Scotland Heat Map: public sector data sharing agreement

Data security

The Recipient shall take proportionate technical and organisational security measures to protect the Heat Map Data including, but not limited to:

• the Heat Map Data will be held and backed up using a secure data management system that restricts access to recorded named users.
• the Information Asset Owner will ensure that only named users have access to the Heat Map Data. Named users must know, guarantee to maintain the security of data provided under this agreement. A list of these named users will be maintained and provided to the Scottish Government upon request by the Scottish Government.
• the physical and technical security of the Heat Map Data will be maintained at all times.
• the Scottish Government representative/responsible statistician must be informed immediately as to the nature of any security breaches and possible implications.
• Heat Map Data shall only be processed for the purposes outlined in the Purposes of the data share section of this agreement

It is the responsibility of signatories to ensure that staff members read and understand this agreement and are appropriately trained to handle and process the Heat Map Data in accordance with technical and organisational security measures together with any other applicable national data protection laws and guidance. The level, content and regularity of training shall be proportionate to the staff members' role, responsibility and frequency with respect to their handling and processing of the Heat Map Data.

This agreement allows your organisation to undertake analysis of the Heat Map Data using a third-party. Any commissioning of work must align to the Purposes outlined in the Purposes of the data share section. The Heat Map Data can be shared with the third-party, for periods of up to one year. The Heat Map Data can be shared for longer periods with written agreement (email) from the Scottish Government responsible statistician. The conditions of processing and use of the Heat Map Data will apply to contractor(s) and signatories are under an obligation to ensure that such contractors are bound under equivalent terms to those of this agreement (see sharing with third-parties and commercial use sections). Termination of this agreement will also terminate any agreement with third-party recipients to hold and use the Heat Map Data and they will be required to destroy it (see retention and deletion of data and termination of agreement sections).