The UK has four legal systems’ worth of devolution settlements, but information law only splits in one place, and it splits in opposite directions depending on which half of information law you are in. Getting this wrong is the commonest structural error in UK writing on the subject: people assume Scotland has its own data protection law because it has its own FOI law, or assume FOI works the same everywhere because data protection does.
Data protection: reserved, so one regime
Data protection is a reserved matterReserved matterA subject kept by the UK Parliament rather than devolved. Data protection is reserved, which is why the UK has one data protection regime. under the devolution statutes (the Scotland Act 1998, the Government of Wales Act 2006 and the Northern Ireland Act 1998). Only the UK Parliament legislates on it. The result is a single regime for the whole UK:
- the UK GDPR, read with the Data Protection Act 2018;
- PECR 2003 for electronic marketing, cookies and communications security;
- one regulator, the Information Commission, for the whole UK.
There are no Scottish, Welsh or Northern Irish data protection entries on this site because there is no such law to profile. The site records the UK as fully unified for data protection.
Where the exemptions differ by nation
The law is the same across the UK, but a handful of exemptions in the DPA 2018 treat the nations differently, because they hook onto family, education and children’s hearings law that is itself devolved:
- The child abuse data exemption (Sch 3 para 21), which lets a controllerControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties. refuse a parent’s access request that would not be in the child’s best interests, applies in England, Wales and Northern Ireland but cannot apply in Scotland.
- The Principal Reporter restrictions on social work and education data (Sch 3 paras 12 and 20) and the children’s hearings exemption (Sch 4 para 6) apply only in Scotland.
- A parent can make a request for a child under 18 in England, Wales and Northern Ireland, but under 16 in Scotland (Sch 3 paras 4 and 10).
These are narrow and specific, recorded on the DPA 2018 checklist. They are not evidence of a devolved data protection regime.
What is not devolved, but still differs
Some machinery around data protection does vary by nation without the law varying:
- Criminal prosecution. The regulator prosecutes DPA 2018 offences in England, Wales and Northern Ireland. In Scotland, prosecution is a matter for the Crown Office and Procurator Fiscal Service.
- Civil courts. A compensation claim under Art 82 UK GDPR and s.168 DPA 2018 goes to the County Court or High Court in England and Wales, and to the sheriff court or Court of Session in Scotland.
Same law, different forum. When a procedure step depends on a court or a prosecutor, the nation matters even though the regime does not.
Freedom of information: devolved in Scotland, so two regimes
Freedom of information runs the other way. The Scottish Parliament has legislated for Scottish public authorities:
| England, Wales, Northern Ireland, UK-wide bodies | Scottish public authorities | |
|---|---|---|
| General access | Freedom of Information Act 2000 | Freedom of Information (Scotland) Act 2002 |
| Environmental informationEnvironmental informationInformation about the state of the environment and things affecting it. Requests for it go through the environmental information regulations, not the FOI Acts. | Environmental Information Regulations 2004 | Environmental Information (Scotland) Regulations 2004 |
| Regulator | Information CommissionInformation CommissionThe UK data protection and FOI regulator. A board-led body that succeeded the Information Commissioner (the ICO) on 2026-09-30, with the same role and powers. | Scottish Information Commissioner |
Two points trip people up.
Which Act applies depends on the authority, not the requester or the location. A UK-wide public authority operating in Scotland stays under FOIA 2000. A Scottish public authority is under FOISA 2002 even if the requester lives in London.
The two Acts are related but not the same. They share a structure (a general right of access, exemptions, a public interest testPublic interest testIn FOI law, the test applied to qualified exemptions: information is withheld only if the public interest in withholding it outweighs the public interest in disclosure. for qualified exemptions, internal review, then the regulator), but their exemptions, time limits and procedure differ in detail. A response template written for one should not be used for the other without checking each step. The specific divergences are recorded on the instrument pages: the clearest is that FOISA 2002 gives no extension for considering the public interest, so the test must be done within the 20 working days, where FOIA 2000 s.10(3) allows a reasonable extension.
Where the two halves meet
The halves meet when an FOI request asks for personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out.. Personal data about the requester is not an FOI matter at all: it is routed to the subject access regime. Personal data about someone else is handled through the FOI personal information exemption, which applies data protection principles. So a Scottish council answering an FOI request for third-party personal data applies FOISA 2002 for the request and UK-wide data protection law for the personal data question, under two different regulators.
How the site models this
- One jurisdiction record, the UK, with data protection recorded as fully unified.
- Every instrument carries a
regime(data protection, electronic communications, freedom of information or environmental information) and anextent, so the FOI split shows up as regime-level variation inside the UK record rather than as a separate country. - Procedures are written per regime. The Scottish FOI and EIR procedure is its own page rather than a variant of the FOIA one.