Driver requests for gate records: a subject access workflow for UK sites

A request at the gate is not permission to export the register

A driver asks for the photographs and entry times recorded during a visit. The guard can find the vehicle, but should they show the screen, email a report or send the driver to the client? The useful answer is a prepared request-handling process, not an improvised disclosure beside the barrier.

This guide addresses access requests involving vehicle records at UK manned gates. It is distinct from choosing a retention period: the question here is how to respond when someone actually asks for their information. The ICO sources below were checked on 17 October 2026. The gate-specific workflow is a practical recommendation to adapt with your organisation's privacy lead, not individual legal advice.

Priority Service advertises vehicle photographs, checked registrations, time-stamped IN and OUT records, permits, approvals and administrator CSV reporting. Those capabilities can help locate records; they do not constitute an advertised automatic subject access request service, redaction tool or legal assessment.

Recognise the request before deciding which records to release

The ICO explains that a subject access request, or SAR, can be verbal or written and can reach any part of an organisation. It does not need legal terminology or a compulsory form. A request for someone's own gate photographs or recorded visits may therefore need handling as a SAR even if it begins as an ordinary conversation.

Give guards a short instruction: record the request accurately, take suitable contact details through the approved channel and pass it promptly to the designated handler. Note when it arrived and who received it. Do not tell the driver that the request only counts after the office opens or after a particular form is completed.

Separate this from a company asking for a delivery report about several drivers. That is not automatically an individual exercising their own access right. Send the request for classification rather than assuming that a transport manager's job title authorises every disclosure.

Name the response owner across client, contractor and software supplier

ICO guidance places responsibility for complying with SARs on the controller. Where a processor is used, the agreement must provide for assistance with access requests. At a contracted gate, identify the actual data relationship rather than assuming the uniform, device owner or software subscription decides it.

Your site instruction should name the receiving contact, deputy and escalation route. Establish how a request reaching the guarding company is passed to the relevant controller, and how the company handles any records for which it has its own responsibilities. An internal referral should preserve the original receipt details.

Use one request reference across the gate note, administrator search and correspondence. The driver should not have to retell the same account to three teams while each assumes another is responding. Resolve contractual uncertainty through the responsible manager; do not ask the guard to decide controller status.

Verify the person and manage the deadline without inventing barriers

The ICO normally requires a response without undue delay and within one calendar month, subject to the applicable rules on identity, representative authority and clarification. Extensions of up to two further months are available in specified circumstances, with timely notice and reasons. Do not turn that into a routine three-month target.

Identity checks should be proportionate; formal documents are not automatically necessary. Knowing a registration alone does not establish entitlement to every associated visit, especially for a shared company vehicle. The handler should establish how the requested records relate to the person. If someone acts for a driver, check their authority.

Only seek clarification where reasonably required. The ICO explains when clarification pauses the clock; it is not a blanket delay mechanism. Have the handler record the deadline and any justified adjustment. Guards should neither promise an immediate export nor demand a passport photograph as their default response.

Search the record trail, not only the first matching registration

ICO retrieval guidance requires a reasonable and proportionate search. Relevant information can sit in several locations, including records held by a processor. Being outside the main application does not by itself place information outside the request.

Build a search plan around the actual scope: site, relevant dates, registration, permit details and associated correspondence. A registration is a useful starting point, not proof that every result concerns the requester. Check substitute vehicles, repeated visits and capture errors where the available context makes them relevant.

For your gate operation, consider the visit history, retained photographs, approval correspondence and controlled reports already exported for a relevant incident. Ask record owners which stores they hold rather than creating uncontrolled copies in a new email chain. Document the searches and any justified limits so another handler can understand what was checked.

Do not change or delete information to prevent disclosure. The ICO warns that intentionally amending requested information for that purpose is an offence. If routine deletion may affect relevant records, refer it promptly for a documented preservation decision; do not casually suspend deletion across the whole organisation.

Review mixed records before making a disclosure copy

A vehicle photograph might show another driver, a passenger or someone near the entrance. A movement row might identify a guard or supervisor. The ICO's guidance on other people's information requires a considered assessment: relevant consent or whether disclosure without it is reasonable may matter. It does not support either releasing everything or refusing the entire request automatically.

Prepare a separate response copy for review. Assess whether irrelevant rows or identifying details can be removed while leaving the requester's information understandable. Removing a name may be insufficient if the remaining context still identifies someone. Record the reasoning for information withheld or disclosed.

Keep the original operational record intact during response preparation. As a practical check, have a second authorised person inspect the actual outgoing files, not just the covering email. Check every sheet, attachment and photograph. Do not assume that hiding spreadsheet rows, adding a coloured box or filtering the screen removes the underlying data from the file.

Provide an understandable response through a checked delivery route

The ICO says access includes supplementary information about processing, not just a data extract. The response owner should check the required information, including purposes, retention and applicable rights, against the organisation's actual arrangements. A generic software privacy notice is not necessarily the premises operator's complete answer.

Explain the gate data in plain language. Identify the site and relevant time convention, distinguish a recorded movement from an approval decision, and explain abbreviations the driver would otherwise have to guess. Do not describe a missing OUT record as proof that the driver remained on site.

ICO supply guidance addresses accessible formats, sufficient context and secure delivery, including checking the destination address. Use an approved method appropriate to the information and confirm the recipient before sending. If encrypted delivery is chosen, the ICO describes sending the access code separately.

Record what was supplied, when, by whom and through which route. Keep response working copies under the organisation's access and retention controls. Sending a carefully prepared package to the wrong email address still defeats the process.

Rehearse a shared-van request before a real dispute

Use a fictional test: a driver asks verbally for all records about their visits last Tuesday. The van is shared, it entered twice, and one retained photograph contains a second person. The request reaches a relief guard at a client's warehouse. This is a training scenario, not a customer case study.

The guard records and routes the request. The handler confirms the relevant identity and scope without assuming van ownership proves who drove each visit. An authorised administrator searches the agreed records. The reviewer separates the requester's information from unrelated visits and assesses the photograph before preparing the response.

Pass the exercise only if the team can show the original receipt, response owner, deadline, search trail, disclosure decisions and checked delivery route. If the process depends on the relief guard remembering a conversation, improve the procedure. ICO preparation guidance recommends trained staff, responsible handlers, request logs and systems that support extraction and review.

Test the reporting boundary in your software demonstration

Priority Service's published features at https://priorityservice.co.uk/#features include administrator visit-history review, filtering and CSV exports. Ask to see an authorised administrator find a fictional visit and explain the resulting report. Separately establish how retained photographs can be retrieved for your process; do not assume that a CSV includes the images.

The current public feature description does not promise automated identity verification, request deadlines, legal exemptions, redaction or a driver self-service disclosure portal. Agree which steps remain with your privacy lead and what supplier assistance is available before relying on a workflow.

Request a demonstration at https://priorityservice.co.uk/#demo with a fictional access-request scenario. Your buying test is whether authorised staff can locate an intelligible record without exposing unrelated information. A searchable gate register is useful evidence infrastructure; a defensible disclosure still needs a responsible person and a tested process.

Vehicle logging for your operation

Explore the workflow, plans and demo options for your team.

Explore gatehouse management software