South Wales Police ordered to clear SARs backlog
The Information Commissioner’s Office (ICO) has issued an enforcement notice to South Wales Police (SWP) over serious delays in handling subject access requests (SARs).
An investigation revealed that between April 2023 and March 2024, SWP responded to only 29 per cent of SARs within the statutory time-frame.
It also found that as of August 2025, the force had 352 overdue SARs, with one dating back nearly two years. The ICO has ordered SWP to clear this backlog by June 2026.
SWP explained to the Commissioner that, as a police force, the majority of SARs it receives fall under Part 3 DPA 2018 (law enforcement processing), although it does receive some SARs under the UK GDPR. It also receives “complex” SARs which involve large volumes of data or sensitive information.
Head of Investigations, Sally Anne Poole, said: “Subject access requests are a cornerstone of data protection law. People have the right to know what information is held about them and how it is used.
“SWP is the largest police force in Wales, providing a policing service to 1.3 million people – all of whom deserve better when it comes to respecting their data rights. Taking action against those who fall short of the law sends a clear message: public bodies must uphold these rights, with delays of this scale being simply unacceptable.”