Energy Performance of Buildings (Scotland) Regulations 2025: data protection impact assessment
Data protection impact assessment (DPIA) produced as part of our intention to lay updated Energy Performance Certificate (EPC) regulations in October 2025. This DPIA has considered the evidence to understand any potential data protection outcomes from the reform of EPCs.
How this data will be processed
EPC Requirements
The Energy Performance of Buildings (Scotland) Regulations (2025) require that building owners must have a valid Energy Performance Certificate (EPC) when:
- Selling or letting a property.
- Completing a newly-constructed building.
- Displaying it publicly as part of ongoing compliance.
A building owner will commission an accredited EPC assessor to complete an assessment of their building. The assessor will visit the property to complete a survey of the property. This data will be lodged on the EPC register. Once the EPC is lodged, building owners and potential owners or tenants can then access the EPC through the Scottish EPC website.
EPCs under the Energy Performance of Buildings (Scotland) Regulations (2025) will be valid for five years unless superseded by a new EPC. EPCs may be subject to an audit and as a result could be marked as invalid. Historic EPC data will be kept for at least 10 years.
Where a property has an active Green Deal loan this will be shown on an EPC[8]. Green deal information is not included on the public extracts of the EPC Register data.
Assessor names and their accreditation body are included on the Property Report that accompanies an EPC but are not included on the public extracts of the EPC Register data.
The Regulations require that on an EPC and accompanying Property Report: “An energy performance certificate must not contain any information or data from which a living individual (other than the person issuing it or that person's employer) can be identified.” The Regulations require that any published extracts of EPC data must not include: “any information or data from which a living individual can be identified”.
The regulations also define:
- Assessment data – data that was collected during the preparation and issuing of an energy performance certificate and property report
- Energy performance data –the information needed to produce an energy performance certificate or a property report
Contact
Email: EPCenquiries@gov.scot