Transparency data

The purposes of assessing the impact of the Child Poverty Pathfinder programme in Dundee.

Published 19 March 2026

Applies to Scotland

This Memorandum of Understanding (MoU) between HM Revenue and Customs (HMRC) and Scottish Government (SG) was agreed and put in place in 2025.

1. Introduction

This MoU sets out the information sharing arrangement between the aforementioned participants. For the context of this MoU ‘information’ is defined as a collective set of data or facts that when shared between the participants through this MoU will support the participants in delivering the purpose of the data sharing activity described in section 2 below.

Information will only be exchanged where it is lawful to do so. The relevant legal bases are detailed within this agreement. It should be noted that ‘exchange’ covers all transfers of information between the participants, including where one participant has direct access to information or systems in the other.

This MoU is not intended to be legally binding. It documents the respective roles, processes, procedures, and agreements reached between HMRC and the participants. This MoU should not be interpreted as removing, or reducing, existing legal obligations or responsibilities of each Participant, for example as Controllers under the UK General Data Protection Regulations (UK GDPR).

2. Purpose and benefits of the data sharing agreement

2.1 Purpose

This is a one-off data share and is expected to commence in August 2025, with the share lasting for 12 months.

The Child Poverty (Scotland) Act of 2017 set new legal targets for child poverty in Scotland, including for less than 18% of children to be living in relative poverty by 2023  to 2024 and for less than 10% to be living in relative poverty by 2030. To deliver against these targets, Scottish Government (SG) has made a commitment to support the work of Local Pathfinders.

SG has commissioned 2 Pathfinder pilots in Dundee and Glasgow as a flagship policy as part of the 2022-26 Tackling Child Poverty Delivery Plan, which is the plan for meeting the statutory 2030 Child Poverty targets. This data share will be for the purposes of evaluating the Dundee Pathfinder only.

The overarching aim of the Dundee pathfinder is to support families towards escaping poverty by working collaboratively with partners to shape services around what matters to people and communities and remove barriers to support, recognising that the factors that keep families in poverty are multiple and complex and that joined up and holistic support is required to tackle multiple barriers.

This data share is for statistical and evaluation purposes of the Child Poverty Pathfinder Programme within Dundee to inform scaling of the Pathfinder approach and development of future policy initiatives and interventions. SG want to be able to review and further understand the overall impact programme has had on individuals involved by looking at their economic outcomes, whilst comparing them against a matched comparison group of similar background. The analysis will be used to understand how successful the programme has been and provide a good insight into the extent to which the intervention is likely to reduce child poverty.  

A feasibility study, commissioned as part of this evaluation, concluded that the only practical way to assess impact robustly is through the analysis of administrative data.  This is because:

• challenges associated with the target group, including digital exclusion and low motivation to respond to surveys, mean that any primary data gathering on outcomes is likely to be heavily compromised by low response or attrition; and

• the routine data gathered by those delivering the intervention is not sufficient to measure these outcomes, lacks baseline data from the point at which the intervention began, and would not be available for a comparison group

SG will provide HMRC with a list of postcodes from 130 data zones identified as the most deprived areas across Scotland.  The Postcodes have been identified by SG as similarly deprived areas using Scottish Index of Multiple Deprivations (SIMD) scores. HMRC will then apply control filters to identify households and individuals within these data zones which meet the following criteria:

Households

• living at an address within identified “data zones” as of 01 October 2022

• all occupants in household have zero (£0) employment income for the month of September 2022 (Pathfinders programme began October 2022)

• and all occupants in household have a period of unemployment of at least 1 month long during the 2021 and 2022 tax year (06 April 2021 to 05 April 2022) (with an exception made in the case of missing data see notes on missing start date below)

• total household employment income is less than £30,558* for the 2022 to 2023 tax year (06 April 2022 to 05 April 2023). *A person is deemed to be in absolute poverty if their current household income is less than 60% of the UK median in 2010 to 2011, adjusted for inflation. For a single parent family with 4 children under 14, this value was equal to £26,400, including direct transfers. This is equivalent to £30,558 in 2022 assuming a cumulative inflation adjustment 2017 to 2018 to 2022 to 2023 of 15.75%)

• all occupants in household have zero (£0) Self-Assessment income for the 2022 to 2023 tax year (06 April 2022 to 05 April 2023)

• at least one individual within the household is claiming child benefit

Individuals of interest within households

• only individuals with no Date of Death or a Date of Death after 01 October 2022

• only individuals aged 18 years or above as of 01 October 2022

HMRC will then return relevant household and occupant information including employment and earnings to Scottish Government (SG).

