Privacy and cookies
Privacy notice: how your information will be used
Last update: June 2026
The Petitions site lets you start and sign petitions to raise issues with the Welsh Parliament/Senedd Cymru (referred to hereafter as the Senedd).
The Petitions service is provided by the Senedd Commission. We need to collect, process and store some personal data to enable you to do this.
Data Controller
The Senedd Commission is the data controller of the information you provide, and will ensure it is protected and used in line with UK data protection law.
Our Contact Details
Any queries regarding our use of your information should be sent to the Data Protection Officer at:
Data.Protection@senedd.wales 0300 2006565
What information are we processing?
The personal data we collect from people who sign petitions will include:
- your name
- your email address
- your postcode
- the country you live in
- the IP address you use when starting or signing a petition
In addition, for people who start a petition we will also collect:
- your postal address
- your contact telephone number
- Any personal information or details that you provide within the petition itself.
We sometimes receive information relating to people who have signed petitions on paper. Paper petitions are securely stored and retained for the same period as personal data received through our own electronic petitions system. They are destroyed in a secure manner at the end of the retention period.
Why are we processing it?
We use this information to:
- facilitate the petitions process
- make sure that people only sign a petition once
- check that you’re eligible to start a petition
- contact you about petitions you start
- if you choose to sign up to email updates about what happens in the Senedd on petitions you’ve signed
- we may occasionally contact people who start or submit petitions to seek feedback on the petitions process and how it could be improved.
What we do with your data
We use your personal information to process the petition you have started or signed.
IP addresses are used to protect the petitions site and prevent fraudulent activity.
We will share your data if we’re required to do so by law – for example, by court order, or to prevent fraud or other crime.
If you’ve signed a petition, we won’t publish any personal information about you.
We’ll use your postcode to work out how many people in Wales and within each Senedd constituency have signed a petition.
We will retain your personal data from the date you start or sign a petition until 12 months after it is no longer being considered by the Petitions Committee, i.e. until 12 months after the Committee considers the petition to be completed, apart from any personal data which has been published.
What we’ll email you about
If a petition you’ve started is referred to the Petitions Committee, we’ll use your contact details to update you about the petition’s progress and to offer you the opportunity to provide further information and engage with the Committee.
You will receive automated confirmation emails when you set up or sign a petition.If you’ve signed a petition, you can choose to receive updates about the progress of the petition.
This might include contacting you to let you know what is happening in the Senedd in relation to your petition, such as:
- debates that you can watch or read,
- chances to respond to a consultation,
- or ways to let committees and Members of the Senedd know why the petition is important to you.
We may occasionally use your contact details to seek your views on the Senedd’s petitions process.
You can stop these emails at any time by clicking the “unsubscribe” link in the email.
Who will have access to the information?
Only limited Senedd Commission staff administering the petitions process will have access to your personal information.
Will the information be shared with any third parties, or publicised?
If you start a petition and we accept it, your name will be published alongside any text you include within the petition. We won’t publish any of your contact details. If you start a petition, your name will remain permanently referenced alongside the petition on the Petitions Committee’s web pages and in meeting transcripts and recordings, as part of the official record of the Senedd’s petitions process. Any information which has been published will remain permanently online in the records of the Senedd’s petitions process, including in any material published by the Petitions Committee.
Third party processors:
Unboxed Consulting Limited who provide technical support for the petitions system will also have access to the system for troubleshooting and maintenance purposes only.
The petitions system uses Amazon Web Services (AWS) cloud storage to store your data. AWS store data within the European Economic Area (EEA).
The information will be stored securely on our ICT systems which includes third party cloud services provided by Microsoft. We may also make use of Microsoft’s artificial intelligence tools to process your information. Any transfer of data by Microsoft outside of the EEA is covered by contractual clauses under which Microsoft ensure that personal data is treated in line with domestic legislation. To find out more about how Microsoft will use your information, you can read their privacy statement here.
The petitions system uses the GOV.UK Notify service to send emails relating to the petitions process including updates. Emails sent are stored for 7 days. The privacy notice for the GOV.UK Notify service is available here: www.notifications.service.gov.uk/privacy.
Storage, retention and deletion
The information will be stored securely on our ICT systems which includes third party cloud services provided by Microsoft.
We will retain your personal data from the date you start or sign a petition until 12 months after it is no longer being considered by the Petitions Committee, i.e. until 12 months after the Committee considers the petition to be completed, apart from any personal data which has been published.
After this 12 month period, your personal data will be securely deleted.
Legal basis for processing Personal Data
UK data protection law sets out various legal bases which allow us to collect, hold and use your personal information. For the purpose of processing the personal data you provide, we rely on the following legal bases:
Article 6(1)(e) of the UK General Data Protection Regulation (‘UK GDPR’): ‘Public Task’
We consider that our collection and use of your information is necessary to help us facilitate the petitions process and allow the public the chance to raise and show support for issues with the Senedd. Our reliance on this lawful basis is read together with section 8(d) of the Data Protection Act 2018 (‘DPA 2018’).
Article 6(1)(c) of the UK GDPR: ‘Legal Obligation’
Where we are required to process personal data in order to comply with a legal obligation, such as a request under access to information legislation or a court order, we will do so on the basis that processing is necessary for compliance with a legal obligation.
We may process personal data relating to criminal convictions and offences. In order to comply with Article 10 of the UK GDPR, this data will be processed in accordance with our Article 6 legal basis, as outlined above, and section 10 of, and paragraph 6 of Schedule 1 to, the DPA 2018.
Legal basis for processing Special Category Data
Article 9(1) GDPR defines special category personal data as including personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Special category personal data will usually be processed on the basis that it is necessary for reasons of substantial public interest, pursuant to Article 9(2)(g) of the UK GDPR read in conjunction with section 10 of, and paragraph 6 of Schedule 1 to, the Data Protection Act 2018. However, where your special category personal data is made public by you, it may be processed on the basis that it has already been manifestly made public by you, pursuant to Article 9(2)(e) of the GDPR.
Sharing Data
In the event of a request for information being made under access to information legislation, it may be necessary to disclose all or part of the information that you provide. We will only do this if we are required to do so by law.
Your rights
As a data subject, you have a number of rights. The rights which apply depend on the legal bases we are relying on to use your personal information. Those rights will not apply in all instances, and the Commission will confirm whether or not that is the case when you make a request.
The rights include the right to request access to your own personal information, sometimes called a ‘subject access request’.
Additionally, you have the right to request from us:
- that any inaccurate information we hold about you is corrected (please note that you are required to keep us up to date with any changes to your personal information);
- that information about you is deleted (in certain circumstances);
- that we stop using your personal information for certain purposes or in certain circumstances; and
- that your information is provided to you or a third party in a portable format (again, in certain circumstances).
If you would like to engage any of the rights that you have under data protection legislation, ask a question, or make a complaint about how your information is used, please email information-request@senedd.wales.
Making a complaint
You can complain to the Data Protection Officer if you are unhappy with how we have used your data. Contact details can be found above.
If, following a complaint, you remain dissatisfied with our response, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
casework@ico.org.uk
Changes to this notice
We may change this privacy notice. In that case the ‘last updated’ date at the top of this page will also change. Any changes to this privacy notice will apply to you and your data immediately. If these changes affect how your personal data is processed, we will take reasonable steps to make sure you know.