Data Protection Subject Access Requests

Under the General Data Protection Regulation (GDPR) (EU) 2016/679 the Council has a duty to protect the personal data it processes in line with the Data Protection Bill. An individual has a right to request information held about them through the Subject Access Process.

How can you request Data Protection Subject Access Requests (personal information) from us?

It would assist greatly if you could make your request in writing (by letter or e-mail) or where possible make a Data Protection Subject Access Request here. If you would like advice or assistance in completing this form or submitting a request please contact the Data Protection & Information Governance Team on 01633 647467.

You can email us at

You can write to us at: Data Protection Officer, Torfaen County Borough Council, Civic Centre, Pontypool, NP4 6YB.

Is there a fee for Subject Access Requests (SAR’s)?

For Data Protection Subjects Access requests the authority will provide a copy of the information free of charge. However, we can charge a ‘reasonable fee’ (based on the administrative cost of providing this information) when a request is manifestly unfounded or excessive, particularly if it is repetitive.

We may also charge a reasonable fee to comply with requests for further copies of the same information.

What is the time frame for responses?

We aim to acknowledge requests, or ask for more information to clarify requests within five working days of receiving it.  We will provide responses within one month of receiving the necessary information and proof of identity documents. 

Where requests are complex or numerous and we feel the need to extend the period of compliance by a further two months we will inform the individual within one month of the receipt of the request and explain why the extension is necessary.

What information is required when submitting a DPA Subject Access Request?

We will request that a Data Subject Access Request form is completed as comprehensively as possible and we will use the information supplied by you to search our files and systems for data relating to you. You can make a Data Protection Subject Access Request here.

We will require proof of ID, one copy of photographic ID such as a copy of the requestor’s passport or a driving licence, and proof of residency such as copy of a utility bill.

A letter of authority will be required if acting on behalf of someone else, a verification process is in place.

Can we supply all the information requested from us?

It is in the public interest that we are open, transparent and accountable for the work we do.

It is important that the disclosures we make do not undermine the confidence and trust in the authority or those who correspond with us.

We will give access to personal information in accordance with the requirements of the General Data Protection Regulation (GDPR) (EU) 2016/679

However, there will be occasions where it would be wrong for us to disclose everything eg 3rd party information and exemptions will be applied. A copy of the Data Protection Act Exemptions can be viewed here.

Appeals and Complaints

If you are unhappy with the reply you have received, please let us know in writing, stating clearly what the issue is.

You can email us at

You can write to us at Data Protection Officer, Torfaen County Borough Council, Civic Centre, Pontypool, NP4 6YB

We will endeavour to resolve any problems, including an internal review of our original decision.

As part of that review, if it is agreed that the information is incomplete or inaccurate, we will correct it.

Please note you may apply directly to the Information Commissioner for a decision at any time during this process.

The Information Commissioner can be contacted at: The Information Commissioner’s Office (Wales), 2nd Floor, Churchill House, Churchill Way, Cardiff, CF10 2HH. Telephone 0330 414 6421 or e-mail

Last Modified: 03/07/2019
For more information contact:

Data Protection Officer


Back to top