We use cookies to collect anonymous data to help us improve your site browsing experience.

Click 'Accept all cookies' to agree to all cookies that collect anonymous data. To only allow the cookies that make the site work, click 'Use essential cookies only.' Visit 'Set cookie preferences' to control specific cookies.

Set cookie preferences

Your cookie preferences have been saved. You can change your cookie settings at any time.

Publication - Impact assessment

Data Protection Impact Assessment (DPIA)

Published
7 Aug 2025

3. Description of the project and personal data

Introduction

The National Social Work Agency (NSWA) will lead excellence in social work, and will work in partnership with the social work profession, people with lived experience and partners to strengthen practice, elevate the profession and drive positive change. It will advise Scottish Ministers, drive national coordination of policy affecting social work and have oversight of national workforce planning, social work education and learning, and improvement priorities and national implementation support. The NSWA will support the statutory role of the National Chief Social Work Adviser (NCSWA) to provide professional advice to Scottish Ministers.

Ownership and governance

The NSWA operates with operational independence in delivering its functions but forms part of the Scottish Government’s executive agency structure. It is therefore operationally independent, strategically accountable to Scottish Ministers, and legally part of the Scottish Government, which acts as the parent body and sole data controller.

It will be governed through a formal framework document aligned with the Scottish Public Finance Manual (SPFM). Planning and delivery of the business of the NSWA will initially be structured around an interim one-year corporate plan, followed by multi-year corporate plans and annual business plans. These will be reviewed regularly and reported to Scottish Ministers, partners, the workforce and the public.

The NSWA is a partner of the Scottish Social Work Partnership (SSWP), a collaborative consensus-based partnership led by COSLA, the Scottish Government and Social Work Scotland that enables collaboration between national and local partners to ensure joined-up delivery and shared leadership across the sector. The Scottish Government, through the NSWA, is the sole data controller for all personal data processed under the SSWP initiative where processing is undertaken on behalf of the Scottish Government.

Privacy information is provided to individuals via the National Social Work Agency Privacy Notice, available from: communications@socialwork.gov.scot

Data processing and sharing

To fulfil its functions, the NSWA will collect, process and share personal data for purposes, including:

  • communications and engagement
  • workforce planning and analysis
  • professional development and education
  • evaluation and reporting on the state of social work services and workforce

At the current stage of establishment, the NSWA processes personal data only where necessary to support:

  • programme and organisational set up
  • engagement with partners and stakeholders
  • internal planning and governance activity

Data will be shared with and received from:

  • COSLA and Social Work Scotland – as part of the work of the SSWP
  • Scottish Social Services Council (SSSC) – for workforce registration and regulatory data
  • Care Inspectorate – for inspection and regulation data
  • IRISS and Centre for Excellence for Children's Care and Protection (CELCIS) – where commissioned to undertake specific pieces of work or research
  • Scottish Association of Social Work (SASW) – for engagement and development work for social work and/or with social workers

Any future personal data sharing between the NSWA and other organisations will be governed by formal data sharing agreements or memoranda of understanding, with roles as data controllers or processors clearly defined. Where personal data is shared between the NSWA and other organisations (e.g., COSLA, Social Work Scotland, SSSC, Care Inspectorate), those organisations act as independent data controllers, not processors.

Justification and business need

The National Social Work Agency will lead excellence in social work, and will work in partnership with the social work profession, people with lived experience and partners to strengthen practice, elevate the profession and drive positive change. It will advise Scottish Ministers, drive national coordination of policy affecting social work and have oversight of national workforce planning, social work education and learning, and improvement priorities and national implementation support.

It responds to increasing demand, complexity and fragmentation in the sector. The benefits of the NSWA include:

  • improved recruitment, retention and wellbeing of the social work workforce
  • enhanced quality and consistency of education and practice
  • greater public confidence and understanding of social work
  • more effective national workforce planning and policy implementation
  • stronger collaboration and innovation across the sector

These benefits are balanced against potential risks to data subjects, with mitigation measures in place to ensure compliance with UK GDPR and the Data Protection Act 2018.

Personal data to be processed

The National Social Work Agency (NSWA) will process several types of personal data as part of its establishment and ongoing functions. The following describes each category of data, its source, the individuals it relates to, and their relationship with the Scottish Government as data controller.

Name and contact details

These are collected directly from individuals or through workforce records. This data relates to thousands of people, including social workers, students, partners and service users. Their relationship to the controller includes roles such as employees, partners or service users.

Professional role, job title and organisation

This information is obtained from workforce records, surveys and the Scottish Social Services Council (SSSC). It covers thousands of social workers and students who interact with the controller as employees or registrants.

Correspondence, feedback and complaints

Personal data provided through correspondence, feedback or complaints is collected directly from individuals. The number of data subjects varies and includes social workers, students and service users who engage with the NSWA as correspondents or service users.

Inspection and regulation data

Inspection and regulation information is supplied by the Care Inspectorate. The volume of data subjects varies and relates to social work services and providers, who are regulated entities in relation to the controller.

Special category data (e.g. ethnicity, health information)

Where relevant, this data is sourced from workforce records and equalities monitoring processes. It relates to social workers and students who are employees of organisations contributing data. The number of data subjects varies depending on the context.

Research and improvement data

Data gathered through commissioned work carried out by IRISS and CELCIS relates to social workers, students and service users who participate as contributors or participants. The number of data subjects varies based on the research undertaken.

How this data will be processed

How will it be gathered?

