The Information Commissioner’s Office (ICO) has issued an enforcement notice to South Wales Police (SWP) over serious delays in handling subject access requests (SARs).
An investigation revealed that between April 2023 – March 2024, SWP only responded to 29% of SARs within the statutory timeframe. It also found that as of August 2025, the force had 352 overdue SARs, with one dating back nearly two years. The ICO has ordered SWP to clear this backlog by June 2026.
The full enforcement notice can be read here.
Head of Investigations, Sally Anne Poole, said: “Subject access requests are a cornerstone of data protection law. People have the right to know what information is held about them and how it is used.
“SWP is the largest police force in Wales, providing a policing service to 1.3 million people – all of whom deserve better when it comes to respecting their data rights. Taking action against those who fall short of the law sends a clear message: public bodies must uphold these rights, with delays of this scale being simply unacceptable.”
1. The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and information rights law, upholding information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
2. The ICO has specific responsibilities set out in the Data Protection Act 2018 (DPA2018), the United Kingdom General Data Protection Regulation (UK GDPR), the Freedom of Information Act 2000 (FOIA), Environmental Information Regulations 2004 (EIR), Privacy and Electronic Communications Regulations 2003 (PECR) and a further five acts and regulations.
3. The ICO can take action to address and change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit.
4. To report a concern to the ICO, telephone call our helpline on 0303 123 1113, or go to ico.org.uk/concerns.
Related Posts
ICO steps up scrutiny of police use of facial recognition technology with audit of South Wales Police and Gwent Police
10 years of Data Protection Day – 10 years of ICO annual reports
ICO seeks comments on draft Data Protection Impact Assessment guidance