MSP Appointment

This privacy statement explains how we collect and use personal information as a data controller for the following process:

Work related processing - Members of the Scottish Parliament (MSP). Reference to ‘we’ are to the Scottish Parliamentary Corporate Body (SPCB) which provides support to you as an MSP to enable you to carry out your parliamentary duties.

Some of the language used in privacy notices can be specialised. The Information Commissioner's website provides .

Categories of personal data processed

Personal data is defined as information about a living individual who can be identified either directly from the information or indirectly from the information in combination with other information that may be available. We will process normal category data (such as your name, address and contact information) and *special category data (such as information about health, ethnicity and political views and opinions).

*Special category data consists of information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Purposes of the processing:

We will process personal data of current and former Members for the following purposes:

To enable oath taking or affirmation on becoming an MSP
To contact you and any next of kin where appropriate
To record and publish biographical information about you, including information about your constituency and length of service; membership of committees and cross-party groups; parliamentary roles, government roles and party roles – to inform the public about ��˿��
To monitor the demographics of ��˿�� in general
To take photographs, images and recordings filmed on SP TV showing the work of ��˿��
To record CCTV footage within the parliament estate for security purposes
To take other relevant security measures for your protection
To record information about declaration of interests and registration of any financial interests you may have
To record information about any registered lobbying
To record information about bank accounts and related financial information for the purposes of processing payments (such as salaries and expenses) including liaising with the Scottish Public Pensions Agency who administer the parliamentary pension scheme
To record information about expenses claims under the Members’ Expenses scheme
To record entitlements to benefits including childcare vouchers (for applications made prior to closure of the childcare vouchers scheme in 2018) and the cycle to work scheme
To obtain passport details and related travel information
To provide information about health for the purposes of providing support and making reasonable adjustments
To protect your vital interests or those of another person (in exceptional circumstances, such as a medical emergency)
To notify you of any complaints received and for the purposes of investigating and responding to complaints
To support you in your role in general following your appointment as an MSP in terms of which your personal data will be processed by the Parliamentary staff offices of the SPCB details

Further information on Parliamentary staff offices

Source of the information

Personal data will primarily be provided to us directly from you as an MSP. However, there may be occasions when information is provided from the following sources:

Medical professionals may provide us with the following personal information: occupational health reports, health data relating to disability, medication, treatment and required adjustments

Legal basis for data processing

Data protection law states that we must have a legal basis for handling your personal data. The legal basis for processing are as follows:

The legal basis for the processing of personal data in relation to the support provided to you as an MSP (details of which are referred to above) is for the purposes of the performance of a task carried out in the public interest in terms of Article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR) and section 8(c) of the Data Protection Act 2018 (DPA). The provision of support to ��˿�� is a core function of the SPCB in terms of section 21 of the Scotland Act 1998;
For the processing of special category data in relation to the provision of support to ��˿�� we rely on the condition for processing in terms of Article 9(2)(g) UK GDPR where processing is necessary for reasons of substantial public interest with a basis in UK law in terms of paragraph 6(1) of part 2 to schedule 1 of the DPA. The substantial public interest condition is that the processing of special category data is necessary for the purposes of providing support to ��˿�� which is a core function of the SPCB in terms of section 21 of the Scotland Act 1998;
Where personal data is processed for the purposes of making reasonable adjustments the legal basis for processing is for compliance with a legal obligation in terms of Article 6(1)(c) UK GDPR with a condition for processing in terms of Article 9(2)(g) and paragraph 8(1) of part 2 to schedule 1 of the DPA. The legal basis and condition for processing is that the processing is necessary to comply with our legal obligations to make reasonable adjustment in terms of section 20 of the Equality Act 2010;
The legal basis for processing personal data in order to assess entitlement to benefits such as childcare vouchers and the cycle to work scheme is consent in terms of Article 6(1)(a) UK GDPR and you will be asked to provide your consent to the processing of your personal data in these circumstances;
The legal basis for processing personal data for oath taking or affirmation is that the processing is necessary for compliance with a legal obligation to which the controller is subject in terms of Article 6(1)(c) UK GDPR. In terms of section 84 of the Scotland Act 1998 a Member may not participate in proceedings of the parliament until they have taken the oath or affirmation;
For the processing of personal data in order to monitor the demographics of ��˿�� the processing is necessary for the purpose of a legitimate interest of the SPCB in terms of Article 6(1)(f) UK GDPR when balanced against your interests or rights. The legitimate interest is to be able to monitor the demographics of ��˿�� for equalities purposes;
The legal basis for processing your personal data in the event of a medical emergency is where processing is necessary in order to protect your vital interests in terms of Article 6(1)(d) UK GDPR and for special category data Article 9(2)(c) where processing is necessary to protect your vital interests where you are unable to give consent.
The legal basis for sharing personal data with Police Scotland and the Scottish Government (as set out below under ‘Data Sharing’) is for the purposes of a task carried out in the public interest in terms of Article 6(1)(e) UK GDPR. For the processing of any special category data in these circumstances the condition for processing is in terms of Article 9(2)(g) UK GDPR and paragraph 6(1)(b) of part 2 to schedule 1 of the DPA. The task is to ensure the safety of ��˿�� which is a core task of the SPCB.