Personal data will be gathered through:

  • direct engagement with individuals (e.g. surveys, mailing list sign-ups, correspondence)
  • anonymised workforce records and registration data from partner organisations such as SSSC, COSLA
  • inspection and regulatory data from the Care Inspectorate
  • commissioned research and improvement work from organisations such as IRISS and CELCIS
  • feedback, complaints, and queries submitted to the NSWA

Who will have access?

Access to personal data will be restricted to:

  • authorised staff within the NSWA
  • designated personnel in COSLA and Social Work Scotland (under the Scottish Social Work Partnership)
  • approved contractors or commissioned partners (e.g. IRISS, CELCIS) where necessary for specific projects

All access will be governed by role-based permissions, confidentiality agreements and data sharing protocols.

How will it be transmitted and how frequently?

Data will be transmitted:

  • securely via Office 365 email, secure file transfer platforms (e.g. Objective Connect), or eRDM Connect or approved file transfer services (e.g. WeTransfer) for the secure transfer of large files such as photos, videos and documents
  • on a periodic basis (e.g. quarterly or annually) for routine workforce planning and reporting
  • on an ad hoc basis for specific projects or evaluation activities

All transfers will be documented and subject to access controls.

How will it be stored, and disposed of when no longer needed?

Data will be stored:

  • electronically on secure Scottish Government systems with appropriate encryption and access controls
  • in line with the Scottish Government’s Data Handling Policy and retention schedules

Data will be disposed of:

  • after a standard retention period of three years unless otherwise required by law or project-specific agreements
  • using secure deletion methods that ensure all copies (including backups) are destroyed

The NSWA, as an executive agency of the Scottish Government, is expected to fall within the scope of the Public Records (Scotland) Act 2011 and will therefore be required to develop and maintain its own Records Management Plan for submission to the Keeper of the Records of Scotland.

Who will own and manage the data?

The Scottish Government (via the NSWA) is the sole data controller and owner of all personal data processed under this initiative. COSLA, Social Work Scotland and commissioned organisations (e.g., IRISS, CELCIS) will act as data processors under Article 28-compliant contracts or as data sharing partners. Where organisations receive personal data for their own purposes, they act as independent data controllers, not processors. They determine their own purposes and means for the data they receive. No third party processing of personal data will begin until Article 28 compliant contracts are signed with each processor.

How will the data be checked for accuracy and kept up to date?

  • data collected directly from individuals will be verified at the point of collection
  • anonymised workforce data from SSSC and other partners will be subject to regular updates and reconciliation
  • feedback and correspondence will be reviewed and updated as necessary
  • privacy notices will inform individuals of their rights to rectification and erasure

The Scottish Government (via NSWA), as the sole data controller, will ensure that privacy notices are issued at the point of data collection and updated as necessary. Privacy notices must include the purpose of processing, lawful basis, data subject rights, and contact details for the Data Protection Officer (DPO).

Source of the personal data

  • collected directly from data subjects (e.g. social workers, students, service users)
  • received from partner organisations acting as data processors or data sharing partners (e.g. SSSC, Care Inspectorate, COSLA, Social Work Scotland)

At this stage, personal data is primarily collected directly from individuals through engagement and correspondence activity.

Lawful bases are compatible with NSWA’s public task and statutory functions under Section 25(1)(b) of the Care Reform (Scotland) Act 2025

Number of data subjects

Currently limited to a small and identifiable cohort of named contacts and stakeholders involved in NSWA establishment activity. Numbers are expected to increase as functions develop and will be reviewed accordingly.

At the point of establishment, personal data processed by the NSWA is limited in scope, volume and sensitivity. The NSWA is not currently undertaking large‑scale workforce data processing, routine receipt of regulatory datasets, or systematic processing of service‑user information.

Any future expansion of processing – including workforce datasets, regulatory data, research activity or data sharing at scale – will be subject to review of this DPIA and, where required, the completion of supplementary DPIAs, updated privacy notices and formal data sharing agreements before processing begins.

Categories of data subjects

  • social work professionals, assistants and students and local authority occupational therapists who work in social work teams
  • contributors to research and improvement activities
  • individuals submitting queries, feedback, or complaints

The purpose(s) of the processing

The purpose of processing personal data within the National Social Work Agency (NSWA) is to support the statutory functions of the National Chief Social Work Adviser (NCSWA), as established by Section 25(1)(b) of the Care Reform (Scotland) Act 2025. The NCSWA’s statutory role is to provide professional advice to Scottish Ministers and to support the delivery, improvement, and oversight of social work services across Scotland, working in partnership with the NSWA to improve standards and support social workers.

Personal data is processed to:

  • enable effective national workforce planning, professional development and service improvement for the social work profession in Scotland
  • enable the NCSWA to advise on social work services, practice, and policy for children and adults
  • oversee and support professional education and development
  • facilitate strategic communications and engagement with stakeholders, including seeking feedback and input from the workforce, people with lived experience, and the wider public
  • monitor, evaluate, and report on the state of social work services and workforce
  • respond to queries, feedback, and complaints

All processing is carried out under the lawful basis of Article 6(1)(e) – Public Task and, where applicable, Article 9(2)(g) – Substantial Public Interest, and is limited to what is necessary and proportionate to support the NSWA’s statutory functions at each stage of its development.

During the establishment phase, processing is primarily limited to engagement, planning, communication and governance activity. As the NSWA’s functions develop, any new or expanded processing will be assessed to ensure it remains compatible with the stated purposes and lawful bases, with additional safeguards and DPIAs implemented where required.

Back to top