Police Act Part V

There are legal obligations on organisations to manage appropriately personal and sensitive data about individuals (this includes, for example, information given in Disclosure certificates and written reports (references) to Scottish Ministers) and the obligations on organisations to balance an individual’s right to confidentiality with the right of a child or young person to care and protection.

The Code of Practice and Explanatory Guide of the Code of Practice For Registered Persons and other Recipients of Disclosure Information (published by Scottish Minister), gives full details of the requirements for storing and sharing Disclosure information.

Failure to comply with the requirements set out in the Code of Practice and Explanatory Notes could result in de-registration with CRBS and in some cases referral to the Procurator Fiscal or the Data Commissioner when investigations find that blatant breaches in confidentiality have occurred.

Copies of both the Code of Practice and Explanatory Guide are available from CRBS.

Paragraph 22 of the Explanatory Guide of the Code of Practice For Registered Persons and other Recipients of Disclosure Information (Disclosure Scotland) states that all information disclosed by Disclosure Scotland is sensitive, personal information (data) and that registered bodies and persons should handle sensitive criminal records and other information responsibly. It also states that Registered Bodies must have a written policy on the secure handling, holding and destroying of Disclosure information.

Guidance on the management of personal and sensitive data including Disclosure information and 9 further services related to storage and access to confidential information are available) from the Central Registered Body in Scotland (CRBS) in various formats:

Data Protection Training.
Sample Policy on the Secure Handling, Use, Storage and Retention of Disclosure Information.
Advice and support on the management of Disclosure certificates where an organisation prefers not to receive and store these (this can include shredding of Disclosure information by CRBS. A fee may be charged for this service.)