Why do Scottish public bodies handle audience management differently from English councils?

What to take away

Two accountability chains, one rulebook

Devolved governance shapes what a Scottish public body treats as a legitimate reason to contact residents.

The ICO regulates UK GDPR, PECR and the Data Protection Act 2018 across the whole UK.

Why this matters to customer data platforms

For anyone choosing a customer data platform or audience platform, the Scottish split changes the buying case. The platform has to hold lawful basis, retention, suppression and records duties in one auditable trail. It also has to fit Scottish procurement routes and committee sign-off.

That makes platform selection less about features alone and more about how the system documents public task, consent and opt-out across statutory records. Suppliers pitching to Scottish bodies should map those controls to the platform's audit log, because the governance chain will test them.

Records duties English councils do not carry

Under the Public Records (Scotland) Act 2011, listed public authorities must produce a records management plan agreed by the Keeper of the Records of Scotland.

The Scotland legislation collection lists the acts and instruments creating these duties.

Scottish freedom of information appeals go to the Scottish Information Commissioner instead, whose decisions shape how records are described.

Council tax, education and social care records exist for statutory functions. Reusing them for a newsletter needs a separate lawful basis, which is the same test English councils apply. The UK rules around a customer data platform cover how that basis is documented from the statutory record onwards.

Where oversight, audit and funding diverge

Scotland Excel runs national procurement frameworks that councils can call off, and Scottish Government frameworks cover other categories. A customer data platform bought under an English framework usually needs a fresh award north of the border.

Example: a vaccination reminder from a health and social care partnership

A vaccination reminder drawn from GP records rests on public task, not consent, because it supports a statutory health function. The partnership still needs a data protection impact assessment, a retention period and a deletion route.

Reusing the same audience for a leisure discount would be direct marketing, which needs consent.

Direct marketing rules that apply unchanged

PECR and UK GDPR govern electronic marketing across the UK, and the ICO's direct marketing and the public sector guidance applies to Scottish bodies without modification.

Before launch, work through a short checklist:

What changes for a supplier

An English council can often approve a resident newsletter through a communications lead and a data protection officer. A Scottish body may add a service manager, a senior information risk owner and a committee report.

A Scottish pilot often needs a data sharing agreement and an agreed records plan before it starts. Our guide to mapping a customer data platform sets out how to sequence that privacy review.

Common questions

Who regulates audience data in a Scottish public body?

The ICO regulates data protection and electronic marketing across the UK. Freedom of information appeals go to the Scottish Information Commissioner instead.

Can a Scottish council reuse council tax records for a newsletter?

Council tax data is held for a statutory function, so a newsletter needs its own lawful basis, normally consent.

Do PECR and UK GDPR apply the same way in Scotland?

Yes. Both apply across the UK without modification and the ICO enforces them everywhere. What differs is the sign-off chain, the records duty and the route for complaints.

What should a supplier check before pitching a CDP to a Scottish body?

Confirm the records management plan is agreed, ask which Scottish framework applies, and budget for a committee cycle.