The SPCB is responsible, under s.21 of the Scotland Act 1998, for providing the Parliament and its Committees with the property, staff and services required for their purposes. This includes processing personal data in order to support Committees in carrying out their work.
The SPPAC is the Committee of the Scottish Parliament with responsibility, under the Parliament’s Standing Orders, the MSPs’ Code of Conduct (the Code) and associated Guidance on the Code, for considering and reporting on whether a Member’s conduct is in accordance with the Code, including matters relating to Members’ interests and the conduct of Members in carrying out their parliamentary duties.
Personal data is processed in these circumstances for the purpose of enabling the SPPAC to consider and report on matters and, where required, to reach a decision on whether to recommend to Parliament that a Member’s rights and privileges be withdrawn to any extent – or on other parliamentary sanctions to be applied.
The SPPAC can receive personal data connected with these matters from a number of sources and bodies, including from the office of the Presiding Officer, the Ethical Standards Commissioner (ESC) and the SPCB.
Material considered by the SPPAC in the matters referred to above may contain a wide range of personal data including the names, job details, financial information and accounts of conduct of respondents, complainers and any witnesses to alleged conduct. Such material, along with evidence from witnesses and any written representations submitted by complaint respondents, is also highly likely to be included in any report made by the SPPAC to Parliament at the end of its consideration.
The SPCB will process this information in order to support the SPPAC in its consideration, discussions and ultimately publication of its report to Parliament where required.
The legal basis for processing personal data received by the SPPAC in these matters is that it is a task performed in the exercise of official authority set out in law – specifically section 8(e) of the Data Protection Act 2018 (DPA), sections 22 and 39 of the Scotland Act 1998 and rules 1.6 and 6.4 of the Standing Orders of the Scottish Parliament.
To the extent that the information processed constitutes special category personal data, the legal basis for processing is that the processing is necessary for reasons of substantial public interest in terms of Article 9(2)(g) GDPR and s10(3) and paragraph 6(2)(b) of part 2, schedule 1 DPA. For criminal offence data contained relating to complaints or conduct matters, the legal basis is as set out in Article 10 UK GDPR and section 10(5) DPA, together with paragraph 6 (2)(b), Part 2, Schedule 1, DPA.
Personal data processed for this purpose will be shared with the membership of the SPPAC, and with parliamentary officials tasked with supporting the SPPAC in its work. The SPPAC’s consideration of complaints and any discussions regarding such complaints would normally be conducted in private.
Where the SPPAC is required to reach a decision on matters under consideration as part of its remit, that decision may be announced in public. The SPPAC may also be required to make a report to Parliament at the end of its consideration. In these circumstances, the SPPAC’s report to Parliament will normally incorporate any other report received by the SPPAC at the outset or in the course of its consideration (for example from the office of the ESC or the SPCB), together with any relevant evidence.
It is also possible that the SPPAC may decide to remit an excluded complaint to the office of the ESC following its consideration, under s.12 of the Scottish Parliamentary Standards Commissioner Act 2002. The ESC is a separate data controller to the SPCB and, in this instance, it would be for the ESC to determine separately under its own data protection policies how any personal data contained in a complaint or related documentation should be handled by it once received.
Personal data relating to complaints and other conduct matters that is held by the SPPAC will be retained securely on the Scottish Parliament’s IT systems. All complaints and any supporting documentation are retained until the end of the Parliamentary session in which the complaint was made, plus 6 years.
Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below.
You have the right to request a copy of the personal information about you that we hold. For further information, have a look at our page on Making a Subject Access Request.
You have the right to ask us to correct the personal data which the SPCB holds about you. Your personal information should be accurate, complete and up to date and you may ask the SPCB to correct any personal information about you that you believe does not meet these standards.
You have the right to ask that the SPCB stops processing your personal data for the purpose of supporting the SPPAC to consider matters under its remit. If you do this, the SPCB must stop processing that data unless there are overriding legitimate grounds to continue.
The right to object to the processing of personal data for the purposes of a public interest task is restricted if there are legitimate grounds for the processing which override the interest of the data subject. This means that if the SPCB can identify a legitimate reason to continue processing which overrides your interest as an individual, it can continue to do so.
The right of erasure (or the right to have your information deleted) does not apply where processing is necessary for performance of a task carried out in the public interest or in the exercise of official authority, and so that right does not apply in the case of consideration by the SPPAC of matters within its remit.
In some cases, you may ask the SPCB to restrict how your personal information is used. This right might apply, for example, where the Parliament is checking the accuracy of personal information about you that it holds or assessing the validity of any objection you have made to the use of your information. The right might also apply where there is no longer an applicable legal basis for using your personal information, but you do not want the SPCB to delete it.
Where this right is validly exercised, the SPCB may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Please get in touch in any of the ways set out below if you wish to exercise any of these rights.
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information below.
This privacy notice was last updated on 18 September 2025.
If you are concerned that we have not handled your personal information properly you can make a complaint to the Information Governance Team of the Scottish Parliament at the following address: [email protected] We will respond to your complaint without undue delay and within one month.
If, having made a complaint, you are still concerned that your personal information has not been handled properly, you can make a complaint to the Information Commissioner's Office.
If you have any further questions about the way in which the SPCB processes personal data, or about how to exercise your rights, please contact the Head of Information Governance at:
The Scottish Parliament
Edinburgh
EH99 1SP
Email: [email protected]
Please get in touch if you require information in another language or format