Subject: We have received your email. Rydym wedi derbyn eich ebost From: icocasework Direction: received Date: Wed, 21 Oct 2026 15:50 UTC Institution: Information Commissioner's Office Refs: none Archive id: gm-1a15f28811081705 ------------------------------------------------------------ Thank you for contacting the Information Commissioner’s Office. We confirm that we have received your correspondence. If you have any special requirements that mean you would like us to communicate with you in a specific way, please let us know and we will make adjustments if we can. If you have made a new complaint - we’re unlikely to look into it unless you have raised it with the responsible organisation (for a data protection complaint) or the responsible public authority (for a freedom of information complaint) first. Please make sure you have sent us a copy of their final response to you. We're supporting a high number of people with their complaints at the moment. For the latest timescales to allocate cases, please visit the make a complaint page on our website. We apologise for this delay but we want to reassure you we take your complaint very seriously. If your correspondence relates to an existing case - we will add it to your case and consider it on allocation to a case officer. If you believe we have either failed to take appropriate steps to respond to your data protection complaint, or we do not provide you with information about the progress or outcome of your complaint within the next three months, you may be able to apply to the First-tier Tribunal to require us to respond to your complaint or to provide you with information about its progress. (www.gov.uk - information rights and data protection: appeal against the Information Commissioner) If you have asked us for advice - we will respond within 7 days. While you wait, you should regularly check our website (www.ico.org.uk) for relevant guidance, as we are updating this all the time. You should read our Guide to the UK GDPR. If you have raised a question that we have answered on our website, we may respond by sending you a link to it. But will do our best to provide you with the information you need. If you represent an organisation and you are reporting a personal data breach under the GDPR or the Data Protection Act 2018 - we aim to contact you within seven days to confirm receipt and to provide you with a case reference number. If you want advice urgently, you should telephone our helpline on [phone redacted]. You can find out more about data breach reporting on our website. Where a significant cyber incident occurs, you may also need to report this to the National Cyber Security Centre (the NCSC). To help you decide, you should read the NCSC’s guidance about their role and the type of incidents that you should consider reporting. (www.ncsc.gov.uk -incident-management) Incidents that might lead to a heightened risk of individuals being affected by fraud, should be reported to Report Fraud (https://www.reportfraud.police.uk/) - the UK’s national fraud and cybercrime reporting centre. If your organisation is in Scotland, then reports should be made to Police Scotland (www.scotland.police.uk). If you are a Communications Service Provider reporting a security breach under the Privacy and Electronic Communications Regulations – you will need to report the security breach via the secure portal that can be found on the PECR pages of our website. If you represent an organisation and are reporting a potential incident under the NIS Directive - we will contact you as soon as we can. You can find out more about the NIS Regulations on our website If you represent an organisation and you are reporting a security breach within the definition of the eIDAS regulation – we will contact you as soon as we can. You can find out more about the eIDAS regulation on our website. If you have reported spam email – we are unlikely to need to contact you again, unless we need more information to help with our investigations. We publish details about the action we've taken on nuisance messages on our website. If you have asked for information you think we might hold - we will contact you if we need any more information to help us respond. Otherwise, we will respond within our public and statutory service levels. For more information please visit our webpage ‘request information from us’ (go to our homepage and follow the link for ‘about the ICO’ and ‘our information’). If you have only copied your correspondence to us - we will not respond. There is more detailed information, including information on our current response times, on our service standards and what to expect webpage. You can also call [phone redacted], we welcome calls in Welsh on [phone redacted]. You can also contact us on live chat (please visit our webpage ‘contact us’ and ‘live chat’). For information about what we do with personal data please see our privacy notice: https://ico.org.uk/global/privacy-notice/ Yours sincerely The Information Commissioner’s Office Diolch