The Animal Health (Fixed Penalty Notices) (Scotland) Regulations 2026: Data Protection Impact Assessment
Data protection impact assessment (DPIA) considering the potential impacts of the implementation of the Animal Health Fixed Penalty Notice (Scotland) Regulations 2026
3. Data Controllers
3.1 Organisation: Scottish Ministers
3.1.1 Activities
The Scottish Ministers are an enforcement authority for the purposes of the Regulations.
The Regulations require enforcement authorities to make arrangements for the retention and storage of records specified within the Regulations whenever a FPN is issued for 3 years beginning with the date on which the FPN was issued.
3.1.2 Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?
Yes.
3.1.3 Lawful basis for processing under the Data Protection Act 2018 for the collection and sharing of personal data – general processing
Section 35(2)(b) – necessary for the performance of a task carried out for law enforcement purposes by a competent authority
3.1.4 Lawful basis for sensitive processing under the Data Protection Act 2018
N/A
3.1.5 Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018
For law enforcement purposes, Scottish Ministers are a competent authority under paragraph 2 of Schedule 7 of the Data Protection Act 2018.
3.1.6 Legal gateway for any sharing of personal data between organisations
Sections 71, 72 and 73 of the Animal Health Act 1981, section 1(7) of the Bees Act 1980, and regulation 12(1) of the Animal Health (Fixed Penalty Notices) (Scotland) Regulations 2026.
3.2 Organisation: Local authorities
3.2.1 Activities
Every Scottish local authority is an enforcement authority for the purposes of the Regulations.
The Regulations require enforcement authorities to make arrangements for the retention and storage of records specified within the Regulations whenever a FPN is issued for 3 years beginning with the date on which the FPN was issued.
3.2.2 Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?
Yes.
3.2.3 Lawful basis for processing under the Data Protection Act 2018 for the collection and sharing of personal data – general processing
Section 35(2)(b) – necessary for the performance of a task carried out for law enforcement purposes by a competent authority
3.2.4 Lawful basis for sensitive processing under the Data Protection Act 2018
N/A
3.2.5 Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018
For law enforcement purposes, local authorities have statutory functions and are a competent authority under section 30(1)(b) of the Data Protection Act 2018.
3.2.6 Legal gateway for any sharing of personal data between organisations
Sections 71, 72 and 73 of the Animal Health Act 1981, and regulation 12(1) of the Animal Health (Fixed Penalty Notices) (Scotland) Regulations 2026.
3.3 Organisation: Police Scotland
3.3.1 Activities
The Police Service of Scotland is an enforcement authority for the purposes of the Regulations.
The Regulations require enforcement authorities to make arrangements for the retention and storage of records specified within the Regulations whenever a FPN is issued for 3 years beginning with the date on which the FPN was issued.
3.3.2 Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?
Yes.
3.3.3 Lawful basis for processing under the Data Protection Act 2018 for the collection and sharing of personal data – general processing
Section 35(2)(b) – necessary for the performance of a task carried out for law enforcement purposes by a competent authority
3.3.4 Lawful basis for sensitive processing under the Data Protection Act 2018
N/A
3.3.5 Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018
For law enforcement purposes, the chief constable of the Police Service of Scotland is a competent authority under paragraph 9 of Schedule 7 of the Data Protection Act 2018.
3.3.6 Legal gateway for any sharing of personal data between organisations
Sections 71, 72 and 73 of the Animal Health Act 1981, and regulation 12(1) of the Animal Health (Fixed Penalty Notices) (Scotland) Regulations 2026.