Skip to site content Skip to main menu

Data Protection Principles

Request for Information

The Data Protection legislation covers the whole of the United Kingdom and works in two ways. Firstly, it gives you certain rights as an individual.  And secondly, organisations that record and use personal data must be open about how the information is used and must follow the six principles of the legislation.

SPA Information Security Policy 


Data Protection Principles

The Data Protection legislation requires all organisations in the UK that process personal data to comply with six principles regarding privacy and disclosure.  The legislation states that data must be:

  • Processed lawfully, fairly and in a transparent manner
  • Collected for specified, explicit and legitimate purpose and not further processed in a manner incompatible with the purpose
  • Adequate, relevant and limited to what is necessary in relation to the purpose
  • Accurate and up-to-date 
  • Not kept longer than necessary 
  • Processed in a manner that ensures appropriate security.

SPA Data Protection Policy


Requesting Information from Scottish Police Authority

The legislation allows you to request a copy of your own personal data. In addition, SPA must also provide you with the following information:

  • the purposes of our processing
  • the categories of personal data concerned
  • the recipients or categories of recipient we disclose the personal data to
  • our retention period for storing the personal data or, where this is not possible, our criteria for determining how long we will store it
  • the existence of your right to request rectification, erasure or restriction or to object to such processing
  • the right to lodge a complaint with the ICO or another supervisory authority
  • information about the source of the data, where it was not obtained directly from the individual
  • the existence of automated decision-making (including profiling)
  • the safeguards we provide if you transfer personal data to a third country or international organisation.

To request information from us please provide your request in writing to:

Information Management
Scottish Police Authority
1 Pacific Quay
G51 1DZ

We will require copies of two identification documents, such us driving licence, passport, current utility bill.

You may find it easier to complete a Subject Access Request form, however, this is not a requirement.

You should be aware that SPA does not process information in respect of Criminal Convictions.

Once we have received your request and appropriate identification, we will deal with it as soon as possible, but we have a maximum of one month to process your request (unless it is particularly complex in which case we may extend it by a further two months).


Enforcement of the Data Protection Legislation

The legislation is enforced by the Information Commissioner.  If you are unhappy in any way with how we have dealt with your request, you can contact the Commissioner at:

The Office of the Information Commissioner
Wycliffe House

Tel: (01625) 545700