Data from HMRC will then be linked by SG with data from DWP, Social Security Scotland and Dundee City Council. The data from Dundee City Council will enable the identification of Pathfinder participants in the dataset. Characteristics of Pathfinder participants, including employment and benefit histories in the 3 years prior to the Pathfinder, will be used to construct a matched comparison group from other areas of Scotland (outside of Dundee), in order to compare outcomes (employment and benefit income) from 2022 to 2025, using difference in difference, in order to assess whether any changes are attributable to the Pathfinder programme.

The processing of data for people in other areas of Scotland not delivering a Pathfinder is necessary in order to form a comparison group and use quasi-experimental methods to ascertain whether any impact observed for participants in Dundee is likely to have been as a result of the intervention or due to other factors. This will enable SG to be more confident about whether the Pathfinder has had an impact or not.

The data transfer will include data for individuals who will be excluded from the final analysis of outcomes.  This includes:

1. Individuals who meet the eligibility criteria in the Dundee postcodes where the Pathfinder is operating but who chose not to take up the support. SG anticipate this group to be small in number because the eligibility criteria set out above closely match the criteria used by the Pathfinder to proactively target households, and anecdotal evidence from Pathfinder key workers suggests that almost all identified families were successfully engaged. The group who did not engage are of interest, as analysis of their characteristics will provide insight into possible reasons for non-engagement, which can inform future delivery.

2. Individuals in postcodes outside of Dundee who are not selected for the matched comparison group (based on propensity score matching (PSM)) because they are less similar to Pathfinder participants. These individuals will be excluded from the subsequent analysis. It would not be possible to exclude these individuals from the data share in advance because the construction of the comparison group requires matching to the characteristics and employment histories of Pathfinder participants. The comparison group postcodes have been selected to ensure that the size of the population is only as large as required for the purpose of constructing the comparison group (using PSM).

HMRC data will be analysed by SG on receipt.  Any data that meets the above exclusion criteria (1) will not be used in the comparative analysis, however SG will use the data to identify characteristics of those individuals who chose not to engage with the programme to inform future delivery.  This data will be deleted once those characteristics have been analysed.  For any data that meets the above exclusion criteria (2) will be deleted as soon as it is identified they do not meet the eligibility criteria.

2.2 Aims of the data share

Dundee Pathfinders, designed and implemented at a local level, aims to provide person-centred support to families most at risk of poverty. Critically, the Pathfinders seek to make it easier for families to access services as part of a proactive attempt to improve the system as a whole and move away from a disaggregated service provision. As such, they aim to tackle child poverty both by directly supporting families at risk, and also by driving system change in the way in which families are supported.

The aim is for SG to use the data to understand whether the Pathfinder approach works in supporting individuals to move out of poverty through income improvements from benefits or employment compared to those households with similar criteria that have not had access to the programme. 

Knowing whether the Pathfinders have had an impact on employment and income outcomes for participants, and thus on child poverty, will inform decisions around scaling of the pathfinder approach, as well as supporting the development of future policy approaches and interventions needed to deliver progress against the 2030 statutory child poverty targets.

There is no function for HMRC other than providing SG with the relevant HMRC data to support their objectives.

2.3 How the data being shared will help achieve those aims

The relevant household and individual level data required by SG for the objectives of this share can only obtained by HMRC.  The data held by HMRC has been collected in line with HMRCs functions, supplied to HMRC by customers, both individuals and companies as a requirement for mandatory tax compliance.

The provision of HMRC data to SG will feed into an evaluation to assess the success of the Child Poverty Pathfinder Programme within the Dundee area and inform decisions and development of future policy initiatives and interventions. Without this relevant HMRC information SG would be unable to conduct such robust analysis.

