Privacy Notice – Law Enforcement
Privacy Notice – Academic Research
Who we are
The Police Service of Scotland is a constabulary established under the Police and Fire Reform (Scotland) Act 2012. Its headquarters is located at Tulliallan Castle, Kincardine, FK10 4BE, United Kingdom, and you can contact our Data Protection Officer by post at this address, by email at: dataprotection@scotland.police.uk, and by telephone on 101.
The Academic Research Department can be contacted by email at: academicresearch@scotland.police.uk.
About this notice
This notice is to advise you (you are also referred to as the data subject) how your personal data (information) will be dealt with (processed) by Police Scotland and your rights in relation to the processing.
This notice covers information processed for a non-crime purpose (academic research).
The Chief Constable of the Police Service of Scotland is the controller of your personal information and decides the purposes for which your personal information will be processed.
The information below provides you with details of:
- what is personal information?
- why we process your personal information
- our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
- personal and/or special category data provided by the data subject when relevant – information provided by you.
- source of personal data when not provided by the person to whom it relates
- the length of time we will keep your information
- organisations or individuals we may share your information with
- your rights
- how to complain
In addition to the details below, your information may also be used by Police Scotland for administrative purposes such as system testing, training and audit purposes.
Where this is the case, the processing will be in accordance with the UK GDPR and Data Protection Act 2018.
Where information has been processed previously for Law Enforcement purposes, any further use will be compatible with the original purpose for which the information was processed, and will be authorised by law.
What is personal data?
Personal data is information that can identify you, for example name, address, date of birth. It also includes alleged or actual offending information when processed for non-crime purposes.
There is also another type of personal data which is called ‘special category personal data’. This is information which relates to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation.
Why we process your personal information
Where researchers are requesting access to non-public or sensitive data it may be necessary to undertake a background check of the practitioners involved in the study; this would be undertaken only with the consent of practitioners, and would be independently conducted by Police Scotland's Vetting team (see also the Police Scotland Vetting Privacy Notice).
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
- Consent – Article 6(1)(a) - we have permission from you after we gave you all the relevant information (you retain the right to withdraw your consent at any time).
- Public task – Article 6(1)(e)
- Substantial public interest – Article 9(2)(g)
- Criminal convictions and offences – Article 10.
Personal and/or special category data provided by the data subject when relevant
Personal data includes name, date of birth, address, previous addresses, telephone number.
Source of personal data when not provided by the person to whom it relates
Police systems/other UK police forces.
Length of time we keep your information
The relevant codes from our Record Retention SOP are as follows:
ADM-025 The process of preparing business for cross-departmental and/or divisional consideration and making a record of discussion, debate and resolutions
This relates to written (email) correspondence between the subject and Police Scotland in relation to research proposals, and any records that are subsequently created which contain subject information.
Where research collaboration is formally undertaken between the subject and Police Scotland the working relationship between parties will be considered ‘live’ – the record retention rule will apply to the scheduled end-date of the research project, and will require historic email correspondence and any data capture relating to the subject to be destroyed. The retention rule for these records are current year +3.
PER-045 The process of vetting non-police personnel (NPPV) to allow access to force facilities
If a research proposal seeks access to Police Scotland facilities or information that is not in the public domain, the subject may be required to undergo vetting. The retention rule for these records are current year +6.
Organisations or individuals we may share your information with
Police Scotland will not share your personal data with any external party.
Your Rights
You have certain rights in relation to how we process your personal information. These are listed below.
Right of access
You can make what is called a Subject Access Request to us.
You are entitled to, amongst other things, a copy of the information we hold on you, although there are exceptions to this.
For further information and details on how to make a subject access request please visit the Police Scotland website.
Right to rectification (correction)
We must correct without delay, any personal information we hold on you which is not accurate.
If you think anything is wrong, you should contact us by post or e mail, where possible by completing the form on our website at:
https://www.scotland.police.uk/access-to-information/data-protection/your-rights
There are exceptions to when we have to correct the information, and you will be advised if we have to apply them.
If it is not possible to establish the accuracy of the personal information, we will restrict how we process it, for example restrict who can see your information, or who we disclose it to.
Right to erasure or restriction of processing
You have a right to request that we delete your personal information, but this will only be done when we are not legally required to keep it.
On occasion it may be more appropriate to restrict how we process it, for example restrict who can see your information, or who we disclose it to.
You can find more information on our website at:
https://www.scotland.police.uk/access-to-information/data-protection/your-rights
Right to object
You also have the right to object to the processing we carry out, if our legal basis for doing so, (see the ‘Purpose and basis for processing’ table above), is for carrying out a task in the public interest, exercising our lawful duty or we believe it is in our legitimate interests.
You can find more information on our website at:
https://www.scotland.police.uk/access-to-information/data-protection/your-rights
For more information about any of these rights, go to:
www.scotland.police.uk/access-to-information/data-protection/your-rights
or email:
information.assurance@scotland.police.uk.
How to complain
If we refuse to carry out your requests in full, you have the right to ask the Information Commissioner to check whether our decision is correct.
If you are unhappy in any way with how we have dealt with your information, you have the right to complain to the Information Commissioner.
The Information Commissioner can be contacted at:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113 (local rate)
Date of next review of this document – 1 Jan 2027