The Home Office rewrote its privacy notice for the police non-emergency line this week. It still tells callers their conversations with operators are kept under a Vodafone policy that never mentions the 101 service at all.
Estimated reading time: 5 minutes
In short. GOV.UK's own change log confirms the Home Office edited its privacy notice for 101, the national non-emergency police number, on 23 September 2026, "to amend how long transcriptions are held for" [3]. The notice that resulted says the 101 service "does not seek to collect personal data" [1], then two sentences later confirms that "central collection and processing of recordings of voice response or conversations with operators" takes place [1]. For how long those operator-call recordings are kept, the notice says only that they are "retained for audit in line with Vodafone's retention policy" and links to Vodafone's public privacy page as its evidence [1]. That page, and the retention schedule it links to in turn, do not mention the 101 service, the Home Office or police calls anywhere; the only entry covering "call recordings" describes Vodafone's own customer call centres, kept for "legitimate business interests" rather than the public task basis the Home Office notice claims, on a schedule last updated in February 2022 [2]. Three documented mistakes: four stars.
101 is the number the government tells people to ring instead of 999 when a police matter is not an emergency: reporting a crime after the fact, a noise complaint, concerns about a neighbour. The Home Office publishes a privacy information notice explaining what happens to callers' information before their call reaches a police force, and it names itself as the "Controller" of that information "including when it is collected or processed by third parties on our behalf" [1]. GOV.UK's publishing history for the page records one change since it was first published on 20 March 2025: an edit on 23 September 2026, the note for which reads "Updated the section 'Storing your information' in the privacy notice to amend how long transcriptions are held for" [3]. The following morning, the section that update touched still leaves the more sensitive part of the same question unanswered.
"Does not seek to collect personal data"
The notice opens with a plain statement: "The 101 Single Non-Emergency Number service does not seek to collect personal data" [1]. The next paragraph qualifies it. "Although personal information is not sought, elements of the call used to identify the appropriate routing for the call may result in central collection and processing of recordings of voice response or conversations with operators" [1]. Before a caller reaches a police force, their call is routed by Vodafone UK, "on behalf of" the Home Office, using "network-level location data, interactive voice response systems and/or operators" [1]. A recorded conversation with a routing operator, in which a caller may explain why they are ringing before they are ever connected to a force, is personal data by any ordinary reading of the term, and the notice's own second sentence says as much. The opening claim that the service "does not seek" it sits awkwardly next to an admission, in the same section, that conversations with operators are centrally collected and processed.
A retention policy that does not mention the service it is cited for
The notice separates two kinds of recording. Automated voice-response audio "is processed while the call is live only." Transcriptions of those automated responses "will be held for a period of 90 days to enable continuous improvement of the automation used," with an exception: "By exception, transcripts may be held for a longer period while investigating issues with the service performance. These transcripts will not be held for longer than the active service issue" [1]. That is the section GOV.UK's change note says was edited this week.
For the other category, recordings of actual conversations with operators, the notice gives no period at all. It says only: "Calls with operators are retained for audit in line with Vodafone's retention policy," followed by a link, "Find more detail of Vodafone's privacy policy" [1].
Following that link leads to Vodafone's general consumer privacy page, which states the company will "store your information for as long as we must by law" or, absent a legal requirement, "for as long as we need to in order to provide Vodafone products or services to you," and links onward to a one-page "Vodafone Limited Retention Schedule" for specifics [2]. Neither page mentions the 101 service, the Home Office or police calls once. The schedule's only line item for call recordings reads: "Call recordings to Vodafone call centres, Date the call was made, Maximum of 24 months, Legitimate business interests for training and quality purposes" [2]. That entry describes Vodafone's own customers ringing Vodafone's own call centres, retained for Vodafone's own "legitimate business interests," a different lawful basis entirely from the "Public Task" basis the Home Office claims for 101 under UK GDPR Article 6(1)(e) [1]. The schedule itself is dated "Updated February 2022" [2], more than three years before the Home Office notice it is now cited to support. A caller who follows the Home Office's own link to find out how long their conversation with a 101 routing operator is kept finds nothing written for that scenario.
