Your Rights

You have a number of rights in relation to the personal data that Police Scotland holds about you. The GDPR and Data Protection Act 2018 made these rights easier to exercise, however, they are dependent on our justification – or ‘lawful basis’ – for processing your data.

Our Privacy Notices explain the variety of purposes for which we process personal data, and the lawful basis that justifies each of these activities under data protection law.

Making a request

If you wish to exercise any of the below rights, please download and complete this form and post or email it to the address on the form, or hand it in to any police station or public enquiry office. You will also need to provide photocopies / scans / photographs of two official documents which confirm your identity and personal details. 

There is usually no fee for making a request, and we aim to respond within one calendar month. If the request is complex or repetitive, we may need to extend this period and/or charge a fee. If this is the case, we will notify you of our decision and the reasons for it.

If you are unhappy with the way we have dealt with your request, you have the right to lodge a complaint with the ICO. We will provide details of this when responding to your request.

Right to be informed

We must provide accessible, clear and concise information about our use of your personal data, including what data we collect, the reasons for processing it, how long we retain it and who we share it with. This information is provided in our Privacy Notices, on Police forms and on posters in police stations.

Right of access

You can make a subject access request for confirmation of whether your data is being processed, and for a copy of the information we hold about you. Although in most cases there is no longer a fee for these requests, we still require two forms of ID, and we may withhold information if it is subject to an exemption under the Data Protection Act.

These exemptions include:

• When providing the information would hinder the prevention or detection of crime or the apprehension or prosecution of offenders
• When the information relates to another individual, unless the requester provides that individual’s written consent and proof of their identity
• When the information is subject to confidentiality e.g. employment references and ongoing disciplinary proceedings

If we do withhold some or all of the information requested, we will advise you of this and the reasons for doing so, as well as your right to appeal the decision.

See the Subject Access Requests page for more information on how to make a request.

Right to rectification

You can ask us to correct or amend any personal data we hold about you that is inaccurate or incomplete. If we are satisfied that the supplied information is correct, we will make the necessary changes, advise (where possible) any organisations that we share your data with, and inform you of the outcome.

If we are unsure whether the information supplied is correct, and/or whether the data we hold should be amended, we must restrict the processing of the data until the accuracy can be confirmed. Where this is the case, we will advise you of our decision and the reasons for it.

If we are required to maintain the data in its current form for evidence purposes as part of our law enforcement activities, we must also restrict the processing of the data for the duration of the relevant proceedings. Where this is the case, we will advise you of our decision.

Right to erasure (‘right to be forgotten’)

You can ask us to destroy personal data that we hold about you. However, this right is not absolute, and does not apply in the following circumstances:

• When the personal data is processed in order to comply with a legal obligation
• When the data is required to carry out our public task or exercise our official authority
• When the data must be retained as evidence as part of our law enforcement activities

If we refuse to comply with your request as per the above or for any other reason, we will advise you of our decision and, where appropriate, the reasons for it.

Circumstances where a request would be accepted include:

• When the data is no longer necessary for the purpose for which it was originally processed
• When you object to the processing and there is no overriding basis for it to continue
• When the processing is based on consent, and you withdraw that consent.

If we accept your request, we will make the necessary changes, advise (where possible) any organisations that we share your data with, and inform you of the outcome.

Right to restrict processing

You can ask for restrictions to be placed on the processing of your personal data, such as who can access it or who we share it with. This may be because the data is no longer required but you oppose its erasure, or because you wish to challenge the accuracy of the data.

Restriction may also occur when you have expressed an objection to processing of personal data carried out on the basis of our public task or official authority and we are considering whether we have overriding legitimate grounds to continue.

If we accept your request, we will advise you of the actions we have taken to restrict the processing of your personal data. If we refuse to comply with your request, we will advise you of our decision and the reasons for it.

Right to object to processing

You can object to our processing of your personal data, but only where it is carried out on the basis of our public task or official authority, or our legitimate interests. Similarly, where we process your data on the basis of consent, you have the right to withdraw that consent.

However, although you have the right to object as above, we do not always have to comply with an objection. In particular, any processing that is necessary for law enforcement purposes is exempt from the right to object, and we may also be able to demonstrate that we have other compelling legitimate grounds for the processing.

If we accept your request, we will advise you of the actions we have taken to stop the processing of your personal data. If we refuse to comply with your request, we will advise you of our decision and, where appropriate, the reasons for it.