, Criminal Division, Judgment, Law, CaseMine ↩

27. Data Protection Act 2018 (legislation.gov.uk) ↩

28. Investigators request third party material under the CPIA, and then latterly process the material under the DPA ↩

29. Commissioners Opinion: Who’s under investigation? The processing of victims’ personal data in rape and serious sexual offence investigations (May 2022) ↩

30. A guide to the data protection principles, ICO ↩

31. Police information and records management: Code of Practice - GOV.UK (www.gov.uk) ↩

32. Data Protection Act 2018 (legislation.gov.uk) ↩

33. Conditions for sensitive processing, ICO ↩

34. Data protection – definitions and elaboration, College of Policing ↩

35. Law Enforcement, ICO Who’s Under Investigation – Chapter 2: Legislative Framework ↩

36. Information Commissioner’s Opinion: Who’s Under Investigation? The processing of victims’ personal data in rape and serious sexual offence investigations ↩

37. Public sector equality duty - GOV.UK (www.gov.uk) ↩

38. Attorney General’s Guidelines on Disclosure - GOV.UK (www.gov.uk) ↩

39. Pre-Trial Therapy, The Crown Prosecution Service (cps.gov.uk) ↩

40. Code of Practice for Victims of Crime in England and Wales (Victims’ Code) - GOV.UK (www.gov.uk) ↩

41. The Criminal Justice (Armed Forces Code of Practice for Victims of Crime) Regulations 2015 (legislation.gov.uk) ↩

42. AG_Guidelines_2022_Revision_Publication_Copy.pdf (publishing.service.gov.uk) ↩

43. AG_Guidelines_2022_Revision_Publication_Copy.pdf (publishing.service.gov.uk) ↩

44. Criminal Procedure and Investigations Act Code of Practice - GOV.UK (www.gov.uk) ↩

45. Attorney General’s Guidelines on Disclosure - GOV.UK (www.gov.uk) ↩

46. Complaints, Independent Office for Police Conduct (IOPC) ↩

47. The Service Police complaints system - GOV.UK (www.gov.uk) ↩

48. Make a complaint, ICO ↩

49. Witness summons: Form N20 - GOV.UK (www.gov.uk) ↩

50. National Disclosure Improvement Plan (NDIP) Report on Phase Two, March 2021, The Crown Prosecution Service (cps.gov.uk) ↩

51. Lawful basis for sharing personal data, ICO ↩

52. Data protection: The Data Protection Act - GOV.UK (www.gov.uk) ↩

53. Early investigative advice - His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services ↩

54. Early advice protocol, College of Policing ↩

55. Service Prosecuting Authority - GOV.UK (www.gov.uk) ↩

56. The Code of Practice for Victims of Crime in England and Wales and supporting public information materials - GOV.UK (www.gov.uk) ↩

57. Introduction to vulnerability-related risk, College of Policing ↩

58. The role of the Independent Sexual Violence Adviser (ISVA) - GOV.UK (www.gov.uk) ↩

59. Mental Capacity Act 2005 (legislation.gov.uk) ↩

60. Mental Capacity Act 2005 (legislation.gov.uk) ↩

61. Human Rights Act 1998 (legislation.gov.uk) ↩

62. Competence and Compellability, The Crown Prosecution Service ↩

63. Mental Capacity Act 2005 (legislation.gov.uk) ↩