Back to Reason for contacting us

Authorisation under the Environmental Authorisation (Scotland) Regulations (EASR)

Purpose and lawful basis for processing

SEPA have a Statutory Purpose as Scotland’s independent environmental regulator. Our purpose for collecting your personal data is to determine whether to grant a new authorisation, or a variation, transfer or surrender of an existing authorisation for a regulated activity under the Environmental Authorisations (Scotland) Regulations 2018 (EASR).

The lawful basis we rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to perform our public tasks as a regulator.

What we need

The personal information we collect and use, may include the following:

• Name

• Home address including postcode

• Business address including postcode

• Email address

• Telephone number

• Date of birth

• Signature

• Details of unspent criminal convictions

SEPA collects dates of birth and home addresses to verify an individual’s identity. This requirement applies consistently to all individuals associated with all permit level applications and registration level applications (except for private sewage treatment systems), including directors and company secretaries of limited companies. These are necessary and lawful purposes under the UK GDPR and the Data Protection Act 2018.

Unfortunately, if applications do not contain the necessary detail, as outlined, SEPA cannot progress them. Please ensure that applications contain all necessary information to allow us to provide the best possible service to you.

SEPA are unable to accept password protected applications or supporting documents as all information contained in the documents is handled as per the “Do we share your information?” section below.

Unfortunately, if applications contain password protected documentation, SEPA cannot progress them. Please ensure that applications contain all necessary information to allow us to provide the best possible service to you.

Your responsibility with other people's personal data

If you’ve included personal data about other people or will provide documents submitted by third party organisations with your application, you must tell them.  You must provide them with a copy of this Privacy Notice, so that they know how their personal data will be used.

Why we need it

Under Environmental Authorisations (Scotland) Regulations 2018 SEPA must not grant an authorisation (Registration and Permit) if we consider the applicant is not a fit and proper person to be in control of the activity.

We therefore need to collect personal information to undertake background checks to assess whether the applicant who has, or will have, control of the regulated activity meets the Fit and Proper Person criteria.

To determine if an applicant is fit and proper, we need to first verify the individual’s identity and undertake background checks. 

This will include additional persons named in the application, who may be partners, and directors and company secretaries of registered companies. The following types of applicants are required to provide home address and date of birth of individuals: 

• individuals 

• sole traders 

• partnerships, in respect of all individuals who are partners or members

• registered companies, in respect of all individual company directors and secretaries

• incorporated association/organisations, in respect of all individual trustees

• unincorporated association/trusts – in respect of all current office bearers or trustees

 

We also need to collect the name and contact details of the person we should contact about charges and where to send invoices.

What we do with it

Some of the ways that we collect and use the information may be through:

• Undertaking a fit and proper person test.
• Determining your application.
• Granting and administering authorisations.
• Maintaining registers for public inspection.
• Publication of information and documents on our website.
• Investigating environmental complaints.
• Undertaking formal enforcement action.
• Maintaining our own accounts and records.

How long we keep it

We keep your personal data while your authorisation is in use and for 6 years after you cancel (surrender) your authorisation, depending on your authorisation.  If the authorisation is for a landfill site, we keep the data for 10 years after surrender. Thereafter, your data will be confidentially destroyed.

What are your rights

You have the right to object to our processing of your personal data. SEPA will consider the objection, and in some cases SEPA, is entitled to refuse your objection. This will be in circumstances where we have a legitimate reason for processing your personal data.

For more information on your rights, please see ‘Your rights as an individual’. 

Do we use data processors?

No

Do we share your information?

SEPA are required by law to organise and maintain registers and make these available for public inspection. We do this by collecting and using the information that applicants (or their agents) share in their application forms and on SEPA’s online application system. Personal information is recorded on the generic application forms APP-GEN1, APP-GEN2 and APP-GEN3.  

After the application has been accepted for determination, documents and information from the application is added to the register and becomes available for public inspection on request.  SEPA will also publish some of the data and documents received on our "Search the register" web pages.  The generic application form(s) submitted will not be published as they contain personal details, however, can be requested where personal email addresses, home addresses, telephone numbers and dates of birth will be redacted before provision unless there is a legal basis for providing them.

Any information contained in the application form(s) and/or supporting documentation that contains sensitive or confidential information will be placed on the register but will not be published. This information can be requested but appropriate redaction will be completed prior to release. All commercial confidentiality & national security information will be treated as per the Commercial Confidentiality & National Security statement below.

Information contained in third party documents will be placed on the register as received including names and signatures.  If any of these items require to be published, personal information will be redacted prior to publication or release unless there is a legal basis for providing them.

There may be occasions when we are required by law to share your personal information with other organisations or partner agencies, e.g. for regulatory reasons, to undertake fit and proper person checks, or because doing so is in the general public interest. Any sharing will be carried out lawfully and securely in accordance with the SEPA Data Protection Policy

Removing personal data from the register

We will remove your personal data from the register if:

• You withdraw your application
• We refuse your application and the time limit for appealing the decision has expired or an appeal is dismissed

Commercial Confidentiality & National Security statement

We are obliged to compile and maintain registers as part of our statutory duties.  Information provided by applicants for EASR authorisations will be included on the register.

You have the right to apply at any time for your information to be excluded from the register on the grounds of commercial confidentiality or national security.  

Information that the Secretary of State or Scottish Ministers has directed may affect national security will not be included on the register.  If you believe information in your application may affect national security, but there is no direction, you should notify the Secretary of State or Scottish Ministers of your concern.

We may consider information commercially confidential if you can demonstrate it would harm your business’s competitive position. If we do not determine information to be commercially confidential, you can appeal this decision with Scottish Ministers.

Any information excluded from the register on the grounds of commercial confidentiality ceases to be commercially confidential four years after the date of determination and will be placed on the register.  You can apply to SEPA to extend the period of exclusion.

Last updated: 27 July 2026