Data Protection

Introduction

Clyde Valley Housing Association is committed to transparency and the responsible handling of personal data. We comply with the UK General Data Protection Regulation (UK GDPR), the Freedom of Information (Scotland) Act 2002 (FOISA), and the Environmental Information (Scotland) Regulations 2004 (EIR).

These regulations provide individuals with rights to access both personal and organisational information. Under FOISA and EIR, members of the public may request certain types of information relating to our housing services. Under UK GDPR, individuals may request access to personal data held about them through a Subject Access Request (SAR).

This page outlines our responsibilities under these regulations, the types of information covered, and how to make a valid request.

Freedom of Information (FOI) and Environmental Information (EIR)

Why We Are Subject to FOISA and EIR

Clyde Valley Housing Association is subject to FOISA and EIR under the Freedom of Information (Scotland) Act 2002 (Designation of Persons as Scottish Public Authorities) Order 2019. This Order came into effect on 11 November 2019 and applies to all Registered Social Landlords (RSLs) and certain RSL subsidiaries.

What Is Covered by FOISA and EIR

Not all activities carried out by Clyde Valley Housing Association fall under FOISA and EIR. These regulations apply specifically to certain housing-related functions, as defined in section 165 of the Housing (Scotland) Act 2010. The following services are covered:

Prevention and alleviation of homelessness
Management of social housing accommodation
Provision of information to the Scottish Housing Regulator (SHR) by an RSL or connected body regarding financial wellbeing and governance standards

Understanding the Difference Between FOISA and EIR

EIR provides access to Environmental Information, which is broadly defined in the regulations. If a request under FOISA relates to Environmental Information, it will be processed under EIR.

Although FOISA and EIR share similarities, there are important differences in how requests are handled. Further guidance is available from the Scottish Information Commissioner.

Making a Freedom of Information Request

To make a valid FOI request, the following criteria must be met:

The request must be in writing. This can be submitted via letter, email, our website, or social media.
The requester must provide their real name. Requests made on behalf of another person, such as by a solicitor, must include a signed mandate.
An address for correspondence must be included. This can be a postal or email address.
The request must describe the information being sought. Any genuine attempt to describe the information will be accepted.

Clyde Valley Group has adopted the Model Publication Scheme approved by the Scottish Information Commissioner. You can view:

The Scheme can also be viewed in Publication Scheme Resources at the Scottish Information Commissioner website.

This online form will be available again on Tuesday 7 April 2026.

UK General Data Protection Regulation (UK GDPR)

The UK GDPR came into effect on 25 May 2018 and governs how personal data is collected, stored, and used. Clyde Valley Housing Association adheres to the following principles:

We only collect information required for a specific purpose
We keep personal data secure
We ensure data is accurate and up to date
We retain only the data we need, and only for as long as necessary
We allow individuals to access their personal data upon request

Your Rights Under UK GDPR

Under UK GDPR, you have the following rights:

The right to be informed
The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision-making and profiling

You can view our policies and notices below:

File Description	File
Data Protection Policy
Freedom of Information Policy
Guide To Information
Model Publication Scheme - updated 26 March 2021
Privacy Notice - Owners
Privacy Notice - Tenants

Subject Access Requests (SAR)

If you wish to access personal data held about you, you may submit a Subject Access Request. Under UK GDPR, you are entitled to:

Receive a copy of your personal data
Understand how your data is being processed
Know how long your data will be retained
Request rectification, erasure, or restriction of processing

We aim to respond within one calendar month from:

The date we receive your written request
Or the date we receive any additional information required to process your request

The information you provide in the SAR form will be used solely to identify the personal data you are requesting and to respond to your request. You are not required to complete the form, but doing so may help us process your request more efficiently.

This online form will be available again on Tuesday 7 April 2026.