Frequently Asked Questions

The Scottish Biometrics Commissioner ensures that Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner adopt lawful, effective and ethical practices to safeguard how biometric data is acquired, retained, used and destroyed for policing and criminal justice purposes

Yes – the Commissioner is independent of the Scottish Government and the Scottish Parliament. As a values-led organisation we conduct our activities in a way that is Independent, Transparent, Proportionate and Accountable 

Funding is through the Scottish Parliamentary Corporate Body (SPCB). The Scottish Biometrics Commissioner Act 2020 provides for the SPCB to pay the salary and expenses of the Commissioner, and any expenses incurred in the exercise of the Commissioner’s function. Each year the SBC submit an estimated bid for funding to the SPCB. Further information can be found within our Annual Report & Accounts, our Strategic Plan or within our Medium-Term Financial Strategy

• Police Scotland
• Scottish Police Authority
• Police Investigations and Review Commissioner

The Commissioner has the power to ensure that biometric data is used in a lawful, effective and ethical manner in relation to policing and criminal justice. Compliance against the statutory Code of Practice is measured by conducting assurance reviews of biometric practices carried out by Police Scotland, the Scottish Police Authority and the Police Investigation and Review Commissioner. The Commissioner investigates complaints and potential breaches of the Code of Practice and has the power to serve compliance notices

The Commissioner is nominated by the Scottish Parliament and appointed by the monarch, for a period of no more than eight years.

The Commissioner’s terms of appointment are in Schedule 1 of the Scottish Biometrics Commissioner Act 2020.

The Commissioner’s independence on decision-making and key statutory functions is an important aspect of their role and guaranteed by statute. They remain accountable to the Scottish Parliament for operations generally and are subject to many of the accountability structures that apply to Scottish public authorities.

The SBC has no punitive powers

The SBC enjoys a blend of staff drawn from police and non-police backgrounds. Find out more about who we are and meet the team

The assurance reviews are based on strategic objectives and priorities as laid out in the 4-Year Strategic Plan 2025/29

When a report is laid at Parliament, this means it will be published on our website and made available to the public. The dates of all our forthcoming reports can be found within our Strategic Plan 2025/29

Put simply, Biometrics are a way to measure a person’s physical, biological, physiological or behavioural characteristics to establish or verify their identity.

The main biometric data types used regularly in Scotland at present for policing and criminal justice purposes are Fingerprints, DNA and Photographic images.

Biometrics are taken to confirm your identity, for use as evidence if you have committed a criminal offence or to help eliminate you from an investigation.

The Police Scotland website provides further information on what samples may be taken and the reasons for taking them.

You may have a photograph of your face taken, a copy of your fingerprints, mouth swabs or hair samples taken to obtain your DNA profile

Your biometrics will be stored or destroyed depending on the circumstances. The Criminal Procedure (Scotland) Act 1995 and Criminal Justice (Scotland) Act 20023 control how Police Scotland gather, use, share and destroy biometric data. The Scottish Police Authority – Forensic Services (SPA FS) process samples and retain biometric data on behalf of Police Scotland.

The retention period is dependent on the police investigation and/or court proceedings and the nature of the offence. Further details can be found on the Police Scotland website and within the Record Retention Standard Operating Procedure.

You may also find it useful to read the Scottish Government and Scottish Biometrics Commissioner’s joint report on biometric data retention.

You can request deletion, but eligibility will depend on the criteria for which it was taken. You can contact Police Scotland via a Subject Access Request (SAR) to establish what is held and whether you can request its destruction.

You can apply to withdraw consent at any time for biometric samples provided with consent under Section 56 of the Criminal Justice (Scotland) Act 2003.

No, the Commissioner deals only with biometrics for policing and criminal justice purposes by Police Scotland, the Scottish Police Authority and the Police Investigations and Review Commissioner

No, the Commissioner’s functions do not extend to this technology. There is currently no oversight of public space CCTV surveillance in Scotland

The Commissioner’s blog in June 2025 explains why he would support its use in certain circumstances.

At the Scottish Police Authority Board meeting of August 2025, Police Scotland confirmed they have taken the decision to move ahead with the future use of live facial recognition.

As this area develops, you may find further information on our News page.

You can complain about the SBC, including:

• our standard of service
• dissatisfaction with our policy
• our failure to follow proper procedure
• treatment, by, or attitude of a member of staff

You can also complain to the SBC if you think that Police Scotland, the Scottish Police Authority or the Police Investigations and Review Commissioner have not followed the Code of Practice for the acquisition, use, retention and destruction of your biometric data

If you’re complaining in relation to your biometric data, please first read our complaints procedure and this will guide you through the process.

