ICO statement on its investigation into Police Scotland

11 Sep 2026 03:58 PM

ICO statement on its investigation into Police Scotland

An ICO spokesperson said:

"A subject access request (SAR) is a fundamental right that allows people to know what information organisations hold about them and how it is being used. 

"We are investigating Police Scotland’s compliance when handling SARs. The investigation is seeking to establish whether Police Scotland has failed, or is failing, to comply with its legal obligations under Articles 12 and 15 of the UK General Data Protection Regulation and Section 45 of the Data Protection Act, including responding to requests within the statutory timescale.  

“As this is a live investigation, we are unable to comment further." 

Background information

The opening of an investigation does not mean we have reached any conclusion about whether the organisation has breached its duties. The fact of this statement is not in any way intended to predetermine the outcome of our investigation.   

Where we identify compliance failures, we can use our regulatory tools such as providing advice and issuing assessment notices, warnings, reprimands, enforcement notices, and fines up to £17.5 million or 4% of the total annual worldwide turnover in the preceding financial year, whichever is higher. If we plan to issue a fine, enforcement notice or reprimand, we will send preliminary decisions to give the organisation an opportunity to respond before we reach a final decision.