2.4 Benefits of the data share

The primary benefit of this data share will be to understand whether the Pathfinder approach works in supporting individuals to move out of poverty through income improvements from benefits or employment.  The findings will be used to inform ongoing delivery of similar interventions, as well as the development of measures in the next and final Tackling Child Poverty Delivery plan (2026 to 2031), which will set out the measures that Scottish Ministers propose to take for the purpose of meeting the statutory child poverty targets.

In evaluating a complex place-based intervention of this sort, the learning gained from this analysis is vital to understanding how impacts can be robustly captured at a national level and will leave the Scottish Government much better placed to understand how best to target its resources to greatest effect in supporting the poorest families in Scotland and in reducing child poverty.

Other than supporting Scottish Government with their aims of reducing child poverty in Scotland there are no measurable benefits to HMRC from this data share.

3. Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessments have been completed by both participants in this agreement. The details of which are found below.

Organisation	DPIA Ref	Date registered	last review
HMRC	16863	10 July 2025	10 July 2025
Scottish Government	Child Poverty Pathfinders Evaluation - Phase 2 (administrative data analysis component) v5.0	28 March 2024	17 March 2025

4. Relationships under UK GDPR in relation to any personal data being exchanged under this agreement

4.1 HMRC

HMRC will be disclosing personal data under this agreement.

Where personal data is being disclosed under this agreement, HMRC’s status will be a controller because HMRC separately determines the purpose and means of the processing of the personal data.

4.2 Scottish Government

Scottish Government will be receiving personal data under this agreement.

Where personal data is being received under this agreement, Scottish Government’s status will be a controller because they separately determine the purpose and means of the processing of the personal data after transfer.

5. Handling of Personal Data and Security

Where participants bear the responsibility of a Data Controller (see Section 5.1 and 5.2), they must ensure that any personal data received pursuant to this MoU is handled and processed in accordance with the current 7 UK GDPR principles.

Additionally as part of the Government, HMRC and participant 2 must process personal data in compliance with the mandatory requirements set out in HM Government Functional Standard GovS 007: Security issued by the Cabinet Office when handling, transferring, storing, accessing or destroying Information assets.

Participants must ensure effective measures are in place to protect personal data in their care and manage potential or actual incidents of loss of the personal data. Such measures will include, but are not limited to:

• personal data should not be transferred or stored on any type of portable device unless absolutely necessary, and if so, it must be encrypted, and password protected to an agreed standard

• participants will take steps to ensure that all staff involved in the data sharing activities are adequately trained and are aware of their responsibilities under the DPA, UK GDPR and this MoU

• access to personal data received by participants pursuant to this MoU must be restricted to personnel on a legitimate need-to-know basis, and with security clearance at the appropriate level, and

• participants will comply with the Government Security Classifications Policy (GSCP) where applicable

6. Duration, Frequency and Volume of the data sharing

Date MOU comes into effect	MOU formal review date	MOU cease date	Frequency and volume of the data being shared
01 August 2025	31 July 2026	31 July 2027	This will be a one-off share relating to approx. 7,500 individuals in total. This is an estimated figure based on the Scottish Index for Multiple Deprivations (SIMD) data for the relevant postcodes.

7. Legal considerations and basis to share data between the Participants

HMRC has specific legislation within the Commissioners for Revenue and Customs Act (2005) which covers the confidentiality of information held by the department, when it is lawful to disclose that information and legal sanctions for wrongful disclosure. For HMRC, disclosure of information is precluded except in certain limited circumstances (broadly, for the purposes of its functions), where there is a legislative gateway or with customer consent. Unlawful disclosure relating to an identifiable person constitutes a criminal offence. The criminal sanction for unlawful disclosure is detailed at section 19 of the Commissioners for Revenue and Customs Act 2005.

Data can only be shared where there is a legal basis for the exchange and for the purposes described in this MoU as specified at Section 8 below. No data should be exchanged without a legal basis and all exchanges must comply with our legal obligations under both the Data Protection Act (DPA) 2018 and Human Rights Act (HRA) 1998.

7.1 Legal basis for HMRC to disclose data

HMRC may disclose data to SG by virtue of the legal basis set out in s35. DEA 2017 which allows for “A specified person may disclose information held by the person in connection with any of the person’s functions to another specified person for the purposes of an objective which is a specified objective in relation to each of those persons”. 

