Data Protection Subject Access Requests

Under the General Data Protection Regulation (GDPR) (EU) 2016/679 the Council has a duty to protect the personal data it processes in line with the Data Protection Bill. An individual has a right to request information held about them through the Subject Access Process.

How can you request Data Protection Subject Access Requests (personal information) from us?

Applications for information need to be in writing.

You can email us at DPA@torfaen.gov.uk

You can write to us at: Data Protection Officer, Torfaen County Borough Council, Civic Centre, Pontypool, NP4 6YB.

Is there a fee for Subject Access Requests (SAR’s)?

For Data Protection Subjects Access requests the authority will provide a copy of the information free of charge. However, we can charge a ‘reasonable fee’ (based on the administrative cost of providing this information) when a request is manifestly unfounded or excessive, particularly if it is repetitive.

We may also charge a reasonable fee to comply with requests for further copies of the same information.

What is the time frame for responses?

We aim to acknowledge requests, or ask for more information to clarify requests within five working days of receiving it.  We will provide responses within one month of receiving the necessary information and proof of identity documents. 

Where requests are complex or numerous and we feel the need to extend the period of compliance by a further two months we will inform the individual within one month of the receipt of the request and explain why the extension is necessary.

What information is required when submitting a DPA Subject Access Request?

We will request that a Data Subject Access Request form is completed as comprehensively as possible and we will use the information supplied by you to search our files and systems for data relating to you. You can make a Data Protection Subject Access Request here.

We will require proof of ID, one copy of photographic ID such as a copy of the requestor’s passport or a driving licence, and proof of residency such as copy of a utility bill.

A letter of authority will be required if acting on behalf of someone else, a verification process is in place.

Can we supply all the information requested from us?

It is in the public interest that we are open, transparent and accountable for the work we do.

It is important that the disclosures we make do not undermine the confidence and trust in the authority or those who correspond with us.

We will give access to personal information in accordance with the requirements of the General Data Protection Regulation (GDPR) (EU) 2016/679

However, there will be occasions where it would be wrong for us to disclose everything eg 3rd party information and exemptions will be applied. A copy of the Data Protection Act Exemptions can be viewed here.

Appeals and Complaints

If you are unhappy with the reply you have received, please let us know in writing, stating clearly what the issue is.

You can email us at DPA@torfaen.gov.uk

You can write to us at Data Protection Officer, Torfaen County Borough Council, Civic Centre, Pontypool, NP4 6YB

We will endeavour to resolve any problems, including an internal review of our original decision.

As part of that review, if it is agreed that the information is incomplete or inaccurate, we will correct it.

Please note you may apply directly to the Information Commissioner for a decision at any time during this process.

The Information Commissioner can be contacted at The Information Commissioner’s Office (Wales), 2nd Floor, Churchill House, Churchill Way, Cardiff, CF10 2HH. Telephone: 029 2067 8400. Fax: 029 2067 8399. E-mail: wales@ico.gsi.gov.uk

Last Modified: 24/05/2018
For more information contact:

Data Protection Officer

Email: DPA@torfaen.gov.uk

Back to top
© Copyright 2018 Torfaen County Borough Council