MSP Appointment

Categories of personal data processed

Personal data is defined as information about a living individual who can be identified either directly from the information or indirectly from the information in combination with other information that may be available. We will process normal category data (such as your name, address and contact information) and *special category data (such as information about health, ethnicity and political views and opinions).

*Special category data consists of information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Purposes of the processing:

We will process personal data of current and former Members for the following purposes:

• To enable oath taking or affirmation on becoming an MSP
• To contact you and any next of kin where appropriate. This includes contacting you through the emergency messaging service
• To record and publish biographical information about you, including information about your constituency and length of service; membership of committees and cross-party groups; parliamentary roles, government roles and party roles – to inform the public about MSPs
• To monitor the demographics of MSPs in general
• To take photographs, images and recordings filmed on SP TV showing the work of MSPs
• To record CCTV footage within the parliament estate for security purposes
• To take other relevant security measures for your protection
• To record information about declaration of interests and registration of any financial interests you may have
• To record information about any registered lobbying
• To record information about bank accounts and related financial information for the purposes of processing payments (such as salaries and expenses) including liaising with the Scottish Public Pensions Agency who administer the parliamentary pension scheme
• To record information about expenses claims under the Members’ Expenses scheme
• To record entitlements to benefits including childcare vouchers (for applications made prior to closure of the childcare vouchers scheme in 2018) and the cycle to work scheme
• To obtain passport details and related travel information
• To record information about health for the purposes of providing support and making reasonable adjustments
• To record and use information about dietary requirements for catering purposes
• To protect your vital interests or those of another person (in exceptional circumstances, such as a medical emergency)
• To notify you of any complaints received and for the purposes of investigating and responding to complaints
• To support you in your role in general following your appointment as an MSP in terms of which your personal data will be processed by the Parliamentary staff offices of the SPCB details

Further information on Parliamentary staff offices

Source of the information

Personal data will primarily be provided to us directly from you as an MSP. However, there may be occasions when information is provided from the following sources:

• Medical professionals may provide us with the following personal information: occupational health reports, health data relating to disability, medication, treatment and required adjustments

Legal basis for data processing

Data protection law states that we must have a legal basis for handling your personal data. The legal basis for processing are as follows:

• The legal basis for the processing of personal data in relation to the support provided to you as an MSP (details of which are referred to above) is for the purposes of the performance of a task carried out in the public interest in terms of Article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR) and section 8(c) of the Data Protection Act 2018 (DPA). The provision of support to MSPs is a core function of the SPCB in terms of section 21 of the Scotland Act 1998;
• For the processing of special category data in relation to the provision of support to MSPs we rely on the condition for processing in terms of Article 9(2)(g) UK GDPR where processing is necessary for reasons of substantial public interest with a basis in UK law in terms of paragraph 6(1) of part 2 to schedule 1 of the DPA. The substantial public interest condition is that the processing of special category data is necessary for the purposes of providing support to MSPs which is a core function of the SPCB in terms of section 21 of the Scotland Act 1998;
• Where personal data is processed for the purposes of making reasonable adjustments the legal basis for processing is for compliance with a legal obligation in terms of Article 6(1)(c) UK GDPR with a condition for processing in terms of Article 9(2)(g) and paragraph 8(1) of part 2 to schedule 1 of the DPA. The legal basis and condition for processing is that the processing is necessary to comply with our legal obligations to make reasonable adjustment in terms of section 20 of the Equality Act 2010;
• The legal basis for processing personal data in order to assess entitlement to benefits such as childcare vouchers and the cycle to work scheme is consent in terms of Article 6(1)(a) UK GDPR and you will be asked to provide your consent to the processing of your personal data in these circumstances;
• The legal basis for processing personal data for oath taking or affirmation is that the processing is necessary for compliance with a legal obligation to which the controller is subject in terms of Article 6(1)(c) UK GDPR. In terms of section 84 of the Scotland Act 1998 a Member may not participate in proceedings of the parliament until they have taken the oath or affirmation;
• For the processing of personal data in order to monitor the demographics of MSPs the processing is necessary for the purpose of a legitimate interest of the SPCB in terms of Article 6(1)(f) UK GDPR when balanced against your interests or rights. The legitimate interest is to be able to monitor the demographics of MSPs for equalities purposes;

• The legal basis for processing of your personal data in relation to the emergency messaging service is that it is in the legitimate interests pursued by the SPCB in terms of Article 6(1)(e) of the UK GPDR. The legitimate interest is to ensure we are able to contact you in the event of an emergency or incident. This is to protect the interests, health and wellbeing of MSPs, parliamentary staff and contactors by ensuring relevant people are informed quickly of an emergency, particularly where there is a risk to personal safety.

