Data Protection Act 2018 Request
Published on 08 May 2026
Data Protection Act 2018 Request
This guide explains how we handle requests under the Data Protection Act 2018 (DPA). It tells you:
- Who we are
- What we do
- Our role as a competent authority
- Why we may ask you or your organisation for information
- What this means for you
Who we are
Counter Fraud Services (CFS) investigates financial crime affecting NHS Scotland. We look into all types of fraud against NHS Scotland. CFS is part of Public Services Delivery Scotland (PSD Scotland). PSD Scotland sits within the Finance, Corporate Governance and Legal Services directorate. PSD Scotland is the working name of the Common Services Agency for the Scottish Health Service. This is a public body created under The National Health Services (Scotland) Act 1978.
What we do
We carry out criminal investigations to protect NHS Scotland’s resources. If our investigation shows that a crime has taken place, we report the case directly to the Crown Office and Procurator Fiscal Service (COPFS).
COPFS recognises CFS as a specialist reporting agency. We also work closely with Police Scotland and other law enforcement bodies.
CFS is leading this investigation because the alleged offences relate to NHS Scotland. This is a criminal investigation. It is not an internal disciplinary matter.
Our status as a competent authority
CFS is a competent authority under Schedule 7 of the Data Protection Act 2018. This means we have a legal reason to collect and use personal data for law enforcement purposes. This work is part of our legal duty to investigate financial crime against NHS Scotland.
Our legal basis for requesting information
We collect and use personal data for law enforcement purposes. We do this as part of our legal duties under Part 3 of the Data Protection Act 2018. Our lawful basis for processing personal data is that the work is necessary for tasks carried out in the public interest. These tasks are part of our official authority. We need this information to prevent, detect and investigate fraud or other irregularities.
Our role as a competent authority, and our legal powers to request information, are set out in law. These include:
What this means for you
When we ask you for information, it is part of a formal criminal investigation. Our requests have the same legal authority as requests from other law enforcement bodies.
Contact us
If you have questions about an information request, please contact the lead investigator using the details on the DPA request you received. Alternatively, email us.