We are the public authority which administers legal aid in Scotland in terms of the Legal Aid (Scotland) Act 1986.
In carrying out these functions we collect, use and retain different types of personal information about you.
We rely on specific provisions under Article 6 and 9 of the General Data Protection Regulation as the lawful basis for processing of data, as a task carried out in the public interest or in the exercise of official authority vested in the controller.
Our lawful basis for processing personal data will also include contractual obligations with service providers and suppliers.
This Privacy notice describes how we collect and use Personal Data, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and any other applicable data protection law in the United Kingdom.
It applies to Personal Data provided to us, by both individuals or by others.
There are several different types of legal aid and the information needed can vary. The information you will be asked to provide is necessary to consider and process your application, and if legal aid is granted to administer any grant of legal aid that is made during the lifetime of the case and in relation to any relevant final or follow-up steps that arise at the end of the case in terms of legal aid regulations and our functions.
The information you will be asked to provide will be about you and your circumstances, such as household, financial and case details, so far as they are relevant to your application, such as:
Your personal information will be used for the purposes of administering Legal Aid and for, communicating the status of Legal Aid applications, where you are named as an opponent.
If you are part of our supply chain, we will process your personal information for the purpose of procuring and consuming goods and services, and to fulfil our contract with you. This may include your personal contact information and information required for you to supply products and services to us.
Your personal information will be used for the purposes of assessing claims from the legal aid fund for the work conducted on behalf of your client, as well as conducting periodic assurance audits on legal aid files to ensure that decisions have been made correctly and accurately, and in producing statistics and information on our processes to enable us to improve our processes and assist in carrying out our functions in terms of the Legal Aid (Scotland) Act 1986.
If you contact us with an enquiry, comment or complaint, we will use the personal information you provide to us to respond and resolve your issue. We may ask you to provide additional personal information if it is necessary for this purpose.
Your personal information will be used to facilitate a visit to SLAB premises and to comply with Health and Safety Legislation and Security requirements.
Some types of personal data are defined as special. We will only collect and use these types of information where we need to and if the law allows us to.
Special categories of personal data include:
We have put in place appropriate security measures to protect your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those people who have a business need to know.
We have put procedures in place to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
In some circumstances we may anonymise or pseudonymise Personal Data so that it can no longer be associated with the Data Subject, in which case we may use it without further notice.
We will share Personal Data with third parties where we are required by law or where we have another lawful basis for doing so.
While we would not normally transfer data outside the EU, in exceptional circumstances where this is the case all personal data will be provided with adequate protection and transferred lawfully. Where we transfer personal data outside the EU to a country not determined by the European Commission as providing an adequate level of protection for personal data, the transfers will be under an agreement which covers the EU requirements for the transfer of personal data outside the EU, such as the European Commission approved standard contractual clauses.
We will also share Personal Data with third-party service providers. For example, we use third parties to provide:
All of our third-party service providers are required to take commercially reasonable and appropriate security measures to protect your personal data. We only permit our third-party service providers to process your personal data for specified purposes and in accordance with our instructions.
We sometimes need to share the personal information we process with other organisations. When this is necessary, we will comply with all aspects of the relevant data protection laws. The organisations we may share your personal information with include:
As part of our statutory function we undertake a range of research work which uses the data we hold. All such work is conducted in accordance with this policy and the data protection legislation
We may contact you for research purposes. Participation in such research is entirely voluntary: you are under no obligation to take part.
We will retain the personal information we hold about you only for as long is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation).
In the case of applications for Legal Aid, the retention period will normally be the lifetime of the case or such other period as is required to complete the administration of the grant of legal aid and its consequences, if any.
Other records, which are not required to be retained as part of our statutory function, will be kept for a period of time depending on:
We continually review our data retention policies, and we reserve the right to amend the retention periods without notice.
It is important that the personal information we hold about you is accurate and up to date. Please keep us informed if your personal information changes.
Under the UK General Data Protection Regulation (UK GDPR) you have the right:
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, request that we transfer a copy of your personal information to another party or request the reconsideration of an automated decision, please contact our Data Protection Officer at DPO@slab.org.uk.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Where you have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact our DPO. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to.
If you are unhappy with the response you get from us, you can ask us to look again at your request; you can write to our Data Protection Officer at SAR@slab.org.uk or using our postal address. At any time, you are entitled to ask the Information Commissioner to review our decision or to go to court to enforce your rights.
We keep this privacy notice under regular review. This privacy notice was last updated on 17/12/2021.
Data Protection Officer
Scottish Legal Aid Board
91 Haymarket Terrace
0131 226 7061
You can find information about how to report a concern to the Information Commissioner on their website, as well as call or write to them:
Alternatively, you can contact the Scottish Regional Office for the ICO Information Commissioner’s Office:
This document provides information about how we process data relating to our current and former employees or relevant dependants, workers and agency contractors and “staff” in the wider sense to include Board Members and those on work experience placements.