Based on the fact that Police Scotland refer to them, I'd say that the Information Commissioner's Office "makes the rules" about Subject Access Requests in Scotland.
As such, ScotRail should have responded to your request within 1 month, and should have provided any information within 3 months...