Current timestamp: 07/10/2026 23:31:22
AgeAlertAnonymousAppealsApplicationsApply Or RegisterArea OutlineArrow DownArrow LeftArrow RightArrow UpAutomatic DoorsBack ArrowBusinessCalendarCashArrow DownArrow LeftArrow RightArrow Down[Missing text '/SvgIcons/Symbols/Titles/icon-chrome' for 'English (United Kingdom)']ClockCloseContactDirectionsDocumentDownloadDrawDrugExpandExternal LinkFacebookFb CommentFb LikeFiletype DefaultFiletype DocFiletype PdfFiletype PptFiletype XlsFinance[Missing text '/SvgIcons/Symbols/Titles/icon-firefox' for 'English (United Kingdom)']First AidFlickrFraudGive FeedbackGlobeGuide DogHealthHearing ImpairedInduction LoopInfoInstagramIntercom[Missing text '/SvgIcons/Symbols/Titles/icon-internet-explorer' for 'English (United Kingdom)']LaptopLiftLinkedinLocal Activity[Missing text '/SvgIcons/Symbols/Titles/icon-location' for 'English (United Kingdom)']LoudspeakerLow CounterMailMapMap PinMembershipMenuMenu 2[Missing text '/SvgIcons/Symbols/Titles/icon-microsoft-edge' for 'English (United Kingdom)']Missing PeopleMobility ImpairmentNationalityNorth PointerOne Mile RadiusOverviewPagesPaper PlaneParkingPdfPhonePinterestPlayPushchairRefreshReportRequestRestart[Missing text '/SvgIcons/Symbols/Titles/icon-rotate-clockwise' for 'English (United Kingdom)']Rss[Missing text '/SvgIcons/Symbols/Titles/icon-safari' for 'English (United Kingdom)']SearchShareSign LanguageSnapchatStart AgainStatsStats And Prevention AdviceStopSubscribeTargetTattosTell Us AboutTickTumblrTwenty Four HoursTwitter LikeTwitter ReplyTwitter RetweetUploadVisually ImpairedWhatsappWheelchairWheelchair AssistedWheelchair ParkingWheelchair RampWheelchair WcYoutubeZoom InZoom Out

Leave this site

Skip to main content

Skip to main navigation

Welcome

This site is a beta, which means it's a work in progress and we'll be adding more to it over the next few weeks. Your feedback helps us make things better, so please let us know what you think.

Privacy notice for reporting cloned number plates

The Public Number Plate Cloning Reporting Tool is a tool developed for the NPCC by Single Online Home. The tool allows members of the public to report a suspected incident of car number plate cloning to the police force where they live. This will then be investigated by this police force. The data will also be shared with the DVLA so they can record this information against the vehicle details in their databases.

Introduction

This Specific Privacy Notice has been created to make it easier for individuals to understand what personal data the NPCC processes about them, and how and why it is used in connection with the Single Online Home Public Number Plate Cloning Reporting Tool. It is a requirement of the Data Protection Act 2018 (DPA) and UK GDPR.

This privacy notice is subordinate to, and should be read in conjunction with the NPCC Privacy Policy and Single Online Home’s Police.uk Privacy Policy. Data is also processed under this initiative by Driver and Vehicle Licencing Agency (DVLA). This is not covered by this Privacy Notice. Information on how DVLA process data can be found on GOV.UK.

If an individual does not have access to the internet and requires access to the high-level Privacy Notice they can contact the Data Protection Officer for the NPCC who will provide a copy to them. They will also facilitate the provision of the Privacy Notice in large font, or Braille, or published in other languages.

Privacy information

(1) Data controllers

Who are the Controllers (the persons who determine the purpose and means by which an individual’s personal data is processed) and what are their contact details?

National Police Chiefs' Council

50 Broadway

London

SW1H 0BL

Email: [email protected]

ICO Registration number: ZA495495

DPA/UK GDPR reference

  • Section 44(1)(a)
  • Article 13(1)(a)
  • Article 14(1)(a)

 

(2) Purpose of personal data

For what purpose(s) is the personal data processed by the NPCC?

For one or more Law Enforcement Purposes – defined as the prevention, investigation, detection or prosecution of criminal offences, the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, or the policing purpose.

DPA/UK GDPR reference

  • Section 44(1)(c)
  • Article 13(1)(c)

 

(3) Types of personal data

What types or categories of personal data is processed by the NPCC?

The following data will be collected and processed by the police force the member of the public reports the incident of car number plate cloning to and the DVLA from the responses generated by the registered keeper or the person acting on their behalf. 

  • Contact details
  • Details of Registered Keeper
  • Vehicle details (including photo)
  • Incident details
  • Details of fines or notices
  • Notice of any previous contact

DPA/UK GDPR reference

  • Article 14(1)(d)

 

(4) How is data processed?

How is personal data processed by the NPCC?

The NPCC will not process individual’s personal data but acts as the overarching national body on behalf of police forces in England and Wales:

The Police Force will process the information to investigate the incident of vehicle number plate cloning and take appropriate law enforcement action. This processing is covered by the Police Force Privacy Notice.

Single Online Home will also collect statistical data, which will be shared with the NPCC, on the number of reports. This will not contain individual personal data.

 

(5) Legal basis for processing data

What is the NPCC legal basis for processing the personal data?

The NPCC’s legal bases for processing personal data is based on its Common Law Policing Purpose of protecting life and property, preserving order, preventing the commission of offences, bringing offenders to justice, and any duty or responsibility of the police arising from common or statute law.

