ACRO Criminal Records Office
We read the privacy notices published across central government, councils, tax and benefits offices, health bodies and policing. These are the patterns that repeat. A public body is not a company and you are not its customer: it holds your record because a law lets it, which changes what you can ask for and what you can expect back.
Reported incidents
Reprimanded after a hacker sat in its website for months
2026-08-12Affected Website content management system (Kentico)
The ICO reprimanded ACRO, the police office that issues Police Certificates and International Child Protection Certificates, on 12 August 2026. A hacker had access to its website and content management system between August 2022 and March 2023 and staged personal data for theft. ACRO could not confirm whether data left. Up to 10,920 applicants and related people were at risk, with data including passport and driving licence details, National Insurance numbers, bank details, biometric data and criminal offence information. The ICO found no clear ownership of security updates and weak patching.
People affected typically ask ACRO Criminal Records Office to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.