Sandeel Fishing Consultation: Data Protection Impact Assessment

4. Data controllers and data processors/sub processors

4.1 Data controllers

Organisation: Scottish Ministers

Activities: Devolved Government

Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?

Yes

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 6 for the collection and sharing of personal data – general processing. Please note relevant legislation if using lawful basis *public task”.

Public task

Link to the Statement of Public Task under the Re-use of Public Sector Information regulations: Public sector information regulations: statement of public task - gov.scot (www.gov.scot)

4.2 Data processors and sub processors

Diffley Partnership

• Data Processor: Processing data – analysis and evaluation of responses generated
• Contract in place compliant with UK GDPR Art 28? Yes

Scottish Government

• Data Controller: Controlling data – informing data subjects of processing, responding to data subjects rights requests, keeping personal data secure, managing breach incidents, maintaining accurate records of data processing activities, ensure compliance with the UK GDPR
• Contract in place compliant with UK GDPR Art 28? N/A