Privacy

Public Services Delivery Scotland (PSD Scotland) is a public organisation created in Scotland under section 10 of the National Health Service (Scotland) Act 1978 (the 1978 Act).

‘Public Services Delivery Scotland’ is the common name of the Common Services Agency for the Scottish Health Service and is one of the organisations which form part of NHS Scotland.

Creation of Public Services Delivery Scotland – April 2026

PSD Scotland was established on 1 April 2026, replacing two existing organisations: NHS Education for Scotland (NES) and NHS National Services Scotland (NSS).

The existing work of both NES and NSS will continue under PSD Scotland. This news article published by the Scottish Government details the background and remit of the new organisation.

A comprehensive PSD Scotland privacy notice will be published in due course. In the meantime please refer to the privacy notices for the previous organisations (NSS and NES) to see how personal data is managed.

Work previously undertaken by NSS

The NSS privacy notice can be found on the NSS website.

Work previously undertaken by NSS includes:

• NSS provided services to health boards and organisations within NHS Scotland, supporting organisations to deliver their services more efficiently and effectively, offering shared services on a national scale.
• Scottish National Blood Transfusion Service.
• Counter Fraud Service, Central Legal Office and National Procurement.
• a full list of NSS directorates is available at Directorates | National Services Scotland.

Work previously undertaken by NES

The NES privacy notice can be found on the NES website.

Work previously undertaken by NES includes:

• Developing and delivering education and training for the health and social care workforce
• Lead body for digital development in health and social care
• National programmes such as the National Digital Platform, Digital Front Door and MyCare.scot

Your rights

This section contains a description of your data protection rights.

The right to be informed

As an organisation, we must explain how we use your personal data. We use a number of ways to communicate how personal data is used, including:

• this Data Protection Notice.
• information leaflets.
• discussions with staff providing your care.

The right of access

You have the right to ask PSD Scotland whether it is processing your personal data. Where we are, you have the right to access the personal data, and be told:

• the purposes of the processing.
• the kinds of personal data concerned.
• the recipients or kinds of recipient to whom the personal data have been or will be disclosed.
• where possible, the period foreseen for storage of personal data, or, if not possible, how that period will be set.
• where the personal data are not collected from you, any available information as to their source.
• the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved. Also, the significance and any foreseen consequences of such processing for you.

Taking this step is called making a subject access request.

We must provide this information free of charge. However, if you request more than one copy we may charge a reasonable administrative fee

When you make a subject access request we ask for proof of identity such as a passport, photo ID driving license, or evidence of address. Once we have details of your request and you have given us enough information to find your personal data, we must respond without delay, within one month (30 days).

If your request is complex, we may take longer to respond - up to two months. If this is going to happen, we will tell you before the first month is up and give a reason.

The right to rectification

If the personal information we hold about you is inaccurate or incomplete you have the right to have this corrected (rectified).

If it is agreed that your personal information is inaccurate or incomplete, we will amend your records within one month - or two months where the request is complex. We will contact you quickly to explain any need to extend the timescale in this way.

If PSD Scotland does not agree that your personal information is inaccurate, we will add a comment to your record stating your concerns about the information. Where this is the case, we must contact you within one month and give our reasons.

If you are unhappy about how we have responded to your request for rectification, we will give you information on how to complain to the Information Commissioner’s Office, or to take legal action.

The right to object

When PSD Scotland is processing your personal data for the performance of a task carried out in the public interest or in the exercise of official authority you have the right to object to the processing, or to seek restriction of further processing.

Where PSD Scotland can show compelling legitimate grounds for processing your personal information, for instance; patient safety or for evidence to support legal claims, your right to object will not be upheld.

The right to complain

We employ a Data Protection Officer to check that we handle personal information in a way that meets data protection law. If you’re unhappy with the way we use your personal information, please contact our Data Protection Officer using the details below.

You also have the right to raise concerns about the handling of your personal data with the Information Commissioner.

How to enact your rights or contact the Data Protection Officer

To enact any of your data protection rights, complain about how your personal data is being handled or to contact the Data Protection Officer, please use the following details:

PSD Scotland Data Protection Officer
Gyle Square
1 South Gyle Crescent
Edinburgh
EH12 9EB 

Email: psd.data.prot.ig@nhs.scot

Other rights

Other rights under data protection law only apply to certain cases. Please see details in either the previous NSS or NES privacy notices.