Records management policy
Published: 27 February 2024Freedom of information class: How we manage our resources
Our records management policy
Table of contents
1. Purpose and scope
1.1 This policy sets out the commitment of the Keeper of the Registers of Scotland (RoS) to exercise best-practice in the management of records.
1.2 This policy governs all records created, collected and managed by RoS as evidence of its functions and activities. Whilst this does not include its registers themselves, which are governed separately by statute, it does include records which facilitate the completion of registers, and which evidence the organisation’s wider corporate functions and commercial activities. RoS therefore applies best practice by default when managing records.
1.3 Records are recorded information, in all formats and media, which:
- evidence strategic and operational decision-making, or
- evidence corporate governance, accountability and statutory or regulatory compliance, or
- constitute the corporate memory of the organisation
2. Policy statement
2.1 RoS will create and manage authentic, reliable and useable records. To achieve this, RoS will ensure that its records are:
- Managed appropriately throughout their lifecycle
- Created and used in ways which ensure their quality and value as evidence
- Accessible to those who need them, and in an efficient manner
- Protected appropriately from unauthorised access, loss or damage
- Retained for the appropriate amount of time
- Destroyed securely and definitively or transferred to a suitable location for long-term preservation
2.2 RoS therefore undertakes to:
- Operate effective procedures and controls to ensure policy is reflected in practice
- Support colleagues, customers and stakeholders
- Meet applicable standards, guidelines and legal requirements
- Monitor and regularly review performance
3. Awareness
3.1 RoS will ensure that its staff understand their roles and responsibilities for records management and that they have the knowledge and skills required to discharge these effectively.
3.2 Where customers and stakeholders have a role in helping RoS achieve effective records management, we will communicate appropriately with them to help them understand and meet its expectations.
4. Law, regulations and standards
4.1 This policy complements the following relevant law, regulation, and standards with which RoS complies, principally:
- Public Records (Scotland) Act 2011
- UK General Data Protection Regulation and Data Protection Act 2018
- Freedom of Information (Scotland) Act 2002 & Section 61 Code of Practice on Records Management
- ISO 27000 series, Information Security Management Systems (ISMS) standards
5. Roