The Cross-border Placement of Children (Requirements, Effect and Enforcement) (Scotland) Regulations 2026: Data Protection Impact Assessment

2. Introductory information

2.1 Summary of proposal

Cross-border placements into residential and foster care in Scotland from other parts of the UK should only occur in exceptional circumstances, where the placement is in the best interests of the child. In such cases, it is essential that the relevant Scottish parties are informed of the placement and provided with the necessary information to support the child and fulfil their statutory duties. This includes being provided with key details about the child and their placement, as well as appropriate contact information to obtain any further information required.

The Regulations include a requirement for placing authorities in England, Wales, and Northern Ireland to complete a notice in relation to all cross-border placements into residential and foster care in Scotland, to provide this to relevant persons in Scotland and update it as appropriate. An undertaking outlining the placing authority’s responsibilities for the duration of the placement must also be completed and submitted to those parties in the context of residential care placements.

In the fostering context, the Regulations include a requirement for an agreement to be entered into between a placing fostering authority and a foster carer in relation to matters relevant to the placement. This includes a requirement to share a statement with the foster carer containing all information which it considers necessary to enable the foster carer to care for the child. Schedule 3 of the Regulations lists particular information which must be provided to the foster carer for this purpose.

2.2 Description of the personal data involved

The Regulations will require placing authorities to provide information about the child being placed into residential and foster care in Scotland, including details of the placement, the order or arrangement under which the child has been placed, the reasons for the placement in Scotland, and relevant contact details.

Please also specify if this personal data will be special category data, or relate to criminal convictions or offences

The Regulations do provide scope for sharing of special category data (for example, information about the reasons for the placement and information about the educational provision for the child who is the subject of the placement may entail, for example, disclosure of a child’s disability). Moreover, additional information will, if necessary, be shared separately (e.g. Scottish Health Boards may seek further details on the child’s heath needs or ask for a copy of health records). Such requests can be raised at a multi-agency discussion or with the placing authority directly.

Although not required by the Regulations, guidance will set out that multi-agency discussion prior to placement is advised. This will enable Scottish parties to consider the proposed placement in more detail and assess whether they can meet the child’s needs. In doing so, it may be necessary for parties to request information in addition to what was provided within the notice. The Scottish Government or Care Inspectorate will not be part of these discussions.

Data controllers will require a lawful basis for processing information under article 6 of the UK GDPR and, insofar as the processing of special category data is concerned, a special category condition must be identified in compliance with article 9. Article 9(2)(g) of the UK GDPR, for example, requires controllers to demonstrate that processing is necessary for reasons of substantial public interest and identify a condition from Schedule 1, Part 2 of the Data Protection Act 2018 that applies (such as statutory and government purposes or safeguarding of children and individuals at risk).

Whilst the Regulations do not directly require the processing of data on criminal convictions, they oblige a placing fostering authority to enter into an agreement with a foster carer. To ensure safeguarding of placed children, this agreement will set out an obligation on the foster carer to notify the placing and receiving fostering authorities of any criminal convictions arising between their approval as a foster carer and any subsequent reviews under the Looked After Children (Scotland) Regulations 2009. Conclusion of the agreement and sharing of updated criminal offence data will require the consent of the foster carer, and the placing and receiving authorities will process this according to their official authority.

2.3 Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons? If so, please explain the potential or actual impact. This may include, for example, a denial of an individual’s rights, or use of social profiling to inform policy making.

The notice provided by placing authorities is only intended to ensure that relevant Scottish authorities (such as a local authority or health board) are aware of a placement in their area and are provided with sufficient information to enable them to fulfil their statutory duties if required. It does not include the level of detail required to support any decision-making.

The multi-agency discussion is intended to provide Scottish authorities with an opportunity to consider the placement in greater detail, with a focus on the child’s specific needs, and to assess whether they can meet those needs. While the final decision to proceed with the placement remains with the placing local authority, the information shared during this discussion may influence the outcome of that decision.

