Report Summary
Issued 15 July 2025, this FOI response provides information and correspondence in relation to non-UK data processing, explains why some of the information is exempt from disclosure, and confirms that some of the requested information is not held by the Scottish Police Authority.
To access the full document please open the PDF document above.
To view as accessible content please use the sections below. (Note that some tables and appendixes are not available as accessible content).
Response
The Scottish Police Authority has considered your request under the Freedom of Information (Scotland) Act (FOISA).
In terms of parts one and two of your request, the Authority does not hold information.
By means of explanation, a decision was taken in Quarter one of 2024-25 that the Authority would not have a tenant in DESC. As such the Data Protection Impact Assessment (DPIA) was retired and has not changed since previously disclosed.
We can also confirm that there has been no further communications between the Authority and Axon or Microsoft in respect of DESC.
In terms of part three of your request, the Authority can confirm that information is held. Communications with the Information Commissioner in terms of S65 of the Data Protection Act 2018 are attached as is the abridged M365 Data Protection Impact Assessment (DPIA), as sent to ICO, and the full DPIA. Please note that this is the DPIA at the time of your request. Given that the Data Use and Access Bill referred to in the DPIA has now been passed and received royal assent, the DPIA will be subject to review.
In terms of part four of your request, the Authority’s Information Management Lead has been involved in formulating questions for Microsoft regarding M365. This correspondence is attached.
Some information has been redacted from correspondence and the DPIAs where this is third-party personal data. This exemption is absolute and does not require application of the public interest test. While you may have a legitimate interest in disclosure of this information, it is our view that those interests are overridden by the interests or fundamental rights and freedoms of the data subjects.
