I read it here:
Paragraph 9(4) & (5)
However in the letter I received back from the company, they state "There is no legal requirement to send out the PCN within 14 days of the incident as there is no reference to POFA on this ticket."
However, there was no "windscreen ticket", the company uses number plate recognition cameras and then presumably has to obtain the keepers address from the DVLA in order to post the initial PCN.
If they are obtaining my personal information does the POFA not automatically apply, if not, what protection do I, as an individual, have regarding companies obtaining and using my data? i.e. what legislation are they operating under?
Yes and yes.