Data Protection

Published 01/01/2017.  Last updated 26/10/2023

​Education Scotland and GDPR: Our Commitment to Data Privacy

Education Scotland (ES) is an Executive Agency of the Scottish Government. Scottish Ministers are the Data Controller for personal information and are included as Data Controller under the Scottish Minsters notification to the Information Commissioners Office reference Z4857137.

Education Scotland is committed to ensuring all personal information is collected and processed in accordance with data protection law which requires information to be:

  • processed fairly, lawfully and transparently
  • collected for specified, explicit and legitimate purposes
  • adequate, relevant and limited to what is necessary for the purpose of processing
  • accurate and kept up to date
  • kept in a form which permits identification for no longer than necessary
  • processed in a manner that ensures appropriate security

Privacy Policy

The Education Scotland privacy policy (PDF) provides more information about how Education Scotland complies with data protection law.​

How to request personal data

Education Scotland do not hold any individual school or teaching records or data relating to individual’s qualifications. You should submit subject access requests to the relevant organisations direct.

Subject access requests

You can request a copy of any personal data we hold about you by making a subject access request (SAR) under the General Data Protection Regulation, in the following ways:

You should also provide proof of identity by submitting one of the following acceptable forms of ID:

  • copy or scan of the photograph page of your passport or
  • a copy or scan of your photo-card driving licence or
  • a copy or scan of at least two utility bills/bank statements from the last six months detailing your name and current address

Please note that the completion of a subject access request form is not compulsory but it is likely to make the process easier.

What happens next

We will acknowledge your request in writing, or verbally if you prefer, and provide you with a reference number for your application. Once we are satisfied that you meet the criteria for disclosure of data under data protection law, and you have provided sufficient information, you should receive a response within one calendar month from the date that we accept your application for processing. To ensure that we are able to conduct adequate searches please ensure you tell us of all names we may hold any information about you under.

^ Back to top

Data Protection

Published 01/01/2017.  Last updated 26/10/2023

​Education Scotland and GDPR: Our Commitment to Data Privacy

Education Scotland (ES) is an Executive Agency of the Scottish Government. Scottish Ministers are the Data Controller for personal information and are included as Data Controller under the Scottish Minsters notification to the Information Commissioners Office reference Z4857137.

Education Scotland is committed to ensuring all personal information is collected and processed in accordance with data protection law which requires information to be:

  • processed fairly, lawfully and transparently
  • collected for specified, explicit and legitimate purposes
  • adequate, relevant and limited to what is necessary for the purpose of processing
  • accurate and kept up to date
  • kept in a form which permits identification for no longer than necessary
  • processed in a manner that ensures appropriate security

Privacy Policy

The Education Scotland privacy policy (PDF) provides more information about how Education Scotland complies with data protection law.​

How to request personal data

Education Scotland do not hold any individual school or teaching records or data relating to individual’s qualifications. You should submit subject access requests to the relevant organisations direct.

Subject access requests

You can request a copy of any personal data we hold about you by making a subject access request (SAR) under the General Data Protection Regulation, in the following ways:

You should also provide proof of identity by submitting one of the following acceptable forms of ID:

  • copy or scan of the photograph page of your passport or
  • a copy or scan of your photo-card driving licence or
  • a copy or scan of at least two utility bills/bank statements from the last six months detailing your name and current address

Please note that the completion of a subject access request form is not compulsory but it is likely to make the process easier.

What happens next

We will acknowledge your request in writing, or verbally if you prefer, and provide you with a reference number for your application. Once we are satisfied that you meet the criteria for disclosure of data under data protection law, and you have provided sufficient information, you should receive a response within one calendar month from the date that we accept your application for processing. To ensure that we are able to conduct adequate searches please ensure you tell us of all names we may hold any information about you under.

^ Back to top