Data Protection - How to Invoke Your Rights

Under Data Protection Law (UK GDPR and Data Protection Act 2018) the Council has a duty to protect the personal data it processes. The following rights are provided to individuals.

Your Rights

• Right to be Informed - You have the right to be informed about the collection and use of your personal data. Please see our Privacy Notice for details
• Right of Access (Subject Access Request) - You have the right to request a copy of personal data held about you
• Right to Rectification - You have the right to request that inaccurate personal data be rectified, corrected or completed
• Right to Erasure - You have the right to request that personal data about you is deleted or destroyed in certain circumstances. This is sometimes called the “right to be forgotten”
• Right to Restrict/Cease/Object to Processing - You have the right to request that inaccurate personal data about you is restricted, limited or suppressed in certain circumstances. Under this right you can also request your data is not deleted or destroyed
• Right to Data Portability - You have the right to request data portability of personal data in certain circumstances. This means you can receive personal data about yourself in machine readable common format, you may request that personal data is sent to another organisation
• Right in relation to automated decision making and profiling - Torfaen County Borough Council does not carry out automated decision making or profiling that comes under this definition.

How can you make a Rights Request from us?

It would assist us greatly if you could make your request in writing (by letter or e-mail) or you can make a Data Protection Rights Request here. If you would like advice or assistance in completing this form or submitting a request please contact the Data Protection & Information Governance Team on 01495 762200.

You can email us at DPA@torfaen.gov.uk

You can write to us at: Data Protection Officer, Torfaen County Borough Council, Civic Centre, Pontypool, NP4 6YB.

If you would like to use AI, AI tools can be helpful, but they can also introduce errors so if you are using AI to help draft an information request, please make sure the final wording has been checked and reflects your actual information needs. 

AI tools sometimes generate broad or excessive wording that goes beyond the information you actually want or need. Short, straightforward requests are easier for us to process and usually lead to quicker, more accurate responses. 

AI can often mis-represent legislation or mis-state what organisations do therefore please review the text of your request carefully and don’t assume AI is right.  

Is there a fee?

For requests listed above, the authority will provide a copy of the information free of charge. However, we can charge a ‘reasonable fee’ (based on the administrative cost of providing this information) when a request is manifestly unfounded or excessive, particularly if it is repetitive.

We may also charge a reasonable fee to comply with requests for further copies of the same information.

What is the time frame for responses?

We aim to acknowledge requests or ask for more information to clarify requests within five working days of receiving it.  We will provide responses within one month of receiving the necessary information and proof of identity documents. 

Where requests are complex or numerous and we feel the need to extend the period of compliance by a further two months we will inform the individual within one month of the receipt of the request and explain why the extension is necessary.

What information is required when submitting a Rights Request?

It would assist us if you completed a Rights Request form as comprehensively as possible and we will use the information supplied by you to search our files and systems for data relating to you. You can make a Data Protection Rights Request here.

If you would like to use AI, AI tools can be helpful, but they can also introduce errors so if you are using AI to help draft an information request, please make sure the final wording has been checked and reflects your actual information needs. 

AI tools sometimes generate broad or excessive wording that goes beyond the information you actually want or need. Short, straightforward requests are easier for us to process and usually lead to quicker, more accurate responses. 

AI can often mis-represent legislation or mis-state what organisations do therefore please review the text of your request carefully and don’t assume AI is right. 

We will require proof of ID, one copy of photographic ID such as a copy of the requestor’s passport or a driving licence, and proof of residency such as copy of a utility bill.

A letter of authority will be required if acting on behalf of someone else, a verification process is in place.

Can we supply all the information requested from us?

It is in the public interest that we are open, transparent and accountable for the work we do.

It is important that the disclosures we make do not undermine the confidence and trust in the authority or those who correspond with us.

We will give access to personal information in accordance with the requirements of Data Protection Law (UK GDPR and Data Protection Act 2018).

However, there will be occasions where it would be wrong for us to disclose everything eg 3rd party information and exemptions will be applied. A copy of the Data Protection Act Exemptions can be viewed here under schedules 2,3 and 4.

Appeals and Complaints

If you are unhappy with the reply, you have received relating to your Data Protection request or concern, please let us know in writing, stating clearly what the issue is. 

• You can email us at DPA@torfaen.gov.uk 
• You can write to us at Data Protection Officer, Torfaen County Borough Council, Civic Centre, Pontypool, NP4 6YB 

Torfaen County Borough Council takes all concerns seriously and will initiate an Internal Review, led by a senior member of our legal team to review our original decision. This process will be conducted withing 20 working days and the outcome of the decision communicated to you. 

Please note you may apply directly to the Information Commissioner for a decision at any time during this process. Generally, the Information Commissioner’s Office (Wales) cannot make a decision unless you have exhausted the internal review process provided by this Council. 

The Information Commissioner can be contacted at: The Information Commissioner’s Office (Wales), 2nd Floor, Churchill House, Churchill Way, Cardiff, CF10 2HH. Telephone 0330 414 6421 or e-mail wales@ico.org.uk. 

Last Modified: 02/06/2026 Back to top