NATS and the CAA hold radar track data that records where your aircraft was, when, and at what altitude. This data is personal data within the meaning of the UK GDPR and Data Protection Act 2018, and you have a legal right to obtain it. NATS may refuse initially — but the law is on your side, as proven by a successful Information Commissioner appeal.
NATS may argue that radar track data relates to an aircraft, not a person, and therefore is not personal data. This argument fails for two reasons:
This is not a novel argument. It follows directly from the definition in UK GDPR Article 4(1): personal data means "any information relating to an identified or identifiable natural person" where identification can be achieved "directly or indirectly, in particular by reference to an identifier." An aircraft registration is precisely such an identifier.
Recital 26 of UK GDPR clarifies that when determining whether a person is identifiable, "account should be taken of all the means reasonably likely to be used" by the controller or another person to identify the individual. NATS knows the aircraft registration. The CAA's public register links registration to owner. The CAA can inspect logbooks to identify the pilot. These are not hypothetical or extraordinary means — they are standard, routine, and already used in every infringement case. The data is personal data.
UK GDPR Article 15(1) provides that you have the right to obtain from the data controller confirmation as to whether personal data concerning you is being processed, and where that is the case, access to the personal data. Article 15(3) requires the controller to provide a copy of the personal data undergoing processing.
This means you are entitled to:
The controller must respond within one calendar month of receiving the request (UK GDPR Article 12(3)). The data must be provided free of charge for the first request (Article 15(3)).
Send your Subject Access Request to both NATS and the CAA simultaneously. They hold different data and each is a separate data controller:
NATS operates the radar systems and holds the raw plot/track data, the radar traces, the occurrence reports they file, and correspondence with the CAA about your case.
NATS Data Protection Officer
NATS Holdings Ltd
4000 Parkway, Whiteley, Fareham, Hampshire, PO15 7FL
Email: dpo@nats.co.uk
The CAA holds the MOR, the ICG assessment, all correspondence with you and about you, any evidence submitted, and the decision record. Also submit an SRG1605 form (Application for MOR Data Release) for the occurrence report specifically.
CAA Data Protection Officer
Civil Aviation Authority
Aviation House, Beehive Ring Road, Crawley, West Sussex, RH6 0YR
Email: dpo@caa.co.uk
NATS refused the initial Subject Access Request in the case documented in the case study. After a 10-month battle including an appeal to the Information Commissioner, NATS was compelled to comply in full. Here is exactly what happened and how to replicate it.
Following an alleged airspace infringement on 3 March 2025, a Subject Access Request was submitted to NATS pursuant to the Data Protection Act 2018 and UK GDPR requesting all data held on the infringement. NATS refused to provide the radar traces and radar system specifications.
The pilot appealed to the Information Commissioner's Office (ICO). The ICO investigated and determined that NATS was required to comply. Following the ICO's intervention, NATS provided:
The entire process took approximately 10 months. The refusal was not sustainable and collapsed under scrutiny. NATS had no valid legal basis to withhold the data — the radar traces were personal data, and the pilot was entitled to them.
Send your Subject Access Request to NATS and the CAA simultaneously. Be specific: identify the aircraft registration, date, time period, and the data you require. State explicitly that this is a request under UK GDPR Article 15. Request the radar traces, raw plot data, radar system specifications, and all correspondence. Use the template letter on the Letters page.
The controller has one month from receipt to respond (UK GDPR Article 12(3)). This can be extended by a further two months for complex requests, but the controller must inform you of the extension and the reasons within the first month. If you hear nothing within one month, move to step 3.
If the request is refused or ignored, write to the controller's Data Protection Officer stating that they have failed to comply with their obligations under UK GDPR Article 15 and that you intend to complain to the Information Commissioner. Give them 14 days to respond. This letter is important — the ICO will ask whether you have complained to the organisation first.
File a complaint with the ICO using their online complaint form or by post. Provide:
— A copy of your original SAR
— A copy of any refusal or non-response
— A copy of your follow-up complaint to the controller
— Your argument that the data is personal data (aircraft registration → CAA public register → identified owner; logbooks → identified pilot)
— A clear statement of what data you are seeking and why
The ICO will contact the controller, assess the complaint, and make a determination. In the case study, the ICO determined that NATS was required to comply. NATS then provided the full radar traces, the radar make/model, and the correspondence with the CAA. The ICO has the power to issue enforcement notices compelling compliance, and failure to comply is a criminal offence.
