1. What is the SLS?

The Scottish Longitudinal Study (SLS) is a large set of information about some individuals over time which allows researchers to explore questions relating to Scottish people.  

The SLS includes information about 5% of the Scottish population. SLS members are people who have a birthday on one of the 20 dates of birth which were used to create the SLS. The dates are secret so very few people know who is included. 

If you lived in the same household as an SLS member on a Census date your information will also be included in the SLS. The SLS is updated with new SLS members who are added if they have a birthday on one of those 20 dates and are born in, or move to, Scotland. 

The SLS contains pseudonymised information from the Scottish Censuses (1991,2001 and 2011) which has been linked to administrative data from other existing sources such as births, deaths and marriages, and health and education records. Names are removed but there is enough detail to identify individuals. This means that this is personal data. A full list of categories of data is given below. 

We keep the SLS very secure and only allow approved researchers to use it.  

You cannot object to the processing of personal data in SLS or find out if you are included. We are allowed to do this because it is necessary for research in the public interest. 

Data will be kept in the SLS indefinitely. We will only supply the minimum SLS data needed for each approved research project. 

2. Why are we using the data?

The SLS is a valuable way for researchers to find out more about the people of Scotland and the things that affect our health, neighbourhoods and daily lives. By using a very large sample of people of all ages and from all communities, researchers can be more certain that the results they find will apply to everyone in Scotland. Information is linked across time which helps to show patterns, for example how moving to a large city affects our health. 

Most SLS users are academic researchers who use the data within the SLS to answer specific research questions, but Scottish Government departments may also use the data to help build evidence for policies.  

The University of Edinburgh and NRS have carried out a Data Protection Impact Assessment for the sharing and processing of SLS data (available upon request). 

A link to examples of current projects which are using SLS data can be found in Annex C in the pdf version of this privacy notice: NRS – Data Protection – Scottish Longitudinal Study – Privacy Notice – 2025 (PDF 448 KB)

3. Where does SLS data come from? 

Currently the SLS includes data from the following sources: 

• Scotland’s Census 
• Statutory Registers of Births, Deaths and Marriages
• NHS Central Register
• Scottish Mental Survey 1947
• Scottish Government Education Data
• Scottish Qualifications Authority
• Scottish Index of Multiple Deprivation (SIMD)
• Department for Environment Food and Rural Affairs (DEFRA)
• Met Office 

More details on the categories of the data and its sources are provided under Annex B, which can be viewed in the pdf version of this privacy notice: NRS – Data Protection – Scottish Longitudinal Study – Privacy Notice – 2025 (PDF 448 KB).

4. Who are we?

The SLS is a University of Edinburgh project supported by National Records of Scotland (NRS).  

The University of Edinburgh and NRS act as joint data controllers of the data. This means that we jointly make decisions about how the data can be processed.  

The data controller of the University of Edinburgh is the University Court. They can be contacted via the University of Edinburgh Data Protection Officer, whose address is at the end of this notice.  

The data controller of NRS is the Registrar General for Scotland. They can be contacted via the NRS Data Protection Officer, whose address is at the end of this notice.  

The SLS steering committee is responsible for data protection, confidentiality and security issues for the Scottish Longitudinal Study and includes representatives from the Longitudinal Study Centre Scotland (LSCS), the National Records of Scotland, the Office for National Statistics, the National Health Service Central Register, the Information Statistics Division of the NHS and the Education Department of the Scottish Government. 

5. What is our lawful basis for processing personal data for the SLS? 

The lawful basis for the University of Edinburgh and NRS to process SLS data is:  

UK GDPR Article 6(1)(e): “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.” 

The basis in law for the University of Edinburgh’s public task is the Universities (Scotland) Act 1966.  

The basis in law for NRS’s public task is provided by the Census Act 1920, the Registration of Births, Deaths and Marriages (Scotland) Act 1965, and the Local Electoral and Registration Services (Scotland) Act 2006. 

Our condition for processing special category data is: 

UK GDPR Article 9(2)(j): “processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes in accordance with Article 89(1) based on domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.” 

The requirement for a basis in domestic law is provided by the Data Protection Act 2018 Schedule 1 Part 1 Paragraph 4: “This condition is met if the processing — 

(a) is necessary for archiving purposes, scientific or historical research purposes or statistical purposes, 

(b) is carried out in accordance with Article 89(1) of the GDPR (as supplemented by section 19), and 

(c) is in the public interest.” 

by Schedule 1, Part 1, Condition 4 of the Data Protection Act 2018. 

Any proposed research project wanting to use information from SLS must get approval from the SLS Research Board. Additionally, if the researchers want to link NHS health data to the SLS, they must obtain additional approval from the Health and Social Care-Public Benefit and Privacy Panel (HSC-PBPP). 

We will only supply the minimum necessary SLS data needed and approved for the research project. 

6. Where is the data stored and accessed from?

The SLS data is stored securely on a University of Edinburgh server within an NRS location in the UK. All processing for creating and maintaining the SLS takes place within the UK.   

SLS staff will be able to access SLS remotely and securely from an approved institutional device and VPN.  

Researchers will be able to access from a safe setting within NRS Offices, the Edinburgh Parallel Computing Centre (EPCC), and the Scottish National Safe Haven.  

We have organisational and technical measures in place to protect the data. For more information see the SLS Data Protection Impact Assessment (available on request).  

SLS data that may identify an individual is not allowed to be made publicly available. Only aggregated SLS data will appear in the public domain. 