Data sharing

We may share your personal information with the following third parties:

HMRC;
Banks/ Building society;
Our service providers, including IT service providers;
payroll and pension administrators; and those involved in providing benefits in connection with your appointment, such as for example childcare vouchers;
Health professionals and occupational health providers involved in your care;
Internal and external auditors;
Police Scotland in order to assess and mitigate security risks to current ��˿�� and to co-operate with enquiries and for the purposes of carrying out background checks of former ��˿�� seeking a former Members security pass;
The Scottish Government for the purposes of sharing personal security information for ��˿�� in the role of Scottish Ministers;
Biographical information and information about declaration of interests, financial interests and expenses claims are published on the webpages for current and former ��˿�� which can be accessed on the Scottish Parliament website at the following link: Current and previous ��˿��
Information about registered lobbying activities is published in the lobbying register: Lobbying Register
Other third parties as necessary to comply with the law.

We may also process your personal data where there is a legal requirement to disclose information about you in response to a request for information under the Freedom of Information (Scotland) Act 2002 or the Environmental Information Regulations 2004. Where appropriate, we will provide you with a courtesy copy of the reply and the information we are disclosing before releasing the information into the public domain. You can access information about freedom of information on the Scottish Parliament website.

Further information on Freedom of Information

Retention of data

We will retain your personal data for as long as is necessary for the purpose for which it was collected. The length of time personal data is retained for differs depending on the purpose of the processing as well as any relevant legal requirements. Applicable retention periods can be accessed in the Records Retention Schedule.

Further information on the Records Retention Schedule

Children and young people safeguarding and child protection

In line with the principles underlying the , our staff may report a concern to the relevant authorities if they come across an issue during their work which causes them to think that a child or adult may be at risk of abuse or harm. 

Your rights

Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below. You can exercise your data subject rights in particular circumstances depending on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.

The following rights may apply:

Access to your information

You have the right to request a copy of the personal information about you that we hold.

Request personal information about you that we hold

Correcting your information

You have the right to ask us to correct the personal data we hold about you. We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards

Objecting to how we may use your information

Where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.

Please note that the right to object to the processing of personal data does not apply where the data subject has consented to the processing, subject to the right to withdraw consent.

The right to object to the processing of personal data for the purposes of a public interest task is restricted if there are legitimate grounds for the processing which override the interest of the data subject. This will be considered on a case-by-case basis and depends on what personal data is involved and the risks further processing of that data could pose to you.

The right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation.

Deletion of your information

You have the right to ask us to delete personal information about you where:

You consider that we no longer require the information for the purposes for which it was obtained
We are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below
You have validly objected to our use of your personal information – see Objecting to how we may use your information above
Our use of your personal information is contrary to law or our other legal obligations

Please note that the right allowing for deletion or erasure of personal data (right to be forgotten) does not apply in cases where personal data is processed for the purposes of the performance of a task carried out in the public interest.

The right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation.

Restricting how we may use your information

In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Withdrawing consent to using your information

Where we use your personal information with your consent, you may withdraw that consent at any time and we will stop using your personal information for the purposes for which consent was given.

Please contact us in any of the ways set out below if you wish to exercise any of these rights.

Changes to our privacy statement

We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information below.

This privacy statement was last updated on 2 June 2025.

Complaints

We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner's Office online at: .

Or by phone at: 0303 123 1113

Contact information and further advice

If you have any further questions about the way in which we process personal data, or about how to exercise your rights, please contact the Head of Information Governance and Data Protection Officer at:
The Scottish Parliament
Edinburgh
EH99 1SP

Email: [email protected]

Please contact us if you require information in another language or format

���˿���