Energy Performance of Buildings (Scotland) Regulations 2025: data protection impact assessment

Personal data to be processed

EPC Approved Organisation Administration Data

The Energy Performance of Buildings (Scotland) Regulations (2025) will require that Approved Organisations (AOs) ensure that accredited members are fit and proper persons who are qualified by their education, training and experience to carry out the preparation and issuing of EPCs. The operating framework requires that all AOs manage information in line with General Data Protection Regulations (GDPR) requirements.

Data collected and processed by assessors and Approved Organisations could include customer contact details, photo evidence of features of a property, audit results and disciplinary matters relating to the assessor’s conduct. This information is not shared with the Scottish EPC Register. No personal data from the building owner/occupant is collected and sent to the EPC register.

Green Deal Information

If an active Green Deal exists for a property the Energy Performance of Buildings (Scotland) Regulations (2025) require that this information is displayed as part of the EPC property report. This information will explain what improvements have been made and how much the person who pays the electricity bill is required to pay (through their bills).

This is financial information. In the public extracts, properties with an active Green Deal are shared but the RRN is removed. The Green Deal information will only be returned when searching for an EPC using the Report Reference Number (RRN) but not through a postcode search.