Back to Reason for contacting us

Apply for an Authorisation under the Environmental Authorisation (Scotland) Regulations

Purpose and lawful basis for processing

SEPA have a Statutory Purpose as Scotland’s independent environmental regulator. Our purpose for collecting your personal data is to determine whether to grant a new authorisation, or a variation, transfer or surrender of an existing authorisation for a regulated activity under the Environmental Authorisations (Scotland) Regulations 2018 (EASR).

The lawful basis we rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to perform our public tasks as a regulator.

What we need

The personal information we collect and use, may include the following:

• Name
• Address including postcode
• Email address
• Telephone number
• Date of birth
• Signature

Your responsibility with other people's personal data

If you’ve included personal data about other people or will provide documents submitted by third party organisations with your application, you must tell them.  You must provide them with a copy of this Privacy Notice, so that they know how their personal data will be used.

Why we need it

We need to collect personal information in order to verify:

• The name and contact details of the applicant, or person applying on behalf of the applicant.
• The applicant is authorised to request a variation or surrender of a regulated activity.
• The applicant is a fit and proper person who has, or will have, control of the regulated activity.
• The name and contact details of person we should contact about charges and where to send invoices.
• The name and contact details of all current directors and company secretaries.

What we do with it

Some of the ways that we collect and use the information may be through:

• Determining your application.
• Granting and administering authorisations.
• Maintaining registers for public inspection.
• Publication of information and documents on our website.
• Investigating environmental complaints.
• Undertaking formal enforcement action.
• Maintaining our own accounts and records.

How long we keep it

We keep your personal data while your authorisation is in use and for 6 years after you cancel (surrender) your authorisation, depending on your authorisation.  If the authorisation is for a landfill site, we keep the data for 10 years after surrender. Thereafter, your data will be confidentially destroyed.

What are your rights

You have the right to object to our processing of your personal data. SEPA will consider the objection, and in some cases SEPA is entitled to refuse your objection. This will be in circumstances where we have a legitimate reason for processing your personal data.

For more information on your rights, please see ‘Your rights as an individual’. 

Do we use data processors?

No

Do we share your information?

SEPA are required by law to organise and maintain registers and make these available for public inspection. We do this by collecting and using the information that applicants (or their agents) share in their application forms and on SEPA’s online application system. Personal information is recorded on the generic application form.  After the application has been accepted for determination, documents and information from the application is added to the register and becomes available for public inspection on request.  SEPA will also publish some of the data and documents received on our “Find authorisation information” and “Find an authorisation document” services.  The generic application form will not be published as it contains personal details, however, can be requested where personal email addresses, home addresses, telephone numbers and dates of birth will be redacted before provision unless there is a legal basis for providing them.

Information contained in third party documents will be placed on the register as received including names and signatures.  If any of these items require to be published, personal information will be redacted prior to publication or release unless there is a legal basis for providing them.

There may be occasions when we are required by law to share your personal information with other organisations, e.g. for regulatory reasons, or because doing so is in the general public interest. Any sharing will be carried out lawfully and securely in accordance with the SEPA Data Protection Policy

Removing personal data from the register

We will remove your personal data from the register if:

• You withdraw your application
• We refuse your application and the time limit for appealing the decision has expired or an appeal is dismissed

Commercial Confidentiality & National Security statement

We are obliged to compile and maintain registers as part of our statutory duties.  Information provided by applicants for EASR authorisations will be included on the register.

You have the right to apply at any time for your information to be excluded from the register on the grounds of commercial confidentiality or national security.  

Information that the Secretary of State or Scottish Ministers has directed may affect national security will not be included on the register.  If you believe information in your application may affect national security, but there is no direction, you should notify the Secretary of State or Scottish Ministers of your concern.

We may consider information commercially confidential if you can demonstrate it would harm your business’s competitive position. If we do not determine information to be commercially confidential, you can appeal this decision with Scottish Ministers.

Any information excluded from the register on the grounds of commercial confidentiality ceases to be commercially confidential four years after the date of determination and will be placed on the register.  You can apply to SEPA to extend the period of exclusion.