Data Protection Compliance 2024-25
Perth and Kinross Council · 17 September 2025
Back to Scrutiny and Performance Committee — 17 September 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Our vision is a Perth and Kinross where everyone can live life well, free from poverty and inequality ___________________________________________________________________ Committee or Board: Scrutiny and Performance Date of Meeting: 17 September 2025 Report Title: Data Protection Compliance 2024-25 Report Number: 25/232 Report Author: Jillian Walker - Data Protection Officer Organisational Lead: Strategic Lead – Legal and Governance ___________________________________________________________________ 1. Purpose 1.1 The purpose of this Report is to provide members of the Committee with the Data Protection Officer’s professional assessment of the Council’s compliance with the UK General Data Protection Regulation during the year 2024-25. 1.2 Sections 1. Purpose 2. Recommendation(s) 3. Background/Context 4. Main Issues 5. Proposals 6. Conclusion 7. Impact Value Assessment 8. Appendices 2. Recommendation(s) It is recommended that the Committee: 2.1 Notes the Data Protection Officer’s assessment of the Council’s compliance with the requirements of data protection legislation. 2.2 Considers the Council’s performance in terms of its compliance with the UK General Data Protection Regulation and provides constructive scrutiny and comment.
Page 2
2.3 Notes that the Data Protection Officer is confident that an acceptable degree of compliance with data protection law was achieved during 2024-25 and that this will continue during 2025-26. 3. Background 3.1 The UK General Data Protection Regulation (“GDPR”) requires the Council, as a public authority, to appoint a Data Protection Officer (“DPO”) and defines tasks that the person must undertake. These tasks include monitoring and reporting on compliance with the GDPR. The Council’s Data Protection Policy sets out that the DPO will present a report on the Council’s data protection compliance to the Scrutiny and Performance Committee annually or more frequently, if considered necessary. It is the role of the Scrutiny and Performance Committee to consider the DPO’s report in relation to the Council’s compliance and to provide appropriate constructive comment. 3.2 The role of the DPO is defined in the GDPR; the legislation places restrictions on both the DPO and the Council in terms of roles and responsibilities. The DPO, like the other Statutory Officers within the Council, has an independent and autonomous role and the Council cannot instruct the DPO how to undertake the role. It should be noted that legal responsibility for compliance with data protection law lies with the Council as a public body and not the DPO as an individual. The DPO does have a role in providing advice and guidance to support the Council in complying with the legislation and to monitor and report on its performance. Formal advice provided by the DPO, to support the organisation and ensure compliance, is generally accepted. 3.3 The DPO and the Information Rights Team sit within the wider Audit and Governance Team, with the DPO maintaining a separate and distinct reporting line to the Strategic Lead for Legal and Governance Services, who is also the SIRO (Senior Information Risk Owner) for the Council. 3.4 The legislation also provides that adequate resources should be made available to the DPO to enable them to fulfil their role. 3.5 The DPO function does not have a dedicated team but is supported by members of the Information Rights and Information Security teams (referred to as the DPO’s team for the purposes of this report). In terms of skills and expertise, as well as the DPO, there are 3 officers (2.9 FTE) within the Information Rights team who have specialised data protection knowledge. These officers also carry out work relating to the Council’s obligations under freedom of information legislation. Additional support is also provided by a solicitor from within the Council’s Legal service. 3.6 Rapidly increasing volumes of complex, time-sensitive responsive work means that almost all staff time is dedicated to this, with very limited time available for planned, proactive work or staff training.
Page 3
3.7 There is a requirement for the DPO’s team to advise on the compliance with data protection law of the Council’s use of new technologies which use Artificial Intelligence (AI). This is a swiftly developing and complex area of work which is placing an increasing demand on resources within the DPO’s team. 4. Performance: Data Breaches 4.1 A data breach is defined as an incident involving “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data”. The term ‘security’ refers to both technical measures and organisational measures such as policy, procedures and practice. 4.2 The Council is required to maintain a register of data breaches and, where appropriate, report them to the Information Commissioner’s office. 4.3 During 2024-25, the Council recorded 138 data breaches, which was a reduction of 18% on the 168 breaches recorded during 2023-24. The number of breaches recorded during 2024-25 is similar to the number recorded during 2020-21 and 21-22, as illustrated in Figure 1. Figure 1 4.4 All data breaches which are reported to the DPO are taken seriously, and an assessment of the circumstances made, before appropriate advice about communication with the data subject(s) and avoidance of future breaches is provided to the team responsible, in a constructive and supportive way. Further guidance and training is provided if required. 0 20 40 60 80 100 120 140 160 180 2020/21 2021/22 2022/23 2023/24 2024/25 Number of recorded breaches
Page 4
