5 questions Edinburgh brand teams must settle before a Scottish listening pilot

What to take away

Question one: which Scots law and UK law applies to the pilot

Start by separating the two. Data protection is reserved: UK GDPR and the Data Protection Act 2018 apply across Scotland exactly as in England. The Information Commissioner's Office regulates it from Wilmslow and Edinburgh, and its UK GDPR guidance and resources index is the first thing your legal lead should read.

Scots law still shapes the pilot in three ways. Delict, not tort, governs any claim that monitoring harmed someone. The law of confidence in Scotland has its own case history, which matters if you monitor private groups. And Scottish courts handle actions raised here, so your contracts should name a Scottish jurisdiction if the pilot is Edinburgh-run.

Public law adds a fourth layer. If your brand is a Scottish public body, or you work for one, the Freedom of Information (Scotland) Act 2002 lets people request the datasets you hold. Plan for that before collection, not after.

Write the answer down as a sentence: which law, which regulator, which court. If the team cannot agree that sentence, the pilot is not ready.

Question two: what Scottish Government communications the pilot must respect

The Scottish Government runs its own communications operation, separate from UK Government comms. It publishes campaigns, consultation material and official accounts across health, education, justice, transport and the economy. A listening pilot that scrapes those channels needs to know which of them are in scope.

Three practical points. First, official Scottish Government accounts are not ordinary brand accounts: quoting them in a report can imply endorsement, so attribute carefully. Second, devolved policy topics carry their own vocabulary, and a lexicon built for UK-wide media will misread Scottish terms and miss Gaelic-language posts.

Third, consultation periods create spikes that look like sentiment shifts but are just process.

If your pilot touches public health, education or justice messaging, brief the team on the devolved context. Reading a Scottish Government consultation as a brand crisis is an easy and expensive mistake.

This is also where governance starts. Before collection, make sure you have owners, gates and stop rules for every channel in scope, including official accounts.

Question three: what source rights you hold over collected posts

Collecting a public post is not the same as holding rights in it. Copyright in the text, image or video stays with the person who made it. Platform terms govern what the platform allows you to do with its data. Neither gives you a free licence to republish.

The Market Research Society sets the professional baseline. Its Professional Standards cover data collection, privacy and the treatment of research participants, and they apply to social data gathered for insight work. MRS membership is common in Edinburgh agencies and client-side insight teams, so the standard is a realistic expectation, not an aspiration.

Individual rights sit on top. People can ask what you hold about them, ask for a copy, ask for correction, or object to processing. The ICO's guide to individual rights sets out what each request involves, and a pilot that cannot answer a subject access request within a month has a design fault.

When you pick a supplier, put those answers in the requirements. The source permission to exit route through supplier selection keeps rights questions in the contract rather than in a later argument.

Question four: how long the pilot retains data and who deletes it

Retention is where most pilots quietly fail. Data protection principles require that personal data is kept no longer than necessary, and the ICO's data protection principles guidance treats storage limitation as a live obligation, not a policy statement.

Set a clock. A ninety-day pilot with a thirty-day post-pilot review window is a workable default: raw posts deleted at day ninety, aggregates and reports kept for the review, then either deleted or moved to a documented archive with a stated purpose. Anything kept longer needs a reason written down.

Name a person. "The insight team" is not an owner. One named individual in Edinburgh should hold the deletion schedule, with a deputy, and both should be able to show a deletion log.

Check your supplier's side too. If the vendor keeps a copy in its own environment, your retention rule is only half enforced. Put deletion duties, timelines and evidence in the contract.

Question five: what cross-border data movement the pilot creates

Most listening tools are hosted outside the UK, usually in the United States, Ireland or another EU state. That makes the pilot a restricted transfer, and restricted transfers need a lawful mechanism before data moves.

The ICO's international transfers guidance covers adequacy regulations, the International Data Transfer Agreement and the UK Addendum to the EU standard contractual clauses. You need to know which one your supplier relies on, and you need it in writing.

Ask four questions of every vendor. Where is data stored at rest and in transit? Which sub-processors touch it? Which transfer mechanism applies? What happens if the mechanism is challenged?

Scotland adds a small wrinkle: a supplier with an Edinburgh office and US infrastructure can move data twice, once on intake and once on support access. Map the whole route, not just the server location.

If the answers are vague, treat that as a stop signal. A pilot that cannot describe its own data route cannot be defended later.

Turning the five answers into a go or stop decision

Score each question green, amber or red. Any red stops the pilot until it clears. Two ambers need a named owner and a date before launch.

The decision belongs to a person, not a committee. Give someone own the social listening decision and let them record the five answers in one page.

Build the pilot so it can be undone. A staged rollout with a kill switch, and a design where launch can be reversed, keeps a bad call cheap.

Revisit the answers at day thirty and day sixty. Law, supplier terms and Scottish Government campaigns all move during a quarter, and a pilot that never rechecks is just an unmanaged risk.

Common questions