The General Data Protection Regulation and Data Protection Act 2018 provides you with a number of rights (subject to the basis for processing). Full details of the rights can be found in the Privacy Notice for Complainants and Representatives.
These rights include the right to request personal information that we hold about you. This is referred to as a ‘Subject Access Request’.
Your Subject Access Request will normally need to be submitted to us in writing. It will also help if you mark your request ‘Subject Access Request’. You should also try to specify the personal information you require – for example, the type of information you require, or the period of time.
A Subject Access Request should be marked for the attention of the Information and Data Protection Officer. It can be sent by email to email@example.com or by post to the following address:
Information and Data Protection Officer
Public Services Ombudsman for Wales
1 Ffordd yr Hen Gae
Whilst we can take verbal requests, we will also need to retain a copy of the call recording for future reference.
We will provide you with a response as soon as possible, and within one month of receipt of your request. If the request is complex, we may extend that response time by a further two months; however, we will notify you if we do extend the time for response.
If we require further information from you before we can respond, we will let you know. However, the time limit for response will be suspended until we receive the additional information we require.
We will also provide you with further information regarding the way in which your information is processed.
All of our investigations are conducted in private, and our governing legislation places restrictions on the disclosure of information obtained by this office. The DPA contains exemptions from the requirement to supply certain information in response to a Subject Access Request. In the event that information is withheld from you, you will be provided with a clear explanation as to why this has been necessary.
If you are dissatisfied with the response you have received to your Subject Access Request, you can request an internal review. All reviews will follow the same procedure set out in our Freedom of Information pages here.
If you remain dissatisfied following review, you can complain to the Information Commissioner’s Office, whose details are also available on the Freedom of Information pages.
You can also seek to enforce subject access rights through a judicial remedy.