We would also suggest you contact Police Scotland or the Scottish Police Authority or the Police Investigations and Review Commissioner in the first instance to afford them the opportunity to resolve or explain the matter.

To complain about the SBC – please submit a complaints form.

You can complain in person at our office, by phone, in writing, by email or by submitting our online complaints form.

The complaints form will ask for your details, who you are complaining about, the basis for your complaint and what resolution you are seeking

For complaints against the Code of Practice, the Operations Manager will investigate the complaint, and the findings will be considered by the Commissioner who will determine whether the Code has been breached.

Complaints against the SBC, will be investigated by the Corporate Services Manager and taken to the Commissioner for any further action.

Typically, you have three years to make a complaint, starting either from when the event occurred or from when you first became aware of it.

Please note that the Code of Practice came into effect on 16 November 2022 and we cannot consider complaints for events prior to this date.

No, as this a formal procedure we require your personal details. We need this information about you and the organisation you are complaining about to progress with the investigation.

If your complaint is against the SBC, you CAN apply anonymously.

Yes, it is confidential. Whilst your complaint will be logged on the Disclosure Log which may be viewed on the SBC website, it will be anonymised, and your personal details will not be made public

Yes – you can give consent to a representative to make the complaint on your behalf by filling out the appropriate consent form

Code of Practice complaints:

We aim to complete our investigation in 30 working days.

Complaints against the SBC:

This investigation is a two-stage process. We aim to resolve Stage 1 within 5 working days and Stage 2 where possible within 20 working days. The complaints handling procedure explains further.

If a breach of the Code of Practice is established the Commissioner will publish their findings in a report (unless of a minor nature). A compliance notice may be served on the body concerned

Complaint against the Code of Practice:

If you are unsatisfied with the outcome, you can request a meeting with the Commissioner who will explain their findings and discuss your concerns. If you remain unsatisfied you may wish to seek legal advice.

Complaint against the SBC:

If you are unsatisfied with the outcome, you may be able to have it reviewed by the Scottish Public Services Ombudsman (SPSO) complaints handling process.

You can make a request by contacting us by telephone, email or in writing, or via the online form

More information is available from the Scottish Information Commissioner

You can see what information is and is not available in our publication scheme along with any charges that me be applied and how to request information that has not been published

The Disclosure Log on our website holds anonymised versions of all FOI responses in our commitment to openness and transparency

Our Privacy Notice explains the types of personal data we may collect about you and how we will use, store and protect it. In doing this we will comply with data protection law

We aim to acknowledge your request within 5 working days and provide a response within 20 working days

You can ask for us to review our response and if you remain unhappy you can appeal via the Scottish Information Commissioner

We try to make our website and documents easy to use. However, if you cannot access an area or experience a problem, please feedback with this form.

We will also always ensure that reasonable adjustments are made to help people with an interest in our function and can arrange for information in another language or format, or Braille. Please contact us to request this.

Yes, you can give consent for others to act on your behalf e.g. a friend or relative. Please see the ‘Complaints – FAQs’ section above.

We will also always ensure that reasonable adjustments are made to help people with an interest in our function and can arrange for information in another language or format, or Braille. Please contact us to request this.

You may also wish to consider contacting Citizens Advice Scotland, the Law Society of Scotland or the Scottish Independent Advocacy Alliance for additional support.

You may wish to consult your local Citizens Advice Bureau or a solicitor about any further action which may be available

Please refer to the ‘contact us’ section below and where possible we will accommodate your request

You can reach us by telephone, email or in writing, or via the online form. We also have an office in Edinburgh although as we operate hybrid working, staff predominantly work from home – however, any letters or messages will be passed to us by the Bridgeside House reception desk.

• Bridgeside House, 99 McDonald Road, Edinburgh, EH7 4NS
• 0131 202 1043
• contact@biometricscommissioner.scot

Monday to Friday 9am – 5pm

• Police Scotland: Biometrics - Police Scotland
• Scottish Police Authority: Forensic Services - Scottish Police Authority
• Police Investigation and Review Commissioner: Police Investigation & Review Commissioner
• Scottish Information Commissioner: Scottish Information Commissioner
• Scottish Public Services Ombudsman: SPSO information
• Scottish Public Services Ombudsman: Complaints Handling Principles