DPO Services & Consultancy in Glasgow

UK GDPR makes a DPO mandatory for public authorities. The Data Protection Act 2018 defines a public authority partly by reference to freedom of information law — and in Scotland that means the Freedom of Information (Scotland) Act 2002, not the UK Act.

We provide named, outsourced DPOs to Glasgow and West of Scotland organisations, remotely and on a fixed monthly fee.

Scottish housing associations must have a DPO

Since November 2019, registered social landlords in Scotland have been designated as Scottish public authorities under FOISA. That makes them public authorities for data protection purposes too — so every Scottish RSL must appoint a DPO, whatever its size.

That's a significant difference from England, where most housing associations aren't public authorities and only need a DPO if their processing meets the large-scale tests.

Community councils are exempt

The Data Protection Act 2018 expressly excludes community councils in Scotland from the definition of public authority for these purposes. A community council still has to comply with UK GDPR, but it isn't required to appoint a DPO.

Councils and health boards

Glasgow City Council, NHS Greater Glasgow and Clyde and the city's universities are all public authorities with a mandatory DPO. At that scale the challenge is resourcing and independence — a DPO buried within an information governance team can struggle to report to the highest level of management. See what a DPO actually does.

Sectors we support in the West of Scotland

How our outsourced DPO service works

1. A free 30-minute consultation to understand your organisation, your processing and whether a DPO is mandatory for you.
2. A clear proposal with a single fixed monthly fee, based on your size and complexity. No hidden costs.
3. Your named DPO in place within 48 hours, with the ICO notified of their contact details.
4. Ongoing support: monthly reporting, policy oversight, breach readiness and direct access to your DPO.

Every engagement runs on rolling monthly terms, with no long-term contract.

DPO consultancy without an appointment

Not every organisation needs a formal DPO. If the mandatory triggers don't apply to you, our DPO consultancy gives you the same expertise on the specific areas you need — a compliance gap analysis, DPIAs for new projects, policy reviews, breach response support or staff training — without the statutory obligations that come with appointing a DPO.

In the West of Scotland, community councils and smaller organisations outside FOISA use our consultancy for policies, training and breach support without a DPO appointment.

Frequently asked questions

Do Scottish housing associations need a DPO?

Yes. Registered social landlords in Scotland have been Scottish public authorities under FOISA since November 2019, which makes a DPO mandatory.

Does a community council need a DPO?

No. Community councils in Scotland are expressly excluded from the definition of public authority, so a DPO isn't required — although UK GDPR still applies.

Is the ICO the regulator in Scotland?

Yes, for data protection. The Scottish Information Commissioner regulates freedom of information under FOISA.