This page sets out how the Databanking model could be tested, by proposing a bounded Scottish demonstrator of regulated personal-data intermediation: one sector, one class of transaction, and a closed initial ecosystem large enough to establish whether the architecture, the institution, the market and the regulatory treatment all hold at once.
Organisations frequently do not need a copy of a person's underlying data. They need an answer derived from it. A service may need to know whether someone is over 18, professionally licensed, financially eligible, resident at an address, or entitled to a benefit. Under prevailing data architectures, answering such a question requires the individual to disclose the records from which the organisation then derives the answer itself, and the organisation consequently acquires, stores and assumes liability for far more personal information than the transaction needed.
Databanking reverses that relationship. The data remains with a regulated custodian. The organisation submits an authorised query or computation, and the Databank returns only the permitted result: an attestation, a cryptographic token, a match or no-match, an eligibility decision, an aggregate, an alias. The underlying records never leave the custodial environment. The worked example follows one such transaction end to end.
A pilot would test whether a neutral intermediary can supply trustworthy answers about individuals to organisations that never acquire the records those answers came from. It would not attempt to create a universal repository for all personal data. Instead, it would test Databanking first as specialised regulated infrastructure for a narrow class of high-value transactions.
The constituent technologies largely exist: secure execution environments, access-controlled APIs, cryptographic credentials, audit mechanisms, privacy-preserving computation, policy enforcement and distributed data processing. For constrained use cases the architecture is buildable. The more difficult questions are institutional and economic, so the pilot is designed to establish four kinds of viability simultaneously.
Can a Databank reliably derive and release useful information while preventing disclosure of the data underneath it? For constrained queries the working hypothesis is that it can.
Can an independent custodian hold a credible structural separation between custody and exploitation, backed by governance, auditability, security and enforceable legal duties?
Will individuals use such an intermediary, and will organisations accept a constrained output in place of collecting the raw information themselves? Commercial viability is plausible but currently unproven.
Can Databank outputs, controls and accountability mechanisms be made robust enough that regulators and relying organisations treat them as trustworthy?
The weakest assumption in a universal Databanking model is that a new institution could rapidly become trusted with every category of a person's information. Demonstrating the architecture does not require that. A pilot should begin in one specialised domain in which:
Candidate domains include age and identity verification, financial eligibility and affordability, professional credentials, health and insurance information, research access to sensitive records, address and entitlement services, and controlled personal-data access for AI systems. Several are already treated in detail elsewhere on this site: age assurance is the most transactionally simple, health data the most institutionally demanding.
Age verification for alcohol sales offers a timely candidate. Since September 2026, licensed premises in England and Wales may accept certified digital proof of age, under which the customer shares only that they are 18 or over. The change does not extend to Scotland, which has its own licensing law, and the Scottish Government has announced a public services app that is to include digital proof of age. How a digital answer may stand in for a document at a Scottish counter is therefore a question Scotland will answer for itself.
The initial use case should be selected jointly with the participating organisations and regulators. The technically simplest demonstration is not necessarily the most useful one. Selection has to balance implementation tractability against how far the case genuinely tests what is distinctive about Databanking.
A realistic Databanking transaction involves more than an individual and a querying organisation. Four roles are required, and the pilot should establish explicit responsibilities and liability boundaries between them rather than treating the Databank as an isolated technical platform.
Regulators and independent auditors sit above these four as a governance layer.
Databanking has an inherent multi-sided network problem. Individuals have little reason to join a Databank until organisations accept its answers. Organisations have little reason to integrate until enough customers use one. Data providers have little incentive to build interfaces before either. A public launch followed by an attempt to grow each side independently would be a weak test of the model.
The pilot should instead construct a closed initial ecosystem. One or more relying organisations agree in advance to accept a defined Databank output. Data providers agree to supply or verify the necessary information. A bounded cohort of individuals is then recruited for whom the supported transaction has an immediate practical use. The pilot would consequently create the minimum network necessary to test the underlying proposition without requiring mass adoption beforehand.
The demonstrator should sit alongside an interdisciplinary research programme rather than being treated simply as a software-development exercise. These questions span computer science, cybersecurity, privacy-enhancing technologies, information law, regulation, economics and public policy, and several of them are already open research strands in their own right.