• The legal basis for processing your personal data in the event of a medical emergency is where processing is necessary in order to protect your vital interests in terms of Article 6(1)(d) UK GDPR and for special category data Article 9(2)(c) where processing is necessary to protect your vital interests where you are unable to give consent.
• The legal basis for sharing personal data with Police Scotland and the Scottish Government (as set out below under ‘Data Sharing’) is for the purposes of a task carried out in the public interest in terms of Article 6(1)(e) UK GDPR. For the processing of any special category data in these circumstances the condition for processing is in terms of Article 9(2)(g) UK GDPR and paragraph 6(1)(b) of part 2 to schedule 1 of the DPA. The task is to ensure the safety of MSPs which is a core task of the SPCB.

Data sharing

We may share your personal information with the following third parties:

• HMRC;
• Banks/ Building society;
• Our service providers, including IT service providers;
• payroll and pension administrators; and those involved in providing benefits in connection with your appointment, such as for example childcare vouchers;
• Health professionals and occupational health providers involved in your care;
• Internal and external auditors;
• Police Scotland in order to assess and mitigate security risks to current MSPs and to co-operate with enquiries and for the purposes of carrying out background checks of former MSPs seeking a former Members security pass;
• The Scottish Government for the purposes of sharing personal security information for MSPs in the role of Scottish Ministers;
• Biographical information and information about declaration of interests, financial interests and expenses claims are published on the webpages for current and former MSPs which can be accessed on the Scottish Parliament website at the following link: Current and previous MSPs
• Information about registered lobbying activities is published in the lobbying register: Lobbying Register

• For the emergency messaging service, we use Alert Cascade to host the software system which trained parliament staff will use to alert SPCB staff, MSPs, MSPs staff and contractors in the event of an emergency. Read the privacy notice for Alert Cascade. 

• Other third parties as necessary to comply with the law.

We may also process your personal data where there is a legal requirement to disclose information about you in response to a request for information under the Freedom of Information (Scotland) Act 2002 or the Environmental Information Regulations 2004. Where appropriate, we will provide you with a courtesy copy of the reply and the information we are disclosing before releasing the information into the public domain. You can access information about freedom of information on the Scottish Parliament website.

Further information on Freedom of Information

Retention of data

We will retain your personal data for as long as is necessary for the purpose for which it was collected. The length of time personal data is retained for differs depending on the purpose of the processing as well as any relevant legal requirements. Applicable retention periods can be accessed in the Records Retention Schedule.

Further information on the Records Retention Schedule

Children and young people safeguarding and child protection

In line with the principles underlying the National Guidance for Child Protection in Scotland 2021 - updated 2023 - gov.scot, our staff may report a concern to the relevant authorities if they come across an issue during their work which causes them to think that a child or adult may be at risk of abuse or harm. 

Your rights

Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below. You can exercise your data subject rights in particular circumstances depending on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.

The following rights may apply:

Access to your information

You have the right to request a copy of the personal information about you that we hold.

Request personal information about you that we hold 

Correcting your information

You have the right to ask us to correct the personal data we hold about you. We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards

Objecting to how we may use your information

Where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.

• Please note that the right to object to the processing of personal data does not apply where the data subject has consented to the processing, subject to the right to withdraw consent.
• The right to object to the processing of personal data for the purposes of a public interest task is restricted if there are legitimate grounds for the processing which override the interest of the data subject.
• The right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you.

Deletion of your information

You have the right to ask us to delete personal information about you where:

• You consider that we no longer require the information for the purposes for which it was obtained
• We are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below
• You have validly objected to our use of your personal information – see Objecting to how we may use your information above
• Our use of your personal information is contrary to law or our other legal obligations

Please note that the right allowing for deletion or erasure of personal data (right to be forgotten) does not apply in cases where personal data is processed for the purposes of the performance of a task carried out in the public interest.

The right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you.

Restricting how we may use your information

In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Withdrawing consent to using your information

Where we use your personal information with your consent, you may withdraw that consent at any time and we will stop using your personal information for the purposes for which consent was given.

Please contact us in any of the ways set out below if you wish to exercise any of these rights.

Changes to our privacy statement

We keep this privacy statement under regular review and will place any updates on this website.  Paper copies of the privacy statement may also be obtained using the contact information below. 

This privacy statement was last updated on 12 May 2026.

Contact information and further advice

If you have any further questions about the way in which we process personal data, or about how to exercise your rights, please contact the Head of Information Governance and Data Protection Officer at:
The Scottish Parliament
Edinburgh
EH99 1SP

Email: [email protected]

Please contact us if you require information in another language or format

Complaints

If you are concerned that we have not handled your personal information properly you can make a complaint to the Information Governance Team of the Scottish Parliament at the following address: [email protected]. We will respond to your complaint without undue delay and within one month. If, having made a complaint, you are still concerned that your personal information has not been handled properly, you can make a complaint to the Information Commissioner's Office.