Edinburgh is one of Europe's major financial centres, with a concentration of fund managers, banks and insurers alongside Scotland's legal profession and national institutions. Requests here often involve regulated records, complaints and legal advice.
We handle review, redaction and disclosure for Edinburgh and East of Scotland organisations remotely, with the Scots-law differences in mind.
Privilege in Scotland: confidentiality of communications
The Data Protection Act 2018 exempts information covered by legal professional privilege — or, in Scotland, by confidentiality of communications. The Scottish doctrine protects communications between a client and their legal adviser, and material prepared in contemplation of litigation, much as privilege does in England, but it is a separate body of law.
Two practical points follow. Legal advice has to be identified item by item, not asserted over a whole folder. And advice from people who aren't legal advisers, such as HR consultants, isn't protected simply because it discusses a legal risk.
Regulated records and complaints
In financial services, SARs frequently arrive alongside a complaint, or after one has been escalated to the Financial Ombudsman Service. Complaint files, call notes and internal assessments are all in scope. Where internal notes contain the requester's personal data, the fact that they are unflattering isn't a reason to withhold them.
For a sense of what's at stake when this goes wrong, see the true cost of getting a SAR wrong.
Which regulator handles complaints?
The ICO has a Scotland office in Edinburgh, and it is the ICO — not the Scottish Information Commissioner — that handles complaints about SARs from Scottish organisations. For freedom of information questions affecting Scottish public authorities, the Scottish Information Commissioner is the relevant regulator.
Sectors we support in the East of Scotland
Asset management and banking
Client and employee requests involving regulated records and recorded lines.
Insurance
Claims and complaint files, often requested alongside an ombudsman referral.
Law firms
Requests from clients and staff where confidentiality of communications must be applied carefully.
Public bodies and universities
Requests to national institutions, with FOISA in the background.
How we handle your SAR remotely
- Tell us about the request — the systems involved, the date range and your deadline. We confirm a fixed fee within 24 hours.
- Upload the documents to an encrypted, access-controlled workspace. Nothing is emailed.
- Our specialists review every item and redact third-party and exempt information, logging the legal basis for each decision.
- You receive a finished disclosure pack, covering letter and redaction schedule, ready to send.
Every case is quoted individually on the size and complexity of your dataset, and the fixed fee is agreed before any work begins.
Received a SAR in Edinburgh?
Tell us the scope and your deadline, and we'll confirm a fixed fee within 24 hours. No commitment required.
Get Your Free SAR Assessment →or call 01244 261 379Frequently asked questions
Is legal professional privilege the same in Scotland?
The effect is similar, but the Scottish concept is confidentiality of communications, and the Data Protection Act 2018 refers to it expressly. It must be applied to specific items, not whole files.
Can we withhold our complaint-handling notes?
Not simply because they are internal or unflattering. Notes containing the requester's personal data are generally disclosable, subject to third-party and other specific exemptions.
Who handles SAR complaints about Scottish organisations?
The ICO, through its Scotland office in Edinburgh. The Scottish Information Commissioner deals with FOISA, not data protection.