http://www.legislation.gov.uk/ssi/2005/494/regulation/39The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005Emergency planningRisk assessmentVoluntary organisationsConfidential informationBusiness continuity planningCIVIL CONTINGENCIESStatute Law Database2026-03-10Expert Participation2026-02-05 These Regulations relate to the extent of the duties imposed on certain bodies (referred to as “Scottish Category 1 responders”) listed in Part 2 of Schedule 1 to the Civil Contingencies Act 2004 (“the Act”) under sections 2 and 4 of that Act (duties to assess, and plan for emergencies and duties to provide advice and assistance to business) and the manner in which those duties are to be performed. PART 8InformationSensitive information391In these Regulations, “sensitive information” means information which is not reasonably accessible to the public and which is–ainformation the disclosure of which to the public would, or would be likely to, adversely affect national security;binformation the disclosure of which to the public would, or would be likely to, adversely affect public safety;cinformation, disclosure of which to the public would or would be likely to prejudice the commercial interests of the person to whom that information relates; ordinformation which is personal data... if the condition in paragraph (1A), (1B) or (1C) is satisfied.1AThe condition in this paragraph is that the disclosure of the information to a member of the public—awould contravene any of the data protection principles, orbwould do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.1BThe condition in this paragraph is that the disclosure of the information to a member of the public would contravene—aArticle 21 of the UK GDPR (general processing: right to object to processing), orbsection 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).1CThe condition in this paragraph is that—aon a request under Article 15(1) of the UK GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018,bon a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, orcon a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.1DIn this regulation—“the data protection principles” means the principles set out in—Article 5(1) of the UK GDPR,section 34(1) of the Data Protection Act 2018, andsection 85(1) of that Act;“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);...“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act); 1EIn determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateways in relation to public authorities) disapplied only the gateway in point (ea) (recognised legitimate interests).2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Reg. 39 in force at 14.11.2005, see reg. 1Reg. 39(1A)-(1E) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 320(3) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)Words in reg. 39(1)(d) omitted (25.5.2018) by virtue of Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 320(2)(a) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)Words in reg. 39(1)(d) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 320(2)(b) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)Reg. 39(2)-(4) omitted (25.5.2018) by virtue of Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 320(4) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)Words in reg. 39(1E) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 61(4) (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)Words in reg. 39(1B)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 61(2) (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)Words in reg. 39(1C)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 61(2) (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)Words in reg. 39(1D) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 61(3)(a) (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)Words in reg. 39(1D) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 61(3)(b) (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)Words in reg. 39(1D) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 61(3)(c) (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)Word in reg. 39(1E) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 70(8)(a)(9)(f), 142(1); S.I. 2026/82, reg. 2(c)Words in reg. 39(1E) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 70(8)(b)(9)(f), 142(1); S.I. 2026/82, reg. 2(c)