We aim to make this site as accessible as possible and therefore have provided the settings below to use if you are finding it difficult to view this website. See the SFO Accessibility Statement for more information.

Where it is appropriate to provide a Welsh translation, you can switch to Cymraeg. See the Welsh Language Commissioner website for more information.

Use the settings button in the bottom right corner of the page to access these settings again.

We would like to use Analytics Cookies on our website. 

Turn these on below if you are happy with us collecting information on how our site is used, in order for us to improve the overall experience of our website. 

All other cookies are necessary and therefore by continuing to browse this website, you are agreeing to the usage of these cookies.

 See the SFO Privacy Policy for more information. 

Analytics Cookies

2020-100 – Sale of personal data by the SFO


Date Answered: 22 Gorffennaf 2021

Can I please have your records concerning the sales of personal data from 2019 and 2020, including trading partners and money earned from transactions?

Please can I have your records concerning the determining the price of personal data, for sales and sharing for the time period January 2019- Present.

What is your internal procedure for selling personal data? By this, I mean guidance given to internal staff and the buyer in question, for the time period of January 2019- Present.

What types of personal data do you sell and are there any limits placed on this? For the time period of January 2019- Present.

The SFO’s work is solely focused on the investigation and prosecution of criminal matters connected to serious fraud, bribery and corruption and it does not sell personal data. As such we do not hold the information you have requested for questions 1 to 4.

How many Subject Access Requests did you receive in the period 2017-2020, broken down by year? What types of personal data did they typically receive? For example email addresses, home addresses and telephone numbers?

The SFO received the following Subject Access Requests (SARs) for 2017 to 2020 (as of June 2020):


Number of SARs








07 (as of June 2020)

As to your question about the types of personal data received; I can advise that the majority of SARs that the SFO typically receives relate to our casework. In addition, we also receive SARs related to personal data that is being processed for general purposes not related to our casework. More information about the types of personal data we may hold and how we process personal data can be found in the SFO’s Privacy Notice