4.5 Data breaches recorded during 2024-25 have been categorised as illustrated in Figure 2, below: Figure 2 4.6 A further analysis of breaches which have been categorised as unauthorised disclosures has shown that the largest number relates to email errors (excluding group emails being sent CC, not BCC). Please see Figure 3 below for a breakdown of breaches in this category. As with all data breaches, advice was provided to the teams responsible about contacting and supporting data subjects who have been affected. Figure 3 0 20 40 60 80 100 120 140 Unauthorised disclosure Email error (CC not BCC) Unauthorised access Loss of access (temporary) Number of breaches 0 10 20 30 40 50 60 70 Number of breaches
Page 5
4.7 The number of data breaches which were reported during 2024-25 needs to be considered in terms of the many millions of interactions involving personal information which Council employees carried out over the course of the year. 4.8 During 2024-25, the DPO determined that 6 of the 138 breaches required to be reported to the Information Commissioner’s Office (ICO), following a risk- based assessment of the circumstances and the potential impact on data subjects. 4.9 The ICO has not required the Council to take any further action in relation to the 6 breaches reported to it. 4.10 During 2024-25, the DPO began providing monthly reports on data breaches to Strategic Leads and their representatives through the Council’s Policy and Governance Group, to increase awareness of recurring or avoidable issues. 4.11 Breaches will continue to be recorded, with their causes being monitored in order that appropriate advice and training can be provided. 5 Performance: Data Subject Requests 5.1 The GDPR gives data subjects a number of specific rights, such as accessing and receiving a copy of information held about them, and having inaccurate personal data rectified. Requests to exercise these rights must be responded to within 1 month, unless the information requested is particularly complex in nature or the request is from an individual who has made multiple requests; in these cases, an additional two months to respond is permitted by the legislation. The DPO has responsibility for dealing with requests received by the Council. 5.2 During 2024-25, there was a 17% increase in the number of subject access requests (SARs) being made, with 269 being received by the Council (compared to 229 during 2023-24). Forty five requests are currently on hold pending further information, or confirmation that they wish to proceed, from the requestor. During 2024-25, there was an 11% increase in the number of SARs which were responded to (224) when compared to 2023-24 (202). This is illustrated in Figure 4 below. Year SARs received Valid SARs SARs on hold SARs responded to Responded to on time Closure compliance 24-25 269 224 45 224 211 95% 23-24 229 202 27 202 194 96% Figure 4 5.3 It should be noted that the recorded increase in the number of requests received does not reflect the volume of work undertaken in relation to SARs during 2024-25.
Page 6
An examination over a three-month period (October -December) of the number of individual pages within records prepared for release by the DPO’s team in 2024-25 when compared to 23-24 shows that the volume of information which has required preparation for release increased by 53%. January- March 2025 demonstrated an increase of almost 330% in the number of pages requiring processing in comparison with the same period in 2024. 5.4 The increase in the number of SARs received is partly attributable to people seeking confirmation of their care experience, in order to apply to Scotland’s Redress Scheme for survivors of historical child abuse in care. As with other requests for social work records held by the Council, records processed in relation to this scheme may contain a very large volume of complex and highly sensitive information, which requires extensive preparation before release. 5.5 The rate of compliance with statutory timescales is considered to be very high, particularly as it has been achieved against a background of an increase in the number of requests for information made, and in the size and complexity of records which have been processed. It should be noted that in almost all cases, the delay in complying with permitted timescales was due to difficulties experienced in obtaining information from providers in other areas of the organisation. 5.6 The Council is sometimes unable to provide information requested by survivors of historical child abuse in care, usually because the person in question was placed in an institution not run by local government. Recognising the distress that this may cause applicants, the DPO’s team undertakes research to help identify the location of records and works with other parties to ensure as comprehensive a response as possible can be provided to the requestor. 5.7 Where information held about requestors may cause distress, the Information Rights team provides advance warning of this before issuing their response. Individuals are appropriately signposted to organisations that can provide them with support going through their records. The Information Rights team is continuing to seek ways of providing as much assistance and information as possible to requestors. 5.8 In addition to subject access requests, the DPOs team also processed 25 Verification Requests from Redress Scotland, to enable payments to affected individuals to receive payments and 2 requests for copies of adoption records (these requests were previously dealt with by social workers). 5.9 During 2024-25, the DPO’s team also processed 74 requests for information made under a provision in data protection legislation which permits authorities, such as Police and HMRC, to request personal information to assist with criminal investigations and the assessment and collection of taxes. This is a 45% increase on the number of similar requests made during 2023- 24, when 51 requests were received.