HMRC are satisfied that the objectives of this share meet the specified conditions as at:

• s35 (9), (10), (11) and (12) DEA 2017;

• s.1 (a) of the Digital Government (Disclosure of Information) Regulations 2018 (multiple disadvantages power); and

• Specified objectives of S.2 (1) (a), (b) and (c) of the Digital Government (Disclosure of Information) Regulations 2018 for the purposes of:

(a) assisting in the identification of individuals or households with multiple disadvantages;

(b) the improvement or targeting of a public service or facilitation of the provision of a benefit provided to individuals or households; and

(c) the improvement of the physical, mental, emotional, social or economic well-being of individuals or households.

• any taxpayer data shared by HMRC includes the presence of at least 2 or more of the multiple disadvantage factors listed at S.2 (3) of the Digital Government (Disclosure of Information) Regulations 2018.

7.2 Legal basis for SG to disclose data

Not applicable as SG are not sharing any data

8. Lawful basis under UK GDPR to process personal data

Personal data can only be processed (transferred, disclosed) where there is a valid lawful basis/bases as set out in Article 6 of UK GDPR – see ICO Guidance

8.1 Lawful basis for HMRC to process (share) personal data

The lawful processing of personal data will be undertaken in line with Article 6:1(e) of the UK GDPR (performance of a task in the public interest or exercise of official authority) and section 8(d) DPA 2018 (function of a government departments).

8.2 Lawful basis for SG to process (share) personal data

Not applicable as SG are not sharing any data

9. Data to be shared

This is a one-off data share anticipated to commence in August 2025.

SG will provide HMRC with a list of postcodes from 130 data zones identified as the most deprived areas across Scotland.  The Postcodes have been identified by SG as similarly deprived areas using Scottish Index of Multiple Deprivations (SIMD) scores.

HMRC will then apply control filters to identify households and individuals within these data zones which meet the criteria set out in Section 3 and 11 of this MoU.

Based on the SIMD data it is estimated that the number of relevant individuals within these data zones is approx. 7,500. 

The postcode areas will be the only inbound data to HMRC.  This will be sent to HMRC via email.

There will be no data matching necessary for HMRC in this data share as there is no inbound personal identifier data for HMRC to match to. 

HMRC will be defining the population based on the list of postcodes provided by SG (please see Section 2 of this MoU for details on how these postcodes were identified or selected).

The return population data will be identified by HMRC using the following control filters (with an exception made in the case of missing employment start or end date – see notes below*):

Households

• living at an address within identified “data zones” as of 01 October 2022

• all occupants in household have zero (£0) employment income for the month of September 2022 (Pathfinders programme began October 2022)

• and all occupants in household have a period of unemployment of at least 1 month long during the 2021 to 2022 tax year (06 April 2021 to 05 April 2022) (with an exception made in the case of missing data*)

• and total household employment income is less than £30,558** for the 2022 to 2023 tax year (06 April 2022 to 05 April 2023)

• all occupants in household have zero (£0) SA income for the 2022 to 2023 Tax Year (06 April 2022 to 05 April 2023)

• at least one individual within the household is claiming child benefit

Individuals of interest within households

• only individuals with no Date of Death or a Date of Death after 01 October 2022

• only individuals aged 18 years or above as of 01 October 2022

Income Data will be supplied for

• 2019 to 2020 tax year (from 06 April 2019) to present for PAYE, including all payments

• the last 4 complete tax years for SA

• Identifying if an individual has had a period on unemployment in 2021 to 2022 relies on being able to use the start and end dates for employments. There is a data quality risk with these dates where they may be missing in a small number of cases, where an employer may not have submitted them.

In the case of a missing start date the following control criteria - All occupants in household have a period of unemployment of at least 1 month long during the 2021 to 2022 tax year will not be applied. However, all other control criteria listed above must still be met.

Missing end dates will be interpreted as a current employment.

**A person is deemed to be in absolute poverty if their current household income is less than 60% of the UK median in 2010 to 2011, adjusted for inflation. For a single parent family with 4 children under 14, this value was equal to £26,400, including direct transfers. This is equivalent to £30,558 in 2022 assuming a cumulative inflation adjustment 2017 to 2018 to 2022 to 2023 of 15.75%)

Note – Historically it has been difficult to confidently infer family or household compositions. Household ID will be based on house name or number and postcode at the launch of the Child Poverty Pathfinder program. The outcome of this will be manually checked, and an alternative way of flagging households will be suggested if this method is not comprehensive enough for any reason (for example multiple surnames within one household).