2.4 Necessity, proportionality and justification

What issue/public need is the proposal seeking to address?

Cross-border placements into Scotland should only occur in exceptional circumstances where the placement is in the best interests of the individual child. The Scottish Government’s intention through the Regulations is to ensure that placements into residential and foster care in Scotland are appropriately considered and assessed, and that a clear regulatory framework applies to these placements. This, in turn, will ensure that the rights and wellbeing of children who come to Scotland through cross-border placements are safeguarded and promoted.

Evidence gathering has highlighted a similar level of risk present in all cross-border placements regardless of their underpinning order, or the agreement which has been used to place children into Scotland. For most of the cross-border placements coming to Scotland, Scottish authorities know very little about these children or their circumstances. In many cases, they do not know that children have been placed and often find out through crisis intervention. Developing the Regulations as one comprehensive package, encompassing a range of different types of relevant orders and placements, will ensure that the risks identified through this evidence gathering are effectively mitigated.

The existing Cross-border Placements “Effect of Deprivation of Liberty Orders) (Scotland) Regulations 2022(“the DoL Regulations”) require placing authorities to notify Scottish parties when a child is placed into residential care in Scotland on a deprivation of liberty order (“DoL order”). Engagement with stakeholders has highlighted that notifications are frequently received after the child has already been placed in Scotland – and in some cases, not at all. Concerns have also been raised that the current notice lacks sufficient information to enable Scottish parties to fulfil their responsibilities or to contact the lead professional for further details where needed. This can result in delays in providing appropriate support to the child and places further strain on already stretched Scottish resources.

What policy objective is the legislation trying to meet?

We have also received feedback that children are often placed without appropriate education or health services being arranged in advance. This can lead to delays in providing the necessary support for the child and places additional strain on already stretched resources in Scotland. Scottish parties have expressed a clear expectation that they should have the opportunity to contribute before a placement is made.

Requiring placing authorities to submit a notice for every temporary cross-border residential and foster placement in advance of the placement to ensure its legal basis is given effect to ensures that Scottish parties are informed of the intention to place a child in their area. This advance notice allows sufficient time to make the necessary arrangements to provide the child with the best possible care. It also ensures Scottish parties have the information needed to fulfil their responsibilities and to contact the appropriate individuals should further details be required. The multi-agency discussion will support this.

Were less invasive or more privacy-friendly options considered, and if so, why were these options rejected?

Careful consideration has been given to the level of information required for parties to fulfil their statutory duties. In developing the proposals, we have assessed the specific responsibilities of each agency and included only the information required to support those functions. This approach is intended to minimise unnecessary intrusion and protect the privacy of the young people being placed in Scotland.

Further consideration was given to minimisation. A core identifier set of information was explored as a less intrusive option. However, stakeholder engagement (particularly with Health Boards, Police Scotland and Chief Social Work Officers) confirmed that the full name and full date of birth of the child who is to be subject to the placement are necessary to identify and safeguard children in urgent or crisis circumstances.

Consideration was given to including foster carer personal data (such as name and address), but this has not been included. This ensures the notice contains only what is operationally required.

Are there any potential unintended consequences with regards to the provisions e.g., would the provisions result in unintended surveillance or profiling.

We are not aware of any unintended consequences of these provisions.

Have you considered whether the intended processing will have appropriate safeguards in place? If so, briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

Each of the Scottish parties involved are operationally independent bodies or agencies and have individual responsibilities to ensure compliance with GDPR.

To support this, detailed guidance will be issued alongside the Regulations including a notice template designed to ensure that only the necessary information is shared with the appropriate parties. The guidance will also reference the ICO’s Data Sharing Code of Practice to support lawful and proportionate information sharing.

2.5 Will the implementation be accompanied by guidance or by an associated Code of Conduct?

The Regulations will be supported by comprehensive guidance for stakeholders, along with awareness-raising sessions to ensure consistent understanding and implementation.