What happens to your data after a phone examination in Scotland

Police Scotland’s own cyber kiosks page states that “all information is securely deleted from the cyber kiosk at the end of each examination.” That statement is about the kiosk itself — the quick, on-the-spot triage device covered on the previous page. It is not a statement about a fuller extraction sent on to a digital forensics lab, which is a separate process with its own rules, covered below.

Once information has been extracted rather than deleted, Part 3 of the Data Protection Act 2018 — the UK-wide regime governing police use of personal data for law enforcement purposes — applies whether the device was examined in Glasgow or London. Under the Act, that processing “must be lawful and fair”; the data extracted must be “adequate, relevant and not excessive in relation to the purpose for which it is processed”; and it must be “kept for no longer than is necessary for the purpose for which it is processed.”

Separately, the statutory Code of Practice issued under the Police, Crime, Sentencing and Courts Act 2022 sets a specific rule for information extracted under its power: paragraph 138 states that “information which is extracted and deemed not relevant must be deleted unless there is a lawful basis to retain it.” That Code applies UK-wide, Scotland included.

None of the sources above sets a fixed retention period in days, months or years. The Data Protection Act’s fifth principle requires data to be kept “no longer than is necessary” without saying what that is in practice; the PCSC Code requires deletion of anything “deemed not relevant” without saying who makes that assessment or how it is checked; and Police Scotland’s cyber kiosks page addresses only the kiosk itself, not what happens to material sent on for a fuller extraction. If you are looking for a fixed number of days, none of the authorities cited on this page give you one.

For the equivalent position in England and Wales — including how the same PCSC Code and Data Protection Act provisions apply there — see retention and deletion.