Access to personal information
You have a right to access personal information that we hold about you by making a ‘subject access request’. A subject access request form for this purpose can be downloaded here (DOC 79Kb), completed and returned using the postal or email address on the form, or alternatively you can write to the Corporate Governance Manager at:
Audit Scotland
4th Floor
102 West Port
Edinburgh
EH3 9DN
Audit Scotland takes data protection very seriously and therefore requires confirmation of your identity before releasing personal information. The following evidence will be required to confirm your identity:
- an original or copy of your driving licence, passport or government issued national ID card or photo pass, and
- a recent utility bill with your name and postal address on it.
If someone is submitting a subject access request on your behalf we will also require a letter from you authorising the submission and release of information.
If we do hold information about you we will tell you:
- about the purpose of the processing and our legal basis for it
- about the categories of personal information concerned
- who the recipients or categories of recipient to whom the personal information has been or will be disclosed, in particular recipients in third countries or international organisations
- where possible, the envisaged period for which the personal information will be stored, or, if not possible, the criteria used to determine that period
- about the existence of the right to request from us rectification or erasure of personal information or the restriction of processing of personal information concerning you or to object to such processing
- about your right to lodge a complaint with a supervisory authority (UK Information Commissioner)
- where the personal information was not collected from you by us, any available information as to its source
- of the existence of automated decision-making, including profiling and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing on them
- when personal information has been transferred to a third country or to an international organisation, what safeguards have been taken relating to the transfer.