Privacy overview

The National Library of Scotland collects and processes personal data for a number of purposes, as listed on this page.

You can follow the links in the menu to read the privacy notice for each purpose. Each notice provides information about our processing of personal data for the stated purpose, the retention of the data, your associated rights, and how to complain about our processing of it.

Since our functions and activities change, we may add to or edit this list of purposes. We may also add to or edit the information in the notices in the event of change, for example, if we change which third party we are sharing personal data with. We will publish the most up to date information on this page. Privacy considerations may vary according to the different purposes. If you are not sure which purposes apply to you, please contact us.

We are currently updating our international transfer arrangements. Please see the Information Commissioner's Office website for more information on international transfers following Brexit.

We process personal data for many of our functions. For example:

• Works in our collections may contain personal data

• We process some personal data when you register as a Library user

• We process personal data when you purchase from us online or register to attend an event with us

In our privacy notices we split these rights into two categories; three core rights which normally apply to all processing activities, and four additional rights which only apply in specific circumstances depending on the lawful basis for us processing your data. These lawful bases are defined in the legal basis for processing data section. Our privacy notices detail all of your rights in relation to each specific data processing activity undertaken by the Library.

Your core rights

Subject to relevant conditions, the core rights normally apply to all data processing activities we undertake.

The right of access

You have the right to know whether we are processing any of your personal data. If we are, you have the right to access the data and certain information, such as why we are processing the data.

The right of rectification

You have the right to ensure that we correct inaccuracies in your personal data that we are processing.

The right to restrict processing

In certain situations you have the right to ensure that we restrict our processing of your personal data. For example, if you contest the accuracy of the data, you may request that we restrict our processing of that data while we verify its accuracy.

Your additional rights

Your additional rights, which apply under specific circumstances.

The right to withdraw consent

You have the right at any time to withdraw your consent for us to process your personal data. This right only applies in situations where our processing of your personal data is based on your explicit consent (for example, this right does not apply in situations where we are processing your personal data in accordance with a task carried out in the public interest).

The right of erasure (the 'right to be forgotten')

In certain situations you have the right to ensure that we erase your personal data. For example, you may request that we erase your personal data if it is no longer necessary in relation to the purpose for which it was collected or processed.

The right of data portability

In certain situations you have the right to receive personal data that you provided to us in a structured, commonly used, and machine-readable format.

The right to object

In certain situations you have the right to object to our processing of your personal data and we are normally obliged to stop processing your data when requested. This right includes the right to object to our processing of your personal data for the purposes of profiling and direct marketing, as well as for research in some cases.

Contact our Data Protection Officer to exercise your rights in relation to your personal data.

For further information about your core and additional rights see the guidance from the UK Information Commissioner's Office.

We must have a lawful basis for processing your personal data, as set out in the General Data Protection Regulation. There are six available lawful bases for processing, at least one of which must apply.

• Consent: you have given clear consent for us to process your personal data for a specific purpose.

• Contract: the processing is necessary for a contract you have with us, or you have asked us to take steps before entering into a contract

• Legal obligation: the processing is necessary for us to comply with the law.

• Vital interests: the processing is necessary to protect someone’s life.

• Public task: the processing is necessary for us to perform a task in the public interest or for our official functions.

• Legitimate interests: the processing is necessary for our legitimate interests.

For further information about the lawful bases see the guidance from the UK Information Commissioner's Office.

You can read the Library's Data Protection Policy (Word document) (148 KB; 34 pages) — December 2024.

How to complain

You can use our complaints procedure to make a complaint about data protection. You may also contact the Data Protection Officer using the contact details below. You have the right to make a complaint directly to the UK Information Commissioner's Office (ICO), which is the data protection supervisory authority in the UK.

If you wish, you do not need to make a complaint to us before making a complaint to the ICO; you may make an initial complaint directly to the ICO.

Contact our Data Protection Officer

To contact our Data Protection Officer:

Email: privacy@nls.uk

Write to:
Data Protection Officer
National Library of Scotland
George IV Bridge
Edinburgh
EH1 1EW
Scotland, UK

Telephone: +44(0)131 623 3700