<p>It remains the case at this time that ACRO has no conclusive evidence that any personal data has been affected by the cyber security incident and there does not appear to be any potential risk to customers’ payment information or to the information / certificates that ACRO sent to individuals following their applications. Detailed investigations are continuing but it is not possible to provide a definitive timescale for their conclusion.</p><p>ACRO’s service resources are demand led and its human and other resources are dynamically allocated according to need. ACRO aims to provide the best service to all its customers, whether members of the public or other organisations, irrespective of if they are receiving a paid or a free service, and in doing so to meet all its service requirements.</p><p>The statutory response for a Subject Access Request must be made within one month of receiving the request. Subject Access for the Police National Computer remains a priority within ACRO and responses are within the time limits.</p><p>ACRO is working with its partners to ensure that its website is as secure as possible before it is brought back online.</p>