When NATS was finally compelled to disclose the radar traces, they turned out to be simple JPG screenshot images of the radar display showing the aircraft's track. They were not complex raw data files requiring specialist software — they were images that could be opened on any computer. The fact that NATS fought for months to withhold what amounted to screenshot images raises serious questions about the true motivation for the refusal.
The disclosure also included:
Without the Subject Access Request, the pilot would never have known which radar was used, what its actual accuracy was, or that the CAA official had been told the radar make/model but refused to share it. The SAR didn't just provide data — it exposed a deliberate information asymmetry that had been used to sustain an unjust finding. The radar's actual specifications exonerated the pilot. The CAA official who withheld this information knew, or ought to have known, that it was exculpatory.
Analysis of the radar traces obtained through the SAR revealed a further problem: a software bug in NATS' evidence recording tool that shifts aircraft positions between different display views. When the same radar data was viewed in different modes or zoom levels, the aircraft's plotted position moved relative to the airspace boundary. In some views the aircraft appeared outside controlled airspace; in others the same underlying data showed it inside.
This means that an infringement finding could depend not on where the aircraft actually was, or even where the radar placed it, but on which screenshot NATS happened to capture when preparing the evidence. If this bug affects the tool used to produce evidence in other infringement cases, it could have contributed to incorrect findings against other pilots.
When submitting your SAR, request radar traces from all available display modes and zoom levels. If the aircraft's position relative to the boundary differs between views, this is evidence of a display rendering error that undermines the reliability of the trace as evidence. Compare the plotted position carefully across all images provided.
Use this template specifically for requesting radar traces and associated data from NATS. A separate, broader SAR and SRG1605 should be sent to the CAA — see the Letters page.
Your Full Name
Address, Postcode
Email address
Date
Data Protection Officer
NATS Holdings Ltd
4000 Parkway, Whiteley, Fareham, Hampshire, PO15 7FL
Email: dpo@nats.co.uk
Sent by email and recorded post
Subject Access Request under UK GDPR Article 15
Aircraft: G-XXXX — Date: DD/MM/YYYY — Time: HH:MM to HH:MM UTC
Dear Data Protection Officer,
I am the registered owner / pilot-in-command of aircraft G-XXXX. I write to make a formal Subject Access Request under Article 15 of the UK General Data Protection Regulation (UK GDPR) as supplemented by the Data Protection Act 2018.
Radar track data associated with my aircraft registration constitutes my personal data. The aircraft registration is a unique identifier linked to me as the registered owner via the CAA's publicly available G-INFO register. Additionally, my identity as pilot-in-command for the flight in question is recorded in the aircraft's technical log and my personal flying logbook. I am therefore an identified or identifiable natural person within the meaning of UK GDPR Article 4(1), and the data relating to this flight is personal data relating to me.
I request a copy of all personal data you hold relating to aircraft G-XXXX for the flight on date, specifically including but not limited to:
1. All radar traces (display screenshots, images, or recordings) from all available display modes, zoom levels, and view configurations for the period HH:MM to HH:MM UTC;
2. All raw radar plot and track data including position (range, bearing, and/or Cartesian coordinates), Mode C altitude, time of each update, and track quality indicators;
3. The make, model, and location of every radar installation that detected my aircraft during the stated period;
4. All Mandatory Occurrence Reports (MORs) or other occurrence reports filed in connection with this flight;
5. All correspondence between NATS and the Civil Aviation Authority (or any other body) referring to me, my aircraft, or this flight;
6. Any internal notes, assessments, or records relating to this flight.
Please provide the data in electronic format by email.
I note that UK GDPR Article 12(3) requires you to respond within one calendar month of receipt of this request. If you consider that an extension is necessary under Article 12(3), please inform me of the reasons within one month.
If you intend to refuse any part of this request, please identify the specific data withheld, the legal basis for the refusal under UK GDPR Article 15(4) or Article 23, and confirm my right to lodge a complaint with the Information Commissioner's Office under Article 77.
To verify my identity, I enclose [copy of photo ID / pilot licence].
Yours faithfully,
Your Full Name
Pilot Licence No.: XXXXXX
NATS retains radar data for limited periods. ATC voice recordings are typically held for 30 days unless specifically preserved. If you delay your request, the data you need to defend yourself may be deleted in the ordinary course of business. Your SAR serves a dual purpose: it is a legal request for disclosure and it puts NATS on notice that the data must be preserved. Once a SAR has been received, deleting the data would be a breach of data protection law.
Include an explicit data preservation request in your letter: "I request that all data falling within the scope of this request be preserved immediately pending its disclosure to me and the resolution of any related proceedings."