In order to contact the company, organisation or agency you are asking for our help with, we need you to provide us with the legal authority to do so. We refer to this as a ‘data protection mandate’ or ‘authority to act’. The word mandate in this instance is just a legalistic way of saying authority or permission.

Please read the following information as it sets out what the mandate is and what it is for, the information collected with the mandate and what happens with the mandate when you complete and sign it. 

Your caseworker has asked you to complete a data protection mandate. Put simply, this mandate provides your Welfare Scotland caseworker with the legal authority to contact a company, organisation or agency on your behalf and to work with them to find a solution to your case or complaint.

This legal authority will last for up to six (6) months and will automatically expire but you can cancel and withdraw it at any time here.

If you tell us you have withdrawn your consent, we will immediately stop using the mandate and will confirm we have done so within 5 working days.

When you click the link below to access the mandate, you’ll be asked for your email address. This email address will be used to send you a copy of your completed mandate, so please make sure you’ve entered the correct email address.

Additionally, the signing server will create an audit log which will show:

• Your IP address,

• Details about the device you used to open and create the mandate,

• The time and date you opened the mandate,

• The time and date you started filling in the mandate,

• The time and date you finished completing and signing the mandate,

• A copy of the answers you’ve provided when completing the mandate,

• Your signature.

A copy of this audit log will be sent to you with a copy of your mandate when you’ve finished signing and submitting it and a copy will be stored securely on your case file and sent to the data controller alongside a copy of your completed mandate.

A copy of your mandate is stored on our secure system, a copy is sent to you via email and a copy is sent to the ‘Data Controller’ - this is the company, organisation or agency you have asked us to contact on your behalf.

Some data controllers will call or email their customer (you) to check that the mandate is genuine and valid. So please don’t be alarmed if they do contact you to double check, they do this for your protection.

If both of you are named on the account at the company, organisation or agency, then we need a mandate from both of you.

If you are happy with the above and wish to continue, please click the button below.

You can withdraw a Data Protection Mandate here. We call this a DPA3 countermanding instruction.