Disclosure Scotland's privacy statement

Disclosure Scotland is an Executive Agency of the Scottish Government. We collect, hold and process personal information because it is necessary for the exercise of our public task.

Under the Protection of Vulnerable Groups (Scotland) Act 2007 (“the PVG Act”), we:

• monitor individuals in regulated roles under the PVG membership scheme as well as issuing confirmation of scheme membership
• administer the barred lists in relation to regulated roles working with children or protected adults

Under the Disclosure (Scotland) Act 2020 (“the Disclosure Act”) we issue Level 1 and 2 disclosures. For this purpose, we access a range of police data as well as data from other sources.

Disclosure Scotland is committed to ensuring all personal information is collected and processed in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.

If you're a PVG scheme member you must keep your details up to date with Disclosure Scotland, for example if you move house. 

Using your information

Disclosure Scotland uses personal information in a number of ways, including:

• assessing eligibility and entitlement to certain levels of disclosures
• prevention, detection and investigation of crime
• for matching purposes to align your information to the correct person profile held on our systems
• checking Police Criminal History Systems for any relevant convictions you may have
• to apply the Rehabilitation of Offenders Act 1974 and its updated/revised schedules and sections
• audit purposes
• statistical analysis and research
• improving service levels
• for members of the PVG scheme, the ongoing monitoring of members for safeguarding/protection purposes
• to allow you to review the content of your disclosure before sharing further
• to prove your identity

Sharing your information

Disclosure Scotland will share your information with other organisations where required to fulfil its safeguarding public task.  We may share information with:

• police forces, to support application processing, prevent and detect crime, and protect vulnerable groups
• employing organisations who have a legal right to see such information under the PVG Act. These are known as Interested Parties who are linked with your account when you apply with them through the PVG scheme
• regulatory bodies who monitor professional competence and maintain standards for the professions they regulate
• NHS Tribunal
• courts services
• Police Criminal Records Office
• UK or overseas government departments and law enforcement agencies
• TransUnion (a data processor of Disclosure Scotland) to verify your identity

Protecting your information

Your personal information will be:

• handled fairly and lawfully
• only kept and used for limited purposes
• adequate, relevant and not excessive
• accurate and kept up to date
• kept no longer than necessary
• processed in line with the data subjects' rights
• held securely
• protected if it's transferred to other countries

Your information will not be made available for commercial use without your permission.

Staff and systems

All our staff, suppliers and contractors are security vetted and trained in data protection to ensure they are aware of their responsibilities.

Your individual rights

You have a number of individual rights. You can:

• ask us to amend any data if it's incorrect
• ask us not to process information used for the disclosure if you have a particular reason
• asking us to make non-automated decisions regarding your data
• claim compensation for damage caused through a data protection breach
• access the data we hold
• stop direct marketing

Read more about your individual rights from the Information Commissioner's Office. 

Help

You can contact our Data Protection Officer by email: dsdpo@disclosurescotland.gov.scot

If you would like to contact us by post, use the address below: 

FAO: Data Protection Officer  
Disclosure Scotland 
PO Box 25 
Glasgow  
G51 1YU 

You can also read our full privacy policy.  

If you're unhappy with the answer you get, or need advice about the use of your personal data, you can contact the Information Commissioner's Office (ICO).