The following data will be shared by HMRC to SG via Secure Data Exchange Service for those household that meet the control criteria above:

• household ID
• address
• postcode
• area Level
• name
• date of Birth
• sex
• tax Year
• employment Start Date
• employment End Date
• payment Date
• payment Amount
• pay Frequency
• hours Worked
• SA Registered
• SA Earnings
• SA Self-Employment Income
• SA Employment Income
• SA Property Income
• SA Foreign Income
• received Universal Credit (UC) payment
• total household income
• dependents into employment

10. How the data will be shared

SG will supply a list of postcodes, via email, corresponding with the data zones where the Child Poverty Pathfinder programme operates and potential comparison areas.

HMRC will define the population using the agreed control filters and identify the relevant HMRC information to be returned to SG.  Information relating to any households within the postcode data zones supplied by SG that do not meet the control criteria will not be returned to SG. 

The processed file will be shared by HMRC to SG via SDES.

11. Accuracy of the data being shared

Before sharing data both participants must take all reasonable steps to ensure that the data being shared is both accurate and up to date.

The exporting department will ensure that data integrity meets their own department’s standards, unless more rigorous or higher standards are set out and agreed at the requirements stage.

Participants will notify each other of any inaccuracies of the data as they are identified.

12. Retention and Destruction of data

12.1 HMRC

This content has been withheld because of exemptions in the Freedom of Information Act 2000.

12.2 Scottish Government

This content has been withheld because of exemptions in the Freedom of Information Act 2000.

13. Onward disclosure to third parties

2 named researchers will be given access to and process pseudonymised data only – that is data at the household or individual level with all personal identifiers removed following the linkage process by SG.

Data processing carried out on the pseudonymised data by the researchers will be conducted under contract to Scottish Government and only available to access on the Scottish Governments Analytical Data Management platform.  The data will not be able to be linked to any individual and will not be transferred to any third-party environment.

14. Role of each Participant to the MoU

14.1 Role of HMRC

• identify the appropriate data required from HMRC IT systems or records

• provide the data to SG in Microsoft Excel transferred by Secure Data Exchange Service from and to agreed contact points

• only allow access to that data by the team requiring it

• ensure that staff handle this data in line with the approved secure transfer method agreed by both departments and within HMRC data security instructions

• only store the data for as long as there is a business need to do so

• move, process and destroy data securely in line with the principles set out in HM Government Functional Standard GovS 007: Security issued by the Cabinet Office, when handling, transferring, storing, accessing or destroying information

• comply with the requirements in the Government Functional Standard GovS 007: Security and, in particular prepare, for and respond to Security Incidents and to report any data losses, wrongful disclosures or breaches of security relating to information

14.2 Role of SG

• identify the appropriate data required from HMRC

• only use the information for purposes that are in accordance with the legal basis under which it was received

• only hold the data for as long as there is a business need to do so

• ensure that only people who have a genuine business need to see the data will have access to it

• on receipt, store data received securely and in accordance with the prevailing central government standards, for example in secure premises and on secure IT systems

• move, process and destroy data securely in line with the principles set out in HM Government Functional Standard GovS 007: Security issued by the Cabinet Office, when handling, transferring, storing, accessing or destroying information.

• comply with the requirements in the Government Functional Standard GovS 007: Security and in particular prepare for and respond to Security Incidents and to report any data losses, wrongful disclosures or breaches of security relating to information

• if SG adheres to a different set of security standards they must inform HMRC what these standards are at 16.3 below and comply with any additional security requirements specified by HMRC

• seek permission from HMRC before onward disclosing information to a third party

• seek permission from HMRC if you are considering offshoring any of the personal data shared under this agreement

• mark information assets with the appropriate government security classification and apply the baseline set of personnel, physical and information security controls that offer an appropriate level of protection against a typical threat profile as set out in Government Security Classifications, issued by the Cabinet Office, and as a minimum the top level controls framework provided in the Annexe – Security Controls Framework to the GSC

• send the data in the above specified format via Secure Data Exchange Service agreed by both departments under the protective marking ‘Official-Sensitive’

15. Monitoring and Reviewing and arrangements

This MoU relates to a regular exchange that must be reviewed annually to assess whether the MoU is still accurate and fit for purpose.

