privacy policy

Updates to this policy

Given recent changes in data protection law, we will update this page over coming months. Please check back for updates. We will not however use any personal data in a way that is inconsistent with the original purposes for which it was obtained, without informing you first.

Data controller

The National Assembly for Wales Commission ('the Assembly') is the data controller for all personal data that it holds.  Personal data will be used in accordance with data protection legislation.  This includes the UK Data Protection Act 2018 ('DPA 18') and the General Data Protection Regulation ('GDPR'). The overarching privacy policy for the Assembly website is available here.

Data Protection Officer

The Data Protection Officer for the Assembly can be contacted at

What personal data is collected through this site?

We are inviting young people to register to vote for the Welsh Youth Parliament elections which will take place in November 2018. Any young person between the age of 11-18 who is interested in registering to vote will be taken to a registration page, managed by a company called Mi-Voice, where we will ask for their name, e-mail address, post code and date of birth to be left. Mi-Voice are the organisation managing the election process on behalf of the National Assembly for Wales, details of how Mi-Voice will use and protect your information is available here. A full copy of the registration privacy notice is available on the registration site, and also via this link.

What legal bases do we rely on for using your personal data?

Many of our activities relate to the official function as the National Assembly for Wales. The legal basis we rely on to use personal data in these instances is often the bases known as 'public task' This basis is engaged where "the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law".

Your rights

You have a number of rights in relation to the information that we hold about you. The rights which apply depend on the legal bases we are relying on to use your personal data.  Those rights will not apply in all instances, and we will confirm whether or not that is the case when you make a request.

In summary the rights are:

  • The right to be informed
  • The right of access
  • The right to rectification
  • The right to erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object
  • Rights in relation to automated decision making and profiling

If you would like to engage any of these rights, please email

Further details about your rights are available on the Information Commissioners Office (ICO) website.

How your personal data will be stored

When registering to vote for the Welsh Youth Parliament election, your details will be stored on Mi-Voice’s secure servers, located in the UK for six months after the election (5-25 November) , after which they will be deleted. This will allow adequate time to deal with any election disputes that may arise.

Mi-Voice are the organisation managing the election process on behalf of the National Assembly for Wales, details of how Mi-Voice will use and protect your information is available here

Sometimes we use third party applications such as Survey Monkey, Mail Chimp, Dialogue, EventBrite. Where this is the case, the relevant privacy notice will inform you of: any transfers of data outside of Europe; the safeguards which are in place to protect your data; and, direct you to information provided by that third party about how they will use your information.

We will ensure administrative, technical and physical security controls are in place to protect information and reduce the potential risks of loss or unauthorised use or disclosure. A summary of the technical controls in place include:


We often take photos and film footage ("images") at Assembly events (on and off the estate). Images are used for the purposes of promoting the work of the Assembly and to engage with the people of Wales. We consider this task to be vital to fulfil the strategic goals of the organisation, as set out in the Assembly Commission Strategy 2016 – 2021.

Images recorded at events may be published on our social media platforms, our website or in printed and digital material. Images may be retained by the Assembly indefinitely. Any images which we publish into the public domain will remain there. Images and footage we retain could potentially be used, without context to the event photographed or filmed, to promote the work of the National Assembly for Wales and engage with the people of Wales.

If you do not want to appear in such media, please contact a member of staff –


If you contact us via the website for the purposes of registration, email subscriptions, and other engagement activities, your information will only be used for those purposes.

Cookies are pieces of data that are often created when you visit a website and are stored in the cookie directory of your own computer.

Log files allow us to record visitors' use of the site. Log files do not contain any personal information or information about which other sites you have visited.

What happens when I link to another site?

Other websites linked from this site are not covered by this privacy policy. The National Assembly for Wales website contains links to other websites, both those of government departments and of other organisations. This privacy policy applies only to the National Assembly for Wales website, so you should always be aware when you are moving to another site and we would encourage you to read the privacy policies of the other websites that you visit.  

Sharing of personal data

The Assembly may need to share your personal details with other people for legal reasons, such as courts and law enforcement agencies.  The Assembly may also share it with its own professional advisers, auditors, insurers and other service providers. Privacy notices will also describe any further instances of sharing of data.

Requests for information made to the Commission

In the event of a request for information being made under access to information legislation, it may be necessary to disclose all or part of the information that you provide. This may include information which has previously been removed by the Assembly for publication purposes. We will only do this if we are required to do so by law.