An exception with no outer limit
The retention period the Home Office did rewrite this week is not unqualified either. The 90-day figure for automated transcripts comes with an open-ended carve-out: transcripts may be kept "for a longer period while investigating issues with the service performance," capped only by the promise that they "will not be held for longer than the active service issue" [1]. Nothing in the notice defines what counts as an "active service issue," who decides when one starts or ends, or what the longest such period has been in practice. The cap on the exception is the exception's own continuation, not an external limit a reader can check.
The claims, tested
| The notice's own words | What following the citation shows | Verdict |
|---|---|---|
| "The 101 Single Non-Emergency Number service does not seek to collect personal data" [1] | The next paragraph of the same notice: "central collection and processing of recordings of voice response or conversations with operators" [1] | The opening claim is contradicted by the notice's own next sentence |
| Operator-call recordings are "retained for audit in line with Vodafone's retention policy" [1] | Vodafone's privacy page and retention schedule never mention 101, the Home Office or police calls; the only relevant entry is for Vodafone's own call centres under a different lawful basis, dated February 2022 [2] | The cited source does not answer the question it is cited to answer |
| Transcripts held 90 days, "by exception" longer, but "not for longer than the active service issue" [1] | No definition of "active service issue," no named limit, no worked example anywhere in the notice | An exception bounded only by its own continuation, not an outer limit |
The mistakes, counted
The notice's opening claim is contradicted by its own next sentence (1). "Does not seek to collect personal data" is followed, two sentences later, by confirmation that recordings of conversations with operators are collected centrally and processed.
The cited evidence for operator-call retention does not cover the scenario it is cited for (2). The Home Office points callers to Vodafone's retention policy for how long their conversations with 101 routing operators are kept; that policy and its schedule never mention 101, the Home Office or police calls, and describe an unrelated Vodafone customer-service function on a different legal basis, last updated February 2022.
The retention period the notice was rewritten this week to state has no outer limit (3). The 90-day figure for automated transcripts can be extended "by exception" for as long as an undefined "active service issue" is considered active, with no maximum stated anywhere.
Credit where due
Not everything in the notice is vague. The 90-day baseline retention for transcripts is a specific, checkable figure, and the notice is explicit that automated routing audio is processed only while a call is live, not retained afterwards [1]. It correctly identifies the Home Office as the data controller rather than hiding behind Vodafone as the processor, states its UK GDPR lawful basis by name and article number, and sets out real rights of access, objection and complaint to the Information Commissioner's Office [1]. It is also honest that once a call reaches a police force, that force's own privacy policy takes over, rather than implying the Home Office notice covers everything downstream. The edit made this week did address a real gap, the exact wording of the automated-transcript retention period, even if the harder question, how long conversations with a human operator are kept, was left exactly as it was.
Verdict
Four stars, from three documented mistakes. The Home Office has a genuine, current privacy notice for a service millions of people may need to use, and most of its structure, controller identification, lawful basis, rights information, is sound. What does not survive a read of the notice against its own citation is the answer to the one question a caller worried about what they said to a 101 operator would actually want: how long is that conversation kept. The notice points to a policy that was never written with this service in mind.
Sources
- Home Office, "Single non-emergency number 101: privacy information notice" (guidance, first published 20 March 2025, updated 23 September 2026, checked 24 September 2026). https://www.gov.uk/government/publications/single-non-emergency-number-101-privacy-information-notice/single-non-emergency-number-101-privacy-information-notice - landing page: https://www.gov.uk/government/publications/single-non-emergency-number-101-privacy-information-notice
- Vodafone Limited, "Vodafone Limited Retention Schedule" (PDF, updated February 2022, checked 24 September 2026), linked from Vodafone's privacy policy at https://www.vodafone.co.uk/privacy. https://binaries.vodafone.co.uk/gbnnsauqav4t/X4SMmh59qdb8QIxTuyFUz/d8b0248af40bf15ec9b6a678e87367be/retention-schedule.pdf
- GOV.UK Content API, change history for "Single non-emergency number 101: privacy information notice" (checked 24 September 2026). https://www.gov.uk/api/content/government/publications/single-non-emergency-number-101-privacy-information-notice