The purpose of the processing is to capture who has signed up to the Employers’ Pledge. This information will be displayed on the Scottish Parliament website to provide transparency about who has signed up, and to encourage MSPs and contractors to adopt the pledge.
For MSPs, the MSP’s name and party will be displayed on the website.
For individual contractors, the data of the employing company/organisation will be displayed on the website (not the name of the individual who signed the pledge).
Categories of information processed
Normal category data category data will be processed in the form of names of signatories. Contractors will also be asked to provide the name of the company or organisation they work for.
MSPs will also be asked to provide their political party. This constitutes special category data under the UK GDPR.
Data will be provided directly by MSPs and by contractors working with the Scottish Parliament.
Data protection law states that we must have a legal basis for handling your personal data.
For recording and publishing MSP and contractor signatories of the Employers’ Pledge, the legal basis for processing of personal data is that it is carried out in the legitimate interest of the SPCB. The legitimate interest is to establish shared expectations of dignity, courtesy and respect across all employers in the Scottish Parliament (Art 6(1)(f) UK GDPR.).
For the processing of MSP party membership, which constitutes special category data under the UK GDPR, the legal basis for processing is that the processing relates to personal data which are manifestly made public by the data subject (Art 9(2)(e) UK GDPR).
For the capture and preservation of information on the Scottish Parliament website by National Records of Scotland, the legal basis for processing is that it is necessary for archiving purposes in the public interest in terms of Article 6(1)(e) of the UK GDPR and section 8(d) of the DPA or, for special category data, the conditions for processing are in terms of Article 9(2)(j) of the UK GDPR (which applies to archiving in the public interest), and Section 10(2) and paragraph 4 of Schedule 1 of the DPA.
The data will be held by the SPCB and published on the Scottish Parliament website. This is to provide the general public with transparency on who amongst their elected representatives at the Scottish Parliament, and the contractors / organisations that work with the SPCB have committed to the principles in the Employers’ Pledge.
Data on Scottish Parliament IT systems will be retained for the duration of the parliamentary session for the purpose of ensuring the data on the website is accurate and then deleted.
Data which is published on our website will be visible there for the duration of the parliamentary session and then removed. In the case of contractors, we will display only the organisation name and not that of any individual. Any contractors who sign up to the pledge will be removed once their contract has expired either during or at the end of the parliamentary session.
Our website is regularly captured by National Records of Scotland in accordance with our obligations under the Public Records (Scotland) Act 2011. This means that the published information will remain publicly available in the NRS archive after we have removed it from our website.
In line with the principles underlying the National Guidance for Child Protection in Scotland, our staff may report a concern to the relevant authorities if they come across an issue during their work which causes them to think that a child may be at risk of abuse or harm.
Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below. You can exercise your data subject rights in particular circumstances depending on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.
The following rights may apply:
Access to your information – You have the right to request a copy of the personal information about you that we hold.
Find out how to make a data protection subject access request
Correcting your information – You have the right to ask us to correct the personal data we hold about you. We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Objecting to how we may use your information – You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
Deletion of your information – You have the right to ask us to delete personal information about you where:
Restricting how we may use your information – In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Please contact us in any of the ways set out below if you wish to exercise any of these rights.
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information below. This privacy statement was last updated on 8 May 2026.
If you have any further questions about the way in which we process personal data, or about how to exercise your rights, please contact the Head of Information Governance at:
The Scottish Parliament
Edinburgh
EH99 1SP
If you are concerned that we have not handled your personal information properly you can make a complaint to the Information Governance Team of the Scottish Parliament at the following address: [email protected]. We will respond to your complaint without undue delay and within one month. If, having made a complaint, you are still concerned that your personal information has not been handled properly, you can make a complaint to the Information Commissioner's Office.