Producing official statistics

Confidentiality and data management

Purpose

This policy sets out how the Scottish Government protects the confidentiality of personal information used in producing official statistics, ensuring compliance with data protection law and the Code of Practice for Statistics.

Principles

The Scottish Government is committed to producing high-quality statistics that serve the public good while also protecting the confidentiality of data. We recognise that:

• confidentiality of data is essential for maintaining public trust
• assurance of confidentiality encourages participation in surveys and data collection
• proper protection of data is both a legal and ethical obligation
• breaches of confidentiality can cause harm to individuals and damage the statistical system

Our confidentiality practices are governed by relevant legislation including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

Statistical Disclosure Control

Statistical Disclosure Control (SDC) should be applied to statistical outputs whenever there is a risk of identifying confidential information.

Approaches to statistical disclosure control are often divided into 'Rules-based' and 'Principles-based' approaches. Rules-based approaches have the advantage of being simpler and requiring less resource or expertise than principles-based approaches.

Principles-based approaches take a more considered approach to disclosure control, taking into account the specific details of the data in determining whether a risk of disclosure exists. Principles-based approaches are to be preferred where possible.

Before publication, we implement disclosure control based on an assessment of:

• whether individuals could be identified from the statistics
• whether sensitive attributes could be disclosed
• risks from combining our outputs with other publicly available information to identify personal information

Data management

Our approach to confidentiality is further supported by our approach to data management. All confidential data is stored and processed on secure IT infrastructure and restricted to authorised individuals.

In order that that data is processed in a secure manner we ensure that:

• statistical data is processed in secure Scottish Government IT systems
• access to data is restricted to authorised personnel only
• we process only the minimum personal data necessary for statistical purposes
• we pseudonymise or anonymise data at the earliest appropriate stage
• we retain data only as long as necessary for statistical and research purposes or as required by law

Data sharing and linkage

We may share data with other organisations in order to produce statistics for the public good, subject to data protection legislation. We also increasingly use data linkage to maximise value from existing data holdings.

When data is shared across public organisations, we ensure that:

• data sharing or linkage projects will take place only where lawful and necessary
• data sharing agreements specify purposes, safeguards and responsibilities
• we follow the Five Safes framework
• we promote transparency through the publication of data sharing information where appropriate

Access to data may also be provided to approved researchers in secure environments.

 More information on accessing our data is available..

Review

This policy is reviewed regularly to ensure compliance with current legislation and guidance and alignment with the Code of Practice for Statistics.

Contact

You are welcome to contact us directly with any comments about how we meet these standards via the Office of the Chief Statistician.

Alternatively, you can email the Office for Statistics Regulation by email or contact them via the OSR website.