Subject Access Request - Privacy Notice

Who we are and what we do

We are ‘Publica’ Group (Support) Limited and are a council owned employment company which delivers shared services between Cotswold, West Oxfordshire and Forest of Dean District Councils and Cheltenham Borough Council (hereon known as “Clients”). Publica additionally provides services to the Cheltenham Trust, Cheltenham Borough Homes and UBICO (an environmental services local authority company) (hereon known as “Clients”).

Publica is a Data Controller and Data Processor for the purposes of the Data Protection Legislation (UK General Data Protection Regulation and the Data Protection Act 2018).

Under the UK General Data Protection Regulations (UK GDPR) data subjects have the right to access and receive a copy of their personal data, and other supplementary information, that we hold within one month from the date of receipt of confirmation of identity and proof of address. This is commonly referred to as a subject access request.

Any questions regarding our privacy practices should be sent to:

Data Protection Officer (DPO)
Publica Group (Support) Limited
Trinity Road, Cirencester GL7 1PX
Tel: 01993 861194

Why Publica needs your information and how we use it

Publica holds information about you in order to enable it to provide services and to meet its statutory and regulatory obligations, a subject access request enables you as the data subject to request a copy of this information.

As part of the subject access request process we will require further information to ensure the validity of your request. In this way we can ensure that we are able to respond to your request and that any information provided is sent to those who are legally entitled to receive it. If you chose not to provide some of this information we may not be able to progress with your request.

Personal data will be collected directly from yourself as the data subject or from someone legally entitled to request the data on your behalf e.g. legal representative or parent of minor.

We collect this information by:

What is the legal process for collecting and processing this data

Under the UK GDPR and Data Protection Act 2018, the lawful bases we rely on for processing this information are:

What type of information is collected from you

Personal details, which may include:

This is to ensure that you are legally entitled to receive the information requested.

Special categories of personal data

We will not purposely collect any special category or criminal data.

Who your information may be shared with (internally and externally)

Your data is shared internally only with the appropriate staff where it is necessary for the performance of their roles in processing your request.

Data may be shared with a third party acting on your behalf e.g. legal representative appointed by yourself.

We will not normally share your information with organisations without your consent, however, there may be certain circumstances where we would share without consent such as where we are required to do so by law e.g. emergency situations.

How long Publica keeps your information (retention period)

We will retain the personal information collected as part of the subject access request process for 3 years from the date of completion of the request.

Once your data is no longer needed it will be securely and confidentially destroyed or disposed of in line with retention schedules.

How Publica protects your information

Your data is stored securely on our systems and accessed only by authorised officers using their own username and password created in line with pre-defined user credentials. Personal data is also held in electronic files on our network drives. These are only accessible through personal logon credentials and access privileges to specific drives. Access to our sites require a personal electronic pass to access staff only areas. Publica has strict procedures for the way this is done. Any and all information about you is treated as confidential and with respect. There are also clear rules and guidance about storing, recording and sharing information which staff receive training on.

Publica will not transfer your personal data outside the EU without your consent.

Publica has implemented generally accepted standards of technology and operational security in order to protect personal data from loss, misuse, or unauthorised alteration or destruction.  

Please note however that where you are transmitting information to us over the internet this can never be guaranteed to be 100% secure.  

Publica will notify you promptly in the event of any breach of your personal data which might expose you to serious risk.

Your rights

You have the following rights under the Data Protection Legislations:

How you can access, update or correct your information

The Data Protection law gives you the right to apply for a copy of information about yourself. This is called a ‘subject access request'.

If you wish to see a copy of your records you should contact the Data Protection Officer. You are entitled to receive a copy of your records free of charge, within a month.

In certain circumstances access to your records may be limited, for example, if the records you have asked for contain information relating to another person.

The accuracy of your information is important to us to be able to provide relevant services more quickly. Publica is working to make its record keeping more efficient. In the meantime, if you change your address or email address, or if any of your circumstances change or any of the other information Publica holds is inaccurate or out of date, please email us or write to us at:

Publica Group (Support) Limited
Trinity Road, Cirencester GL7 1PX

Further information

For further information, please refer to and for how to make a request

If you would like to know more about how Publica uses your information, or if for any reason you do not wish to have your information used in any of the ways described in this privacy notice, please contact the Data Protection Officer at

You can also complain to the Information Commissioner:

Publica reserves the right to update this privacy notice from time to time by publishing a new version on their the website.