The Parliament’s Safeguarding Policy ensures that the safety and welfare of any children and adults at risk (as defined in the Adult Support and Protection (Scotland) Act 2007) who interact with us is paramount.
The policy sets out the steps that SPCB will take if it receives any information that suggests that a child or vulnerable adult is at risk of harm or abuse. Under this policy, data will be processed only when a child or vulnerable adult may be at risk of harm.
The implementation of this policy reduces the risks of harm to individuals from either of these groups and ensures compliance with relevant legislation and statutory guidance.
Normal category data such as names, addresses and telephone numbers of the child or adult at risk, as well as information about the nature of any alleged harm/abuse.
Depending on the circumstances and the information provided by the child or adult at risk we may process special category and/or criminal offence data when reporting a safeguarding concern.
Special category data as defined by the UK General Data Protection Regulation. Special category data applies to personal data revealing:
Criminal offence data as defined by the UK GDPR is personal data relating to criminal convictions and offence or related security measures.
Personal data will be provided to us directly by individuals (data subjects), or by third parties (e.g. organisations working with the child or adult at risk).
Data protection law states that we must have a legal basis for handling your personal data.
For the purposes of reporting safeguarding concerns the legal basis for processing is where processing is necessary for the purposes of the recognised legitimate interests of safeguarding vulnerable individuals, as set out in Paragraph 6 of Annex 1 of the UK GDPR.
For special category data the condition for processing is where processing is necessary for reasons of substantial public interest on the basis of domestic law (Article 9(2)(g) UK GDPR and Schedule 1, Paragraph 18 of the Data Protection Act 2018 (for safeguarding of children and individuals at risk)).
For criminal offence data the condition for processing is when the processing is authorised by Union or Member State law providing appropriate safeguards for the rights and freedoms of data subjects (Article 10 UK GDPR and Schedule 1, Paragraph 18 of the Data Protection Act 2018 (for safeguarding of children and individuals at risk)).
The personal and special category data gathered by the Parliament under this policy will be shared with a Safeguarding Officer who is part of the Safeguarding Group, which acts as a point of contact for any enquiries or concerns about safeguarding. Where safeguarding concerns are identified Safeguarding Officers may share information about the safeguarding concern with relevant authorities including the police and the onsite police unit. Where the safeguarding concern relates to a child supported by an external partner (e.g. school, youth group, charity, or community organisation) the Safeguarding Officer may share information with the external partner unless there is a risk that the behaviour causing the concern is related to the actions of an employee of that partner.
The requirement to share information about safeguarding concerns is to ensure compliance with the National Guidance for Child Protection in Scotland 2021 - updated 2023 and the Adult Support and Protection (Scotland) 2007 Act, i.e. in circumstances where a child or vulnerable adult is at risk of significant harm. If such a situation occurs, we may share personal and special category data with Police Scotland and/or local authority social services teams).
The personal and special category data gathered by Parliament under this policy and shared with public authorities will be held securely on Scottish Parliament IT systems for a period of six months, after which it will be deleted.
Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below. You can exercise your data subject rights in particular circumstances depending on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.
The following rights may apply:
You have the right to request a copy of the personal information about you that we hold. For further information, have a look at our page on Making a Subject Access Request.
You have the right to ask us to correct the personal data we hold about you. We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
You have the right to object to the processing of your personal data. Where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
You have the right to ask us to delete personal information about you where:
Please note that the right allowing for deletion or erasure of personal data (right to be forgotten) does not apply in cases where personal data is processed for the purposes of the performance of a task carried out in the public interest.
The right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you.
In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where this is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Where we use your personal information with your consent, you may withdraw that consent at any time and we will stop using your personal information for the purposes for which consent was given.
Please contact us in any of the ways set out below if you wish to exercise any of these rights.
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information below.
This privacy statement was last updated on 23 October 2026.
If you have any further questions about the way in which we process personal data, or about how to exercise your rights, please contact the Head of Information Governance and Data Protection Officer at:
The Scottish Parliament
Edinburgh
EH99 1SP
Email: [email protected]
If you are unhappy with the way that we have handled your personal information you can make a complaint to the Information Governance Team of the Scottish Parliament at the following address: [email protected]. We will respond to your complaint without undue delay and within one month. If, having made a complaint, you are still unhappy with the way your personal information has been handled, you can make a complaint to the Information Commission using the following link: https://ico.org.uk/make-a-complaint/