7. How long do we keep data? 

SLS Data 

The SLS dataset will be maintained indefinitely as a resource for research purposes. 

 SLS Research project datasets 

At the start of each research project using data from SLS a set end date for analysis is agreed between the researchers and the joint data controllers of the SLS. On this end date no-one will be able to access the research project SLS dataset and all access will be denied.  The research project SLS dataset is archived for a period of 5 years. At the end of the archive retention period the research project SLS dataset is securely and confidentially destroyed. 

Researchers can apply to extend the end date of their project before or after the original end date but not after the archival period has lapsed. This is subject to appropriate review and governance. The dataset will always have specified end / destruction dates re-applied as part of this process and continuous extension will not be permitted.  

Other Personal Information we collect 

• Researchers (including information about their Research Team) 

Personal information collected from Researchers or their Supervisors during the SLS application process, publication request process and correspondence will be securely deleted after 5 years of the project end date.  

Data will not be disclosed without lawful authority. 

• Personal Information collected from SLS/DSU Staff members 

Data will not be disclosed without lawful authority. 

8. What are your data protection rights? 

Data protection law grants individuals certain rights. The rights that apply to the SLS data we process are: 

• the right to be informed;  

• the right to lodge a complaint with the Information Commissioner’s Office.  

 Other rights, however, do not apply where personal data is processed for scientific or historical research purposes or statistical purposes and where responding to these rights would prevent the research or statistical purpose from being achieved. The University of Edinburgh and NRS agree that the following rights do not apply to SLS dataset (and research projects of SLS data): 

X Right to access your personal data; 

X Right to rectification 

X Right to have your data erased 

X Right to restrict what can be done with your data 

X Right to data portability 

X Right to object to the use of your data 

X Rights in relation to automated decision making (no automated decision making occurs) 

No automated decision-making or profiling takes place. 

To exercise your rights you should contact the University of Edinburgh or NRS Data Protection Officers.  

• University of Edinburgh Data Protection Officer 

Email Address: dpo@ed.ac.uk 

Address: 

Data Protection Officer 

Governance and Strategic Planning 

University of Edinburgh 

Old College 

Edinburgh 

EH8 9YL 

Phone Number: 0131 651 4114 

• NRS Data Protection Officer  

Email Address: dataprotection@nrscotland.gov.uk 

Address: 

Data Protection Officer, 

National Records of Scotland , 

HM General Register House, 

2 Princes Street, 

Edinburgh, 

EH1 3YY 

9. Complaints or queries about our use of personal information 

If you have any concerns about our compliance with data protection law please contact our Data Protection Officers. They will look into your concerns and provide a response.  

If you are not satisfied with their response you  also have the right to report your concerns to the Information Commissioner’s Office (ICO). For more information visit the ICO website: https://ico.org.uk/concerns/ 

10. Changes to this privacy notice 

We keep our privacy notice under regular review to make sure it is up to date and accurate. This privacy notice was last updated in March 2025.   

Further Information in relation to how we manage our interactions with you

• Email & Forms

We email you from a secure device via Outlook 365, including SharePoint.

When you contact us via the SLS, LSCS, CALLS or Digitising Scotland websites your email is directed to us via a web hosting company, MTC Ltd, Shed 26, Unit 35, City Quay, Dundee, UK DD1 3JA.   MTC Ltd servers are located in the Centro data centre in London.  When you press send, your message and contact details will be sent directly to the administrator at SLS. Your personal data will not be stored on the website server; will not be shared with others outside of SLS; will only be used for the purpose of communicating with you in response to your email and any future communications in relation to SLS. Further information on MTC can be found here

• Project Applications & Forms

The information you provide in all project documentation is used for administering your project and for the reasons of meeting our contractual agreement with you in providing the necessary information for you to carry out your SLS research.  In addition, your personal data is used  to meet our contractual agreements with the National Records of Scotland.  All forms are stored electronically on the University of Edinburgh’s Server (Microscoft European servers), the National Records of Scotland/Scottish Government server.  A copy is also stored in the Project Log on the non-internet connected SLS network with restricted access to key members of SLS staff as well as our secure Trello site. SLS staff will be able to access SLS remotely and securely from an approved institutional device and VPN.

Your project application is electronically sent to the SLS Research Board via Outlook 365.  The members of the Research Board view your application on their secure institutional devices and destroy the application after submitting their comments.   On signing our Census Confidentiality Form, the signed tear-off slip is mailed internally by the SLS NRS PM to an individual in NRS to be logged on to the NRS system.

All your project documentation will be retained by the Longitudinal Studies Centre for Scotland, SLS-DSU for a period of 5 years from the project end date, in case you or your research team wish to undertake further analysis, after which time they will be securely destroyed.

• SLS Newsletter

As a SLS Researcher you are added to the SLS newsletter.  The newsletter is circulated via Outlook 365, a maximum of 5 times per year.  The newsletter contains information regarding the SLS which may be of interest to you.  You can opt out of receiving the newsletter at any time.  The newsletter mailing list is stored in the University of Edinburgh secure mailing list system (mlist) on the University of Edinburgh servers.  You will remain on the mailing list until you unsubscribe.

• Projects & Outputs on the SLS Website

When your project proposal has been accepted as an SLS Project we will ask your consent (on the SLS Project Application Form) to list your project on the SLS website.  We will only list your name and institution and not your contact details. As you produce Stage 2 publication output from your research, you will indicate whether the output should be visible on the SLS website and you will supply us with a date when the output can be made live.  The information will remain on the website for the duration of the lifetime of the SLS website.