ScotAccount: equality impact assessment

1.7 The development process

Origins and continuous improvement

The 2025 EQIA refresh incorporates findings from earlier assessments, learning from ScotAccount private beta launch with Disclosure Scotland in February 2023, extensive user testing and the development of new features such as attribute storage and reuse. ScotAccount is an iterative programme, designed to evolve through continuous user feedback, stakeholder engagement and iterative development to improve inclusion, accessibility and trust.

User-centred design

• Over 45 rounds of user research involving 1,100 participants informed service design.
• Accessibility testing included users with assistive technologies and protected characteristics.
• Continuous improvement surveys have gathered over 6,000 responses since launch, feeding into service enhancements.
• Service design with reading age of eight years to ensure clarity and ease of use.

Expert input

• Development guided by an Expert Group on privacy, security, and inclusion.
• Consultation with the Information Commissioner’s Office throughout development.
• Stakeholder engagement with a range of potential service providers and their service users, including Disclosure Scotland, Young Scot, and NHS.
• Deliberative consultation with users and interest groups.

Mitigation strategies

• Introduced landline-based two-factor authentication to mitigate against older users’ lower mobile phone ownership.
• Accepted Young Scot NEC cards for biometric proof.
• Implemented knowledge-based verification as an alternative to biometric checks.
• Sponsored CivTech challenges to explore vouching solutions for those without traditional proofs.
• Support the maintenance of offline routes for those unable or unwilling to use digital channels.
• Coordination with Connecting Scotland and other national initiatives to tackle systemic barriers like affordability and connectivity.

Alignment with standards

• Assessed against WCAG 2.1 AA accessibility standards.
• Compliant with the Digital Scotland Service Standard.
• Compliance with GPG 45 (medium), ISO 27001 and Scottish Cyber Resilience Framework, to build user confidence.
• Clear Privacy Notices for transparency about data use and legal basis, reinforcing trust and accountability.