Individually innocuous answers can collectively disclose sensitive information. Repeated threshold queries can progressively reconstruct the value underneath them. Control is needed over query histories and cumulative release, not only over per-query permission.
Where external organisations submit computations, mechanisms are needed to establish that those computations are safe, authorised and not covertly extractive. Constrained query languages, static analysis, sandboxing, information-flow control, output restriction, privacy budgets, formal policy models and human review are all candidates.
A perfectly secure Databank still returns a wrong answer from stale or inaccurate data. The system requires provenance, correction procedures and explicit responsibility for data quality.
The Databank must establish that records correspond to the right individual, and that authorisations originate from that person or an authorised representative.
Responsibility has to be allocated when harm follows from the Databank, the source data, the submitted computation or the relying organisation.
Formal consent does not imply meaningful choice. Employers, lenders, insurers, landlords and public authorities can make an excessive query a de facto condition of access. Governance must therefore regulate permissible requests, not only user authorisation.
Reducing uncontrolled duplication also concentrates value. Compartmentalisation, breach containment, resilience and recovery need investigation under pilot conditions.
The long-term model should permit multiple competing Databanks rather than a single universal custodian. Data, policies and attestations must be portable across regulated providers from the outset.
The pilot should quantify the cost of identity verification, ingestion, storage, computation, security, compliance, audit, support and dispute resolution, and set those against plausible revenue from custody and authorised access.
The decisive test is whether three propositions hold at the same time. Individuals are willing to entrust the relevant information to the custodian under the proposed governance and accountability model. Relying organisations are willing to accept minimal authenticated outputs in place of the underlying records. And the Databank can provide the service on economically sustainable terms while maintaining strict independence from commercial exploitation of what it holds.
Secondary measures follow: accuracy, transaction latency, security incidents, user understanding, dispute rates, data correction rates, integration cost for organisations, compliance cost, and the effectiveness of controls against cumulative disclosure. Failure on any of these is itself evidence, and identifies where the model requires modification.
The problem is interdisciplinary, and requires technology, regulation, academia, public policy and industry to be in the same room. Scotland offers a comparatively compact institutional ecosystem in which distributed systems, privacy-preserving computation, cybersecurity, data science, information law, financial technology, public-sector data governance and regulated services are all represented. It is also of a scale at which a bounded infrastructure experiment is meaningful without requiring national deployment from the outset.
The objective is not to persuade Scotland to adopt Databanking universally. It is to determine whether Scotland can serve as an incubator for a new regulated data-infrastructure model, producing the technical architecture, governance mechanisms, regulatory principles, economic evidence and interoperability standards on which any decision about broader deployment would have to rest. The comparison with EU data-governance law indicates how much of that regulatory ground is already partially prepared, and where it is not.
A successful pilot leads not automatically to scale-up but to an evidence-based decision about which parts of the model merit further development.
The intended destination is not a single institution holding all personal data. A mature ecosystem would contain multiple regulated and interoperable Databanks, plausibly specialising by sector or service, operating under common standards for custody, identity, authorisation, policy enforcement, auditing and portability. Individuals should be able to move between custodians without lock-in. Organisations should be able to request standardised outputs without bespoke integration against every provider. Regulatory obligations should apply consistently across them. A Scottish pilot could therefore contribute not only a working demonstrator but the beginnings of an open institutional and technical framework for regulated personal-data intermediation.
At this stage the proposal is to establish a small interdisciplinary group to examine the model, identify the strongest Scottish pilot use case and determine the appropriate institutional and funding structure. The immediate requirement is therefore not a commitment to deploy Databanking at scale. It is to bring a small number of organisations and individuals with relevant expertise in technology, regulation, law, public policy and industry to a more bounded question.
Demonstrated convincingly, the resulting technical architecture, regulatory framework and economic evidence would provide the basis for deciding whether Databanking should develop into a broader infrastructure industry.
The model itself is set out in the Databanking whitepaper, and the FAQ addresses the objections it most often meets. Enquiries about participation in a pilot are welcome at contact@databanking.org.