Free Traffic Legal Advice

Hi, 
Would you recommend replying directly to the email they sent, or should I send a new email instead?

Also, should I still use the same email address: info@ukpenforcement.co.uk?

Thanks!

There sent it from the same email address which I sent the original email to which is info@ukpenforcement.co.uk

Please see below:

Apologies for the confusion, I wasn’t sure whether to send it as a new email or reply directly to the one from UKP.

I’ve now sent the email as mentioned above and will keep you all updated if / when I receive a response.

Once again, thank you all for your help and guidance.

Looks like they've realised they messed up by failing to issue a POPLA code, and have withdrawn on that basis.

Damage limitation, I suspect.

Their “clarification” doesn’t change anything: UKPE remains the controller, the clock runs from your original SAR date, and you’re entitled to deal with UKPE directly. A processor (ZZZPS) may assist, but UKPE is responsible for the response and its lawfulness.

Respond with the following:

Subject: Re: SAR – Controller responsibility, deadline and required items – PCN [ref], VRM [reg]

Dear Data Protection Officer,

Thank you for confirming that UK Parking Enforcement Ltd is the data controller and that any processor acts strictly under your instruction. For the avoidance of doubt:

1. The statutory one-month deadline under Article 12(3) UK GDPR runs from my original SAR date [insert date].
2. I will continue to correspond with UKPE as controller. Any response you instruct a processor to compile must be issued on your behalf, with a covering note from UKPE accepting controller responsibility.

Please ensure the SAR bundle includes the personal data and proofs previously requested, specifically:

• A copy of every item of correspondence to/from me (letters, emails) about PCN [ref], including any rejection you allege and any POPLA code;
• Proof of posting/transmission for any such rejection/POPLA (Certificate of Posting or postal/batch manifest; or for email, full SMTP headers and server logs);
• System/audit logs evidencing creation and dispatch of those items (date/time, method, addressee);
• All identifiers you hold for me (name/address/email/phone), their source (including DVLA/KADOE details), and the dates and recipients of any disclosures (including to ZZZPS).

As stated, I rebut any presumption of delivery. Without contemporaneous proof of posting/delivery, you must treat any “rejection” as not served and either cancel or re-issue a rejection to the keeper with a fresh POPLA code.

Finally, my Article 21 objection and Article 18 restriction to debt-collection processing remain in place pending your SAR fulfilment and a lawful conclusion of the appeal process. Please ensure ZZZPS is instructed accordingly.

If a complete response is not provided within the statutory time, I will escalate to the ICO and consider remedies for non-compliance.

Yours faithfully,

[Name]
[Address]
[Email]
[Date]

What response have you had to the email above that I advised you to send to the UKPE DPO? That response is from ZZPS.

Send the following to the UKPE DPO and CC ZZPS and yourself:

Subject: Formal Data Protection Notice – SAR Non-Compliance and Unlawful Processing

PCN [ref] / VRM [reg]

UK Parking Enforcement Ltd – Data Protection Officer

You used your processor (ZZPS) to issue a partial, inadequate response to my SAR dated [date]. As controller, UK Parking Enforcement Ltd remains responsible under Articles 12 and 15 UK GDPR and s.45 DPA 2018 for issuing a full, lawful response.

Your bundle omits my personal data that I expressly requested:

• Proof of posting/transmission for any alleged rejection/POPLA (certificate of posting or postal/batch manifest; or for email, full SMTP headers and server delivery logs identifying my address).
• System/audit entries that record creation and dispatch to me (date/time, method, addressee).

Provide those items, or confirm in writing that they do not exist, within 7 days.

ZZPS’s pages state the Parking Charge has been “withdrawn and the case closed”. Confirm as controller that PCN [ref] is cancelled (£0 balance), all recovery is permanently withdrawn, and no further processing/sharing for enforcement will occur.

Failure to comply will result in a formal complaint to the DVLA Data Sharing Policy & Compliance Team and the ICO for breach of Articles 12 and 15 UK GDPR.

No further correspondence will be entered into unless it is a complete, compliant disclosure.

[Name]
[Date]

Do not give them extra time.cUnder UK GDPR, they had one month from receipt of your SAR on 06/10/2025. The deadline is 06/11/2025. They can extend by up to two further months only if they told you within that first month that your request is complex and explained why. If they didn’t do that by 06/11/2025, they’re late.

If 06/11/2025 passes with no complete controller response from UKPE (not ZZPS alone), same day, send a final non-compliance notice (short template below). Then file an ICO complaint against UKPE (controller).

Separately, file a DVLA complaint to the Data Sharing Policy & Compliance Team about:

If they respond after 06/11/2025 but it’s incomplete or still issued only by ZZPS, you can still complain to the ICO for late and/or incomplete SAR.

1-paragraph final non-compliance notice (send 07/11/2025 if needed):

Subject: SAR Non-Compliance – PCN [ref], VRM [reg] (deadline missed)

UK Parking Enforcement Ltd – Data Protection Officer

My SAR was received by you on 06/10/2025. The statutory one-month period expired 06/11/2025 with no complete controller response from UK Parking Enforcement Ltd and no timely extension notification under Article 12(3). You are now in breach of Articles 12 and 15 UK GDPR. Provide the missing items (proof of posting/transmission and the audit/dispatch entries containing my personal data) within 7 days or confirm in writing that they do not exist. Failing that, I will proceed with complaints to the ICO and DVLA Data Sharing Policy & Compliance Team.

Also confirm, as controller, that PCN [ref] is cancelled (£0) and that no further processing/sharing for enforcement will occur.

[Name]

ICO complaint (points to include):



DVLA complaint (outline):


ZZPS's written admission that they went to debt “without a POPLA code being issued” is powerful. Keep that page prominent. It supports both your DVLA complaint and any future challenge if this ever resurfaces.