yn fawr ichi am gysylltu â Swyddfa’r Comisiynydd Gwybodaeth. Rydym yn cadarnhau bod eich gohebiaeth wedi dod i law. Os oes gennych unrhyw ofynion arbennig sy'n golygu yr hoffech i ni gyfathrebu â chi mewn ffordd benodol, rhowch wybod i ni a byddwn yn gwneud addasiadau os gallwn. Os ydych wedi gwneud cwyn newydd – dydyn ni ddim yn debygol o edrych i mewn iddo oni bai eich bod wedi’i godi’n gyntaf gyda’r sefydliad cyfrifol (cwyn am ddiogelu data) neu’r awdurdod cyhoeddus cyfrifol (cwyn am ryddid gwybodaeth). Gofalwch eich bod wedi anfon copi aton ni o’u hymateb terfynol ichi. Rydyn ni wrthi’n helpu nifer fawr o bobl gyda’u cwynion ar hyn o bryd. Am yr amserlenni diweddaraf i ddyrannu achosion, ewch i'r dudalen gwneud cwyn ar ein gwefan. Ymddiheurwn am yr oedi yma ond hoffem eich sicrhau ein bod yn cymryd eich cwyn o ddifrif. Os yw’ch gohebiaeth yn ymwneud ag achos sydd eisoes yn bod - byddwn yn ei hychwanegu at eich achos ac fe gaiff ei hystyried ar ôl cael ei dyrannu i swyddog achosion. Os ydych yn credu ein bod ni naill ai wedi methu cymryd camau priodol i ymateb i'ch cwyn diogelu data, neu heb ddarparu gwybodaeth ichi am gynnydd neu ganlyniad eich cwyn o fewn y tri mis nesaf, efallai y byddwch yn gallu gwneud cais i'r Tribiwnlys Haen Gyntaf i’w gwneud yn ofynnol inni ICO ymateb i'ch cwyn neu ddarparu gwybodaeth ichi am gynnydd eich cwyn. (www.gov.uk - information rights and data protection: appeal against the Information Commissioner) Os ydych wedi gofyn am gyngor – byddwn yn ymateb o fewn 14 diwrnod. Tra byddwch yn aros, dylech edrych yn rheolaidd ar ein gwefan (www.ico.org.uk) i chwilio am ganllawiau perthnasol, gan eu bod yn cael eu diweddaru drwy’r amser. Hefyd dylech ddarllen ein blogiau ynghylch ‘mythau’r GDPR’. Os ydych wedi codi cwestiwn sydd wedi’i ateb ar ein gwefan, mae’n bosibl y byddwn yn ymateb drwy anfon dolen atoch i gysylltu â’r ateb. Ond fe wnawn ein gorau glas i roi’r wybodaeth angenrheidiol ichi Os ydych yn cynrychioli sefydliad a’ch bod yn rhoi gwybod am drosedd data personol o dan y GDPR neu Ddeddf Diogelu Data 2018 – rydym yn anelu at gysylltu â chi o fewn saith niwrnod calendr i gadarnhau bod eich neges wedi dod i law ac i roi rhif cyfeirnod achos ichi. Os oes arnoch eisiau cyngor ar frys, dylech ffonio’n llinell gymorth ar [phone redacted]. Cewch ragor o wybodaeth am roi gwybod am droseddau data ar ein gwefan. Pan fo digwyddiad seibr arwyddocaol yn digwydd, mae’n bosibl y bydd angen ichi roi gwybod amdano hefyd i’r Ganolfan Seiberddiogelwch Genedlaethol (yr NCSC). I’ch helpu i benderfynu, dylech ddarllen canllawiau’r NCSC ar eu rôl a’r math o ddigwyddiadau y dylech ystyried rhoi gwybod amdanyn nhw. (www.ncsc.gov.uk -incident-management) Dylai digwyddiadau a allai arwain at risg uwch y bydd twyll yn effeithio ar unigolion gael eu cyfleu i Report Fraud (https://www.reportfraud.police.uk/) – sef canolfan genedlaethol y Deyrnas Unedig ar gyfer rhoi gwybod am dwyll a seiberdroseddau. Os yw eich sefydliad yn yr Alban, yna i Heddlu’r Alban y dylech chi roi gwybod (www.scotland.police.uk). Os ydych yn Ddarparwr Gwasanaethau Cyfathrebu sy’n rhoi gwybod am dor diogelwch o dan y Rheoliadau Preifatrwydd a Chyfathrebu Electronig – bydd angen ichi roi gwybod am y tor diogelwch drwy’r porth diogel sydd ar gael ar y tudalennau ar ein gwefan sy’n ymwneud â’r PECR. Os ydych yn cynrychioli sefydliad a’ch bod yn rhoi gwybod am ddigwyddiad posibl o dan Gyfarwyddeb yr NIS – byddwn yn cysylltu â chi cyn gynted ag y gallwn. Cewch ragor o wybodaeth am Reoliadau’r NIS ar ein gwefan. Os ydych yn cynrychioli sefydliad a’ch bod yn rhoi gwybod am dor diogelwch o fewn y diffiniad yn Rheoliad eIDAS – byddwn yn cysylltu â chi cyn gynted ag y gallwn. Cewch ragor o wybodaeth am Reoliad eIDAS ar ein gwefan. Os ydych wedi rhoi gwybod am ebost sbam – mae’n annhebygol y bydd angen inni gysylltu â chi eto, oni bai bod arnon ni angen rhagor o wybodaeth i helpu yn ein hymchwiliad. Rydym yn cyhoeddi gwybodaeth am y camau rydyn ni wedi’u cymryd ynghylch negeseuon niwsans ar ein gwefan. Os ydych wedi gofyn am wybodaeth yr ydych yn credu ei bod gennyn ni – byddwn yn cysylltu â chi os bydd arnom angen rhagor o wybodaeth i’n helpu i ymateb. Fel arall, byddwn yn ymateb ichi o fewn ein lefelau gwasanaeth statudol a chyhoeddus. I gael rhagor o wybodaeth, ewch i’n tudalen gwe ‘request information from us’ (ewch i’n tudalen hafan a dilynwch y ddolen ‘about the ICO’ ac ‘our information’). Os ydych wedi anfon copi o’ch gohebiaeth aton ni ond dim byd arall – fyddwn ni ddim yn ymateb. Mae gwybodaeth fanylach, gan gynnwys gwybodaeth am ein hamserau ymateb presennol, ar ein tudalen gwe safonau gwasanaeth a beth i’w ddisgwyl. Gallwch ffonio hefyd yn y Gymraeg ar [phone redacted] opsiwn 9 neu yn Saesneg ar [phone redacted]. Gallwch gysylltu â ni hefyd i gael sgwrs fyw (ewch i’n tudalen gwe ‘contact us’ a ‘live chat’). I gael gwybodaeth am yr hyn rydyn ni’n ei wneud â data personol, gweler ein hysbysiad preifatrwydd: https://ico.org.uk/global/privacy-notice/ Yn gywir Swyddfa’r Comisiynydd Gwybodaeth