Data Protection Act 2018 compliance
Dear Sir/Madam,
I am writing to make a formal request for information under the provisions of the Freedom of Information Act 2000. I kindly request that you provide me with the following information:
1. A copy of your organisation's Records of Processing Activity (ROPA) as defined in Article 30 of the UK General Data Protection Regulation (UK GDPR).
2. A copy of all legitimate interest assessments conducted by your organisation where you rely on Article 6(1)(f) legitimate interests as your lawful basis for processing.
3. A copy of all privacy impact assessments conducted by your organisation.
4. A copy of all data protection impact assessments conducted by your organisation.
5. A copy of all international transfer risk assessments conducted by your organisation.
6. A recent copy of your organisation's data protection compliance assessment using the Information Commissioner's Office (ICO)'s accountability framework template. If you are using your own standards to monitor compliance with the Data Protection 2018, please provide me with copy of it.
7. A copy of your organization's data protection policy.
8. A copy of your organization's subject access request policy, procedures, and processes, including any guidance material such as folder structure, naming conventions, and redaction guides.
9. A copy of your organisation's privacy notices, including but not limited to employees, customers, ministers, special advisors (SPADs), complaints, NEDS, visitors, and CCTV.
10. A copy of your organisation's due diligence questions for vendor management such as independent data controllers or processors.
I understand that under the Freedom of Information Act, you are required to respond within 20 working days. To stay within section 12 - cost limits, I suggest asking your Data Protection Officer for the information. If this is not possible, I suggest a search of your compliance platform and your Microsoft estate for the following search terms (not case sensetive):
1. "records of processing activity" OR "ropa"
2. "legitimate interest assessment" OR "LIA"
3. "privacy impact assessment" OR "privacy impact assessments" OR "PIA"
4. "data protection impact assessment" OR "DPIA"
5. "transfer risk assessment" AND "personal data"
6. "accountability framework"
I would prefer to receive the requested information in electronic format via email.
Should you require any clarification or further details in order to process this request, please do not hesitate to contact me. I would be grateful if you could confirm receipt of this request and provide a reference number for future correspondence.
Thank you for your attention to this matter. I look forward to receiving the requested information within the statutory timeframe.
Yours faithfully,
Jay Bhanji
Our Reference: 202300362265
Dear Jay Bhanji,
Thank you for your correspondence sent on 16/06/2023. Your query will be
passed to the relevant area for consideration and has been given a
reference number of 202300362265. Please quote this number in all
correspondence. The Scottish Government aim to respond, where necessary,
as quickly as possible and within the stated timescale as indicated on our
website
(http://www.gov.scot/about/contact-inform...).
Yours sincerely
MiCase
Correspondence system for SG and partner agencies
The Scottish Government takes your privacy seriously. You may have written
to us because you have a question or want to make a complaint. Our privacy
notice
(https://beta.gov.scot/publications/conta...),
available on our website, sets out how we use your personal data, and your
rights when communicating with us. It is made under Article 13 of the
General Data Protection Regulation (GDPR).
**********************************************************************
This e-mail (and any files or other attachments transmitted with it) is
intended solely for the attention of the addressee(s). Unauthorised use,
disclosure, storage, copying or distribution of any part of this e-mail is
not permitted. If you are not the intended recipient please destroy the
email, remove any copies from your system and inform the sender
immediately by return.
Communications with the Scottish Government may be monitored or recorded
in order to secure the effective operation of the system and for other
lawful purposes. The views or opinions contained within this e-mail may
not necessarily reflect those of the Scottish Government.
**********************************************************************
Please find attached a response to your correspondence.
**********************************************************************
This e-mail (and any files or other attachments transmitted with it) is
intended solely for the attention of the addressee(s). Unauthorised use,
disclosure, storage, copying or distribution of any part of this e-mail is
not permitted. If you are not the intended recipient please destroy the
email, remove any copies from your system and inform the sender
immediately by return.
Communications with the Scottish Government may be monitored or recorded
in order to secure the effective operation of the system and for other
lawful purposes. The views or opinions contained within this e-mail may
not necessarily reflect those of the Scottish Government.
**********************************************************************
Please find attached a response to your correspondence.
**********************************************************************
This e-mail (and any files or other attachments transmitted with it) is
intended solely for the attention of the addressee(s). Unauthorised use,
disclosure, storage, copying or distribution of any part of this e-mail is
not permitted. If you are not the intended recipient please destroy the
email, remove any copies from your system and inform the sender
immediately by return.
Communications with the Scottish Government may be monitored or recorded
in order to secure the effective operation of the system and for other
lawful purposes. The views or opinions contained within this e-mail may
not necessarily reflect those of the Scottish Government.
**********************************************************************
Please find attached a response to your correspondence.
**********************************************************************
This e-mail (and any files or other attachments transmitted with it) is
intended solely for the attention of the addressee(s). Unauthorised use,
disclosure, storage, copying or distribution of any part of this e-mail is
not permitted. If you are not the intended recipient please destroy the
email, remove any copies from your system and inform the sender
immediately by return.
Communications with the Scottish Government may be monitored or recorded
in order to secure the effective operation of the system and for other
lawful purposes. The views or opinions contained within this e-mail may
not necessarily reflect those of the Scottish Government.
**********************************************************************
Dear Jay,
Please find attached the documents associated with your FOI request dated
15 June, with reference number 202300362265.
Please refer to the response letter issued in a separate email for more
information.
Yours sincerely,
Alan Shaw
Information Assurance and Data Protection Advisor
**********************************************************************
This e-mail (and any files or other attachments transmitted with it) is
intended solely for the attention of the addressee(s). Unauthorised use,
disclosure, storage, copying or distribution of any part of this e-mail is
not permitted. If you are not the intended recipient please destroy the
email, remove any copies from your system and inform the sender
immediately by return.
Communications with the Scottish Government may be monitored or recorded
in order to secure the effective operation of the system and for other
lawful purposes. The views or opinions contained within this e-mail may
not necessarily reflect those of the Scottish Government.
**********************************************************************
We work to defend the right to FOI for everyone
Help us protect your right to hold public authorities to account. Donate and support our work.
Donate Now