4. Data controllers and data processors/sub processors
Data controller
The Scottish Government, acting through the National Social Work Agency (NSWA), is the sole data controller for all personal data processed under this initiative.
For specific SSWP activities where COSLA or Social Work Scotland jointly determine the purposes and means of processing with the Scottish Government, they may act as joint controllers. In these circumstances, a transparent joint controller arrangement under Article 26 of the UK GDPR will be put in place. This will clearly set out responsibilities for transparency, privacy notices and the handling of data subject rights.
Controller details
The data controller for this DPIA is:
- Organisation: Scottish Ministers, via the National Social Work Agency
- Role and activities: Devolved government responsibilities, including statutory oversight and delivery of NSWA functions
- Status under data protection law: A public authority as defined in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018
Lawful basis for processing
Personal data is processed under the following lawful bases:
- General personal data is processed under Article 6(1)(e) of the UK GDPR (public task), as processing is necessary for the performance of tasks carried out in the public interest or in the exercise of official authority
- Special category personal data, where processed, is processed under Article 9(2)(g) (substantial public interest)
- The relevant condition under the Data Protection Act 2018 is Schedule 1, Part 2, Paragraph 6 – Statutory and Government Purposes
- No law enforcement processing under Part 3 of the Data Protection Act 2018 is undertaken
Legal gateway for data sharing
The legal gateway for any sharing of personal data between organisations is Section 25(1)(b) of the Care Reform (Scotland) Act 2025.
Data processors and partner organisations
At the establishment stage, partner organisations do not process personal data on behalf of the NSWA. Where information is shared, it is anonymised and does not constitute personal data processing.
The following organisations currently provide anonymised data or work with the NSWA in ways that do not involve personal data processing:
Social Work Scotland (SWS)
Provides anonymised social work related data only. Any activity involving personal data would require a separate DPIA
Scottish Social Services Council (SSSC)
Provides anonymised social work related data only. Any processing of personal data would be subject to a separate DPIA
IRISS
Provides anonymised data for research and improvement activity. Any request involving personal data would require a DPIA
COSLA
Future activity may include resourcing or workforce related data. The scope of any such activity will be agreed through a Memorandum of Understanding and will require review and update of this DPIA before any personal data is processed
Scottish Association of Social Work (SASW)
Provides anonymised social work related data. Any processing of personal data would require a DPIA and a formal data sharing or processing agreement
At present, no Article 28 compliant data processing contracts are required, as no personal data is processed by these organisations on behalf of the NSWA.
Future processing arrangements
Where future activity involves third party processing of personal data on behalf of the NSWA:
- Article 28 compliant contracts will be put in place before processing begins
- The DPIA will be reviewed and updated to reflect any new or expanded processing
- Privacy notices and data sharing arrangements will be updated as required