Page 7
5.10 During 2024-25, the Council received 12 further data subject requests: • 6 requests for rectification (individuals can request that what they consider to be inaccurate personal data is corrected) • 3 requests for erasure rectification (individuals have the right to request their personal data is deleted, although this is only applicable in certain limited circumstances) • 3 objections to processing All 12 requests were responded to appropriately, with requestors being referred to the ICO if they were dissatisfied with the Council’s response. 5.11 In addition, during 2024-25, the Council also received 28 complaints in relation to how the Council had processed their personal information. All complaints have been responded to appropriately. 5.12 The DPO is satisfied that data subject requests are being handled well, with a high rate of compliance with statutory timescales, against a background of rising demand and fixed staffing resources. 6. Surveillance & Interception of Communications 6.1 The Council has powers under the Regulation of Investigatory Powers (Scotland) Act to undertake directed surveillance and to utilise covert human intelligence sources. The Council also has powers under the Regulation of Investigatory Powers Act to obtain information (‘intercept’) about electronic communications. 6.2 Council officers have a duty to report on the use of these powers to Elected Members. 6.3 During 2024/25, no directed surveillance was authorised, no covert human intelligence sources were used, and no electronic communications information was obtained. 6.4 The Council’s policy statement on the use of directed surveillance and the intercept of communications is attached as Appendix 1. 7. Training 7.1 During 2024-25, targeted reminders about the importance of data protection have been communicated to staff using Managers’ Weekly Briefings and the Council’s intranet site. 7.2 The DPO’s team has delivered targeted training sessions and worked closely with colleagues in Information Security in raising awareness the use of products which employ AI.
Page 8
7.3 Support, and advice is provided to councillors on an ongoing basis, as required. 7.4 A continuing increase in the work of the DPO’s team means that it is not possible to provide more systematic training at present. However, online training is available to all staff, and targeted training is delivered when requested by Strategic Areas. 7.5 The DPO is encouraged by the willingness of staff from all areas of the organisation to seek help and support when required and by the increasing awareness of the importance of data protection. 8. Data Protection Policy and Process 8.1 The DPO is satisfied that the Council has a Data Protection Policy which complies with the requirements of the UK GDPR and the Data Protection Act 2018. 8.2 It is a statutory requirement that the Council be able to always provide evidence of its compliance with the legislation. Compliance is therefore documented and evidenced by the Council’s use of: - • Data Protection Impact Assessments (DPIAs) • Data Processing Agreements • Privacy Notices • Data Sharing Agreements (DSAs) 8.3 It is the responsibility of the Council to carry out DPIAs and ensure Data Processing Agreements and Privacy Notices are in place. The role of the DPO is to assist and advise in their creation and to maintain registers of the documentation. 8 The DPO is satisfied that there is some form of privacy notice in place in relation to all processing of personal information carried out by the Council. Processing may be covered by the General Privacy Notice which appears on the Council website, or by more specific short or detailed privacy notices. The DPO continues to monitor, review and provide advice to services as required. Privacy notices are required where we collect personal data. 8.5 Where personal information requires to be shared with other parties (e.g., Police, Health etc) best practice requires that Data Sharing Agreements should be put in place. These are specialised documents which tend to be lengthy and time-consuming pieces of work, often needing extensive consultation with the other organisations involved. The DPO is satisfied that appropriate Data Sharing Agreements are generally in place. 8.6 The Data Use and Access Act, which amends but does not replace existing data protection legislation, became law in June 2025. Relevant changes, which it is not considered will have an extensive impact on the Council’s work, will be phased in over 2025-26.
Page 9
8.7 Advances in the capabilities and potential use within the Council of AI places significant requirements on the organisation in terms of its obligations under data protection legislation. The DPO recognises the importance of providing the authority with advice that enables it to comply with these obligations. The DPO’s team forms part of the Council’s AI Governance Group and works closely with colleagues in Information Technology and Information Security to ensure compliance with legislation and the Council’s AI Policy. 8.8 During 2024-25, work on updating, simplifying and expanding an internal Data Protection Impact Assessment Checklist form was completed; increased use of this form is intended to reduce the time spent by services on completing lengthy and complex full Data Protection Impact Assessments when it is not a statutory or organisational requirement for this to be done. 9. Improvement Actions 9.1 During 2025-26 The DPO’s team will update existing policies and guidance to ensure compliance with new requirements placed on the Council by legislation, including formalising and publicising the existing procedure for data protection complaints. 9.2 Work on migrating all parts of Data Protection Impact Assessment process to an online portal will continue, streamlining and improving this process. 10. Conclusion 10.1 The DPO considers that the Council is continuing to achieve a reasonable degree of compliance with data protection legislation and considers that there is an improving awareness of its importance across the organisation 10.2 All data breaches the DPO is notified of are taken seriously, and support to prevent repetitions is provided. However, the size and complexity of the Council means that each year it processes an enormous amount of personal information in millions of interactions; the number of reported breaches therefore remains low. 10.3 The Council’s growing use of Artificial Intelligence products will continue increasing substantially the work of the DPO and her team, as she is obliged to inform and advise the Council on its obligations to comply with data protection law while using complex and constantly evolving new technologies. 10.4 The continuing growth in the number of subject access and associated requests for information has impacted on the workload of the DPO’s team, limiting its capacity to undertake other work or training. The DPO is pleased to note that senior leadership has agreed the necessity of a temporary additional administrative resource to help address this issue, and recruitment is now underway.
Page 10
11. Impact Value Assessment This report has been classified as being an operational report and as such does not require a full Impact and Value Assessment. 12. Appendices 12.1 Appendix 1 - The Regulation of Investigatory Powers (Scotland) Act 2000