Reviews outside of the proposed review period can be called by representatives of either Participant. Any changes needed as a result of that review may be agreed in writing and appended to this document for inclusion at the formal review date.

Technical changes necessary to improve the efficiency of the exchange that do not change the overarching purpose can be made without the requirement to review formerly the MoU during its life cycle but must be incorporated at the formal review stage.

A record of all reviews will be created and retained by each participant.

16. Assurance Arrangements

HMRC has a duty of care to assure any data that is passed on to others. Processes covered by this MoU will be subject to annual reviews, from the date of sign off. HMRC may also choose to introduce ad hoc reviews. Assurance will be provided by the annual completion of a Certificate of Review and Assurance. The assurance processes should include checking that any information sharing is achieving its objectives (in line with this MoU) and that the security arrangements are appropriate given the risks.

SG agrees to provide HMRC with a signed Certificate of Review and Assurance within the time limits specified upon request.

HMRC reserves the right to review the agreed risk management, controls, and governance in respect of this specific agreement.

17. Security Breaches, Security Incidents or loss or unauthorised disclosure of data

The designated points of contact are responsible for notifying the other participant in writing in the event of loss or unauthorised disclosures of information within 24 hours of the event.

The designated points of contact will discuss and agree the next steps relating to the incident, taking specialist advice where appropriate. Such arrangements will include (but will not be limited to) containment of the incident and mitigation of any ongoing risk, recovery of the information, and notifying the Information Commissioner and the data subjects. The arrangements may vary in each case, depending on the sensitivity of the information and the nature of the loss or unauthorised disclosure.

18. Subject Access Requests

In the event that a Subject Access Request (SAR) is received by either participant they will issue a formal response on the information that they hold following their internal procedures for responding to the request within the statutory timescales. There is no statutory requirement to re-direct SARs or provide details of the other participant in the response. However, each participant will notify the other if a SAR is received in respect of any personal data shared under this agreement.

HMRC Contact

SG Contact

Full details of Data subject’s rights in relation to processing of personal information can be found in each Participant’s Privacy Notice – links below. Also, see ICO Guidance..

HMRC Privacy Notice

Scottish Privacy Notice

ICO Data Sharing Code of Practice – The rights of individuals

19. Freedom of Information Act (FOI) 2000

Both Participants are subject to the requirements of the Freedom of Information Act (FOIA) 2000 and shall assist and co-operate with each other to enable each organisation to comply with their information disclosure obligations

In the event of one participant receiving an FOI request that involves disclosing information that has been provided by the other participant, the organisation in question will notify the other to allow it the opportunity to make representations on the potential impact of disclosure.

HMRC FOI Contact

SG FOI Contact

20. Issues, disputes, and resolution

Any issues or disputes that arise as a result of exchange covered by this MoU must be directed to the relevant contact points. Each participant will be responsible for escalating the issue as necessary within their given management structure.

Where a problem arises it should be reported as soon as possible. Should the problem be of an urgent nature, it must be reported by phone immediately to the designated business as usual contact and followed up in writing the same day. If the problem is not of an urgent nature, it can be reported in writing within 24 hours of the problem occurring.

21. Costs

RIS Government Data Exchange Team will recharge for all cross-government data exchanges where there is no reciprocal benefit to HMRC. Recharges are based on resource costs, including both governance and analytical resource and are in line with HMRC Fees and Charges guidance.

22. Termination

This MoU may be terminated by giving 3 months’ notice by either participant.

Both participants to this MoU reserve the right to terminate this MoU with 3 months’ notice in the following circumstances:

• by reason of cost, resources, or other factors beyond the control of the HMRC or SG

• if any material change occurs which, in the opinion of HMRC or SG following negotiation significantly impairs the value of the data sharing arrangement in meeting their respective objectives

In the event of a significant security breach or other serious breach of the terms of this MoU by either participant the MoU will be terminated or suspended immediately without notice.

In the event of a failure to cooperate in a review of this MoU or provide assurance the agreement may be terminated or suspended without notice.

23. Signatories

This content has been withheld because of exemptions in the Freedom of Information Act 2000.