Awdurdod annibynnol y Deyrnas Unedig a sefydlwyd i gynnal hawliau gwybodaeth er budd y cyhoedd, annog cyrff cyhoeddus i fod yn agored a hybu preifatrwydd data i unigolion.

I gael trosolwg sylfaenol ar yr wybodaeth isod, gweler ein ffeithlun 'what we do with your personal data when you...' infographic


Diben y prosesu a’r sail gyfreithiol drosto

As part of our statutory functions, we investigate and prosecute individuals and organisations for alleged criminal offences committed under the legislation we regulate (including Data Protection Act 2018, Freedom of Information 2000, etc.). The Information Commissioner is named as a competent authority for the purpose of Part 3 of the DPA 2018 which applies to the processing of personal data by such authorities for law enforcement purposes.

These purposes are set out at s.31 DPA 2018 and are the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, which might include the safeguarding against and the prevention of threats to public security. Our processing is either done because it is necessary for the performance of a task relating to one of these purposes or with the consent of the individual.

We process personal data for the purposes of law enforcement of the legislation for which we are regulator in the following three areas:

  • Ymchwiliad troseddol
  • Cuddwybodaeth
  • Adferiad ariannol

Our processing can also include sensitive processing which means processing special category data for law enforcement purposes. Where this is the case we rely on either the consent of the individual or, provided the processing is strictly necessary for the law enforcement purposes, on a condition set out in Schedule 8 of the DPA 2018. Our Safeguards Policy explains about our processing (including sensitive processing) for law enforcement purposes, our procedures for complying with the data protection principles and our policies for retention and erasure of any personal data. You can read our policy yma.

Yr hyn y bydd arnom ei angen

When we investigate an alleged criminal offence, we gather information and evidence which might include information about victims, suspects, witnesses and other individuals relevant to the circumstances and events. 

Pam mae arnom ei angen

In our role as a competent authority, we need to establish whether offences have been committed so that we can take legal action if appropriate. So we’ll gather information relevant to our investigation which might include information about you. 

Yr hyn a wnawn gydag ef

Rydym yn defnyddio'ch gwybodaeth bersonol at ddibenion ein hymchwiliad ac at ddibenion erlyn, os yw'n briodol.

Mewn rhai amgylchiadau, efallai y byddwn yn rhannu eich gwybodaeth bersonol gyda gorfodi'r gyfraith ac asiantaethau eraill yn ystod ymchwiliad. Efallai y byddwn hefyd yn ei rannu ag eraill fel tystion arbenigol.

If we are considering taking legal action, we’ll share this information with our external legal counsel, the courts and any co-defendants and their legal representatives. Court cases are held in public and so personal data, including special category data, might be made public during the course of proceedings.

Pan fyddwn yn erlyn rhywun yn llwyddiannus, efallai y byddwn yn cyhoeddi hunaniaeth yr unigolyn a gollfarnwyd yn ein Hadroddiad Blynyddol, ar ein gwefan neu'n dosbarthu'n ehangach i'r cyfryngau.

Pa mor hir y byddwn yn ei chadw

I gael gwybodaeth am pa mor hir rydyn ni’n cadw data personol, gweler ein hamserlen cadw gwybodaeth.

Beth yw’ch hawliau chi?

You have a right to access your personal data held by or for us. You also have a right to get inaccurate data rectified and incomplete data completed, and for your personal data to be erased in certain circumstances.

We will provide further information directly to data subjects in specific cases to enable them to exercise their rights. This might be in cases where

rydym yn prosesu eich data personol a gasglwyd heb eich gwybodaeth.

We will not do this where doing so would be prejudicial to our investigation or for other reasons set out in s.44 (4) Data Protection Act 2018.

Ydyn ni’n defnyddio unrhyw broseswyr data?

We do use external service providers in the UK for the case management system we use to process cases which are investigated for law enforcement purposes.

We sometimes use external service providers to carry out forensic analysis of evidence in cases which are investigated for law enforcement purposes or for financial recovery activities.

Ydyn ni'n neud unrhyw drosglwyddiadau data dramor?

Mae unrhyw drosglwyddiadau’n cael eu gwneud yn unol â'n rhwymedigaethau diogelu data.