In terms of Section 35(2) of the DPA the processing is necessary for the performance of a task carried out for a Law Enforcement purpose by the NPCC or another competent authority.

And the following for General Processing: a) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

DPA/UK GDPR reference

  • Section 44(2)(a)
  • Section 35(2)
  • Article 13(1)(c)
  • Article 14(1)(c)

 

(6) Who is personal data disclosed to?

Who could the personal data be disclosed to by the NPCC?

The data collected by UK policing is disclosed to DVLA.

The data will not be shared with any parties beyond those listed in this Privacy Notice. The data will be exempt from freedom of information requests under section 30, 31 UK DPA 2018. 

DPA/UK GDPR reference

  • Section 44(2)(c)
  • Article 13(1)(e)

 

(7) Transferring data out of the UK

Does the NPCC intend to transfer the personal data out of the U.K. or to an international organisation?

No.

DPA/UK GDPR reference

  • Article 13(1)(f)
  • Article 14(1)(f)

If the NPCC intends to transfer the personal data out of the U.K. or to an international organisation what safeguards are there to protect the personal data?

Not applicable.

DPA/UK GDPR reference

  • Section 44(2)(b)
  • Article 13(1)(f)
  • Article 14(1)(f)

 

(8) How long data will be retained

How long will the personal data be retained by the NPCC?

The NPCC will not have access to personal data provided, therefore data retention is not applicable.

Police forces will have access to personnel data provided to them via the Single Online Home Vehicle Number Plate Cloning reporting form.

This data will be used to investigate the reported incident of vehicle number plate cloning and is justifiably retained under the Criminal Procedure Investigations Act (CPIA). Where there is a continued policing purpose, beyond the initial investigation, data may be retained under Management of Policing Information (MOPI). Details of policing policy on this can be found with the primary NPCC Privacy Notice or Privacy Notices on individual police force websites.

DPA/UK GDPR reference

  • Article 13(2)(a)
  • Article 14(2)(a)

 

(9) Your rights

What are individuals’ rights under the DPA and UK GDPR?

Individuals have the following rights under the DPA:

  • Right of access to their personal data
  • Right of rectification of their personal data
  • Right of erasure of their personal data or the restriction of its processing
  • Right to lodge a complaint with the Information Commissioner

Full details of those rights and how to exercise them can be found in the NPCC’s high-level Privacy Notice, which can be found on the NPCC website. It can also be obtained from the NPCC’s Data Protection Officer

Individual forces also publish high-level Privacy Notices, which can be found on the force websites. Force Privacy Notices can also be obtained from the Force’s Data Protection Officer.

DPA/UK GDPR reference

  • Section 44(1)(d)(i)
  • Section 44(2)(d)
  • Section 44(3)(a)
  • Section 45
  • Section 44(1)(d)(ii)
  • Section 46
  • Section 44(1)(d)(iii)
  • Section 47
  • Section 44(1)(e)
  • Section 51

Individuals have the following rights under the UK GDPR:

  • Right to be informed
  • Right of access
  • Right of erasure
  • Right to restriction of processing
  • Right to data portability
  • Right to object
  • Right not to be subject of automated decision-making

Full details of those rights and how to exercise them can be found in the NPCC’s high-level Privacy Notice, which can be found on the NPCC website. It can also be obtained from the NPCC’s Data Protection Officer.

Advice on subject rights and how to exercise them can also be found in individual high-level Privacy Notices, published on force websites. Force Privacy Notices can also be obtained from the Force’s Data Protection Officer.

DPA/UK GDPR reference

  • Article 13(2)(b)
  • Article 14(2)(c)

 

(10) Withdrawing consent

If the NPCC relies on individuals’ consent to be the legal basis for processing the personal data, can they withdraw that consent?

This process does not rely on individual consent. Not applicable.

DPA/UK GDPR reference

  • Article 13(2)(c)
  • Article 14(2)(d)

 

(11) Making a complaint

Who can an individual lodge a complaint with if they are unhappy about the way their personal data is processed by the NPCC?

They may lodge a complaint with the Information Commissioner’s Office. Their contact details are:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 0303 123 1113

Website:  www.ico.org.uk

They may wish to initially raise any concerns with the NPCC Data Protection Officer.

DPA/UK GDPR reference

  • Article 13(2)(d)
  • Article 14(2)(e)

 

(12) Who data is obtained from

If personal data was obtained by NPCC from someone else, from who or where was it obtained by the NPCC?

Data is obtained directly from a member of the public, who is the registered vehicle keeper, or acting on behalf of the registered vehicle keeper, to report the suspected incident of vehicle number plate cloning. 

DPA/UK GDPR reference

  • Article 14(2)(f)

 

(13) Statutory or contractual requirements

Are individuals required to provide their personal data under a statutory or contractual requirement, or a requirement necessary to enter a contract, or are they obliged to provide it?

No.

DPA/UK GDPR reference

  • Article 13(2)(e)

 

(14) Automated decision-making

Is an individual’s personal data used for automated decision-making, including profiling?

No.

Automated decision-making is where the NPCC makes a decision about an individual without human intervention that has a legal or similar effect on them.

DPA/UK GDPR reference

  • Article 13(2)(f)
  • Article 14(2)(g)

If an individual’s personal data is used for automated decision-making, including profiling what logic will be involved and what significance and consequences will there be for them from the automated decision-making?

Not applicable.

DPA/UK GDPR reference

  • Article 13(2)(f)
  • Article 14(2)(g)