UKs Criminal Records Office (ACRO)

The UK's Criminal Records Office, commonly known as ACRO, is a national law enforcement agency responsible for the administration and dissemination of criminal record information. Its core function is the processing and issuance of official certificates, most notably Police Certificates for individuals requiring them for employment, visa applications, or other purposes, and International Child Protection Certificates for those working with children abroad. The organisation serves a critical domestic and international market, facilitating the sharing of conviction data with foreign law enforcement and government bodies to support security and safeguarding efforts. ACRO operates a primary online customer portal through which applicants submit requests for these certificates, making digital service delivery a central component of its public-facing operations. The agency's work is fundamental to enabling background checks that underpin public safety and compliance with various legal and regulatory frameworks both within the United Kingdom and for UK citizens overseas. Its services are essential for a wide range of sectors, from education and healthcare to immigration and adoption, positioning it as a key node in the national security infrastructure. The office maintains other critical systems for policing and international records exchanges even when its public-facing portal is disrupted, highlighting a separation between customer service channels and core operational data exchange functions.

ACRO's operational profile is defined by its specialised, high-integrity role in handling sensitive personal data, including criminal conviction records and applicant identification details. The organisation has demonstrated a capacity to manage significant service disruptions, as evidenced by two separate cyber security incidents in early 2023 that forced the offline status of its application portal. During these events, ACRO collaborated with the National Cyber Security Centre and the Information Commissioner's Office, following established protocols for investigating breaches and notifying affected individuals. While initial public statements indicated no conclusive evidence of data compromise, subsequent reporting suggested that identification details and conviction records may have been exposed, though payment information remained secure. These incidents reveal the agency's reliance on a single digital access point for its customers and its contingency planning for manual processing via email during system outages. The response included increasing customer service resources to manage a backlog and maintain some level of service continuity. ACRO's positioning is that of a statutory office within the UK's policing landscape, tasked with a specific, legally mandated function rather than a broad commercial enterprise, which shapes its operational priorities and incident response strategies.