Data privacy notice

If you have any queries concerning how we process or use personal data or information generally, we may be contacted as follows.

• by mail to:

  Scottish Forestry
  FAO the Data Protection Officer
  Saughton House
  Broomhouse Drive
  Edinburgh
  EH11 3XD
  Scotland

• by email at Scottish.Forestry@forestry.gov.scot
• by telephone at 0300 244 4000

• through the contact facilities upon our website at https://www.forestry.gov.scot/contact

  Contact Scottish Forestry

In respect of any correspondence sent to us concerning how we process or use personal data we could be grateful if it is marked “Privacy Notice – Grants and Regulations”.

Our activities and functions include the following.

In performing our functions under applicable law, we:

• conduct assessments
• arrange and conduct consultations
• determine approvals
• conduct monitoring and evaluation
• undertake reviews
• determine appeals
• conduct enforcement activities
• maintain registers (including public registers) relating to:
  • felling permissions
  • forest planning
  • forest management planning
  • environmental impact assessments
  • tree felling
  • tree health

In conducting these activities, we collect and process personal data relating to individuals interested in, or whose activities relate to, those matters.

We associate with those individuals information concerning their interest in, or activities relating to, those areas.

The basis under which we process personal data in this respect is our performance of public tasks. The laws under which we perform public tasks include:

• The Forestry (Environmental Impact Assessment) (Scotland) Regulations 2017
• The Forestry and Land Management (Scotland) Act 2018
• The Felling (Scotland) Regulations 2019
• Agriculture (Retained EU Law and Data) (Scotland) Act 2020
• The Agriculture and Rural Communities (Scotland) Act 2024
• various plant health laws (see Legislation for tree health)
• The Conservation (Natural Habitats, &c.) Regulations 1994 (Habitat Regulations Appraisals only)

In addition, we conduct assessments, determine eligibility for, conduct monitoring and evaluation in relation to, undertake reviews of, determine appeals concerning and conduct enforcement activities relating to the provision of grants and loans by us.

In conducting these activities we collect and process personal data relating to individuals interested in, or whose activities relate to, those interested in grants and loans, and/or of individuals receiving or connected to persons receiving grants or loans.

We associate with those individuals information concerning their interest in, or activities relating to, grants and loans.

The basis under which we process personal data in this respect is the performance of contracts relating to those grants and loans, and the conduct of activities in preparation for such contracts.

In the course of conducting the activities referred to above we will collect and process personal data.

Where we gather personal data we will endeavour to ensure that only the personal data we need is gathered.

Personal data that we collect and process in relation to the individuals referred to above may include the following

• personal details, such as title, name(s), and date of birth
• details about connected businesses, including name(s) and address(es)
• contact details including telephone number(s), and email address(s)
• information contained in correspondence or documentation relevant to the conduct of our activities
• information relating to connected land and property, such as maps, plans, or land titles
• videos, photographs, witness statements, and interview transcripts
• information concerning stakeholders, witnesses, neighbouring land owners or users
• payment information

We do not collect or process special category personal data and we ask that this is not provided to us. If received this will be promptly and securely deleted and/or destroyed.

We need this information in order to conduct our functions, as set out at the start of this notice.

We collect personal data using various means and from various sources, being:

• through the submission of applications to us
• by requesting the submission of information to us
• through general research and evidence gathering, both from public sources and through exercise of our powers under applicable law
• by requesting information from other public bodies
• via the contact means set out above
• by inviting the submission of information in direct comment to our specific notification and consulted projects (including our public registers)

If you do not provide us with personal data we require to conduct our activities, we may not be able to complete the activity in respect of which that personal data is required to your satisfaction, or at all.

Where we require personal data to perform our activities, we may use alternative means to identify the data required, for example requesting information or intervention from other public bodies.

We will share personal data with the third parties that provide our information technology facilities, for example email or case management facilities, in the course of our normal conduct of our activities.

Some of these third parties may be located or may operate facilities located out with the UK.

Any sharing will be conducted under controls under law or contract which provide you with at least the same level of protection in respect of your personal data as you are entitled to under UK law.

Where we process personal data in relation to our maintenance of public registers or consultations, personal data may be made available to the general public upon those registers or in connection with those consultations.

In this respect, the amount of personal data made available shall be that which allows us to properly meet the requirements of our connected public functions.

You will be notified at the point of collection of that personal data where we intend to make your personal data available in this respect.

We may disclose personal data to other public bodies as required in performance of our public functions. In such an event we will ensure that adequate and reasonable protections are implemented with respect to that disclosure. 

We recommend that you redact any personal data from documents provided to us if it is not relevant to the purpose of that provision, otherwise such personal data may be incidentally processed and disclosed (as set out herein) as part of our activities.

If you feel strongly that particular personal data provided to us should not be disclosed as set out herein, you may request that we retain that personal data as confidential.

However, in such instances whilst we will try to accommodate your request, we may not be able to complete the activity in respect of which that personal data was provided to your satisfaction, or at all.

We will never intentionally share any Special Category Data publicly, and will only share with other bodies if absolutely necessary to perform our functions or where compelled to do so by law.

We may store your personal data in electronic or physical form.

Physical form data will be stored in secure file storage at our premises or in secure data facilities, with access limited to authorised individuals as necessary only.

Electronically stored data will be stored on secure networks accessible only through the use of an encrypted computers by authorised individuals.

Case management systems may be used and will be password protected or use verified single sign on controls operable only from encrypted computers.

Where we share information we will password protected means with two-factor authentication, or means accessible only by invitation and through encrypted computers with additional password checks.

We shall retain personal data:

• where that personal data is processed to enable the performance of our public functions, for the period that we perform those public functions and thereafter until such time as no liabilities can arise in relation to the performance of those functions. 

  Please note that our public functions include the maintenance of various public registers concerning our activities, in which case related personal data shall be retained on a continuous basis. 

• where that personal data is processed in relation to grants and loans, for the period during which we are discussing a possible grant or loan relating to you, for the period that repayment of any grant or loan may be required, and thereafter for such period as any liabilities may remain in relation to that grant or loan.

When we dispose of personal data we shall do so securely.

Electronically held personal data will be disposed of through the permanent deletion of the personal data. Physical copies of personal data will be disposed of through secure destruction by us or our service providers.

We will not use personal data to make a decision which has legal effects based solely on automated processing, including profiling.

We may, however, use automated processing means to assist us in evaluating, monitoring, or reviewing information.

You have various rights in relation to the personal data awe hold concerning you.

Your rights in relation to your personal information are:

• you have a right to request access to, and to obtain copies of the personal data that we hold about you by making a "subject access request"
• if you believe that any of the personal data that we hold about you is inaccurate or incomplete, you have a right to request that we correct or complete your personal data

• you have a right in certain circumstances to object to and/or request that we restrict the processing of your personal information

  Right to restrict processing (Information Commissioner's Office website)

• you have a right in certain circumstances to have the personal data we hold about you erased

  Right to erasure (Information Commissioner's Office website)

• where you have given consent to the processing of your personal information, you have the right to withdraw that consent.

You can exercise any of the following rights by contacting us using the means of contact set out above.

We are committed to protecting your personal data.

If you have queries or concerns, please contact us using the contact means set out above.

If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner's Office. The contact details for the Information Commissioner’s Office are as follows.

The Information Commissioner’s Office
Queen Elizabeth House
Sibbald Walk
Edinburgh
EH8 8FT
Information Commissioner's Office
Telephone: 0303 123 1115

We may partner with third parties performing our activities.

In doing so we may provide links to those third party websites, or contact details for those third parties.

Those third parties will have their own policies, notices, and such like for processing personal data.

We are not responsible for how they process personal data, and you should check and confirm how they process personal data before you provide personal data to them.

We may amend this privacy notice from time to time.

Please check this privacy notice from time to time, including when you submit information to us, as it may have changed from a previous version you reviewed.

This privacy notice was last reviewed in November 2025.

We will keep this privacy notice under regular review to make sure it is up to date and accurate.

We may supplement this privacy notice by other notices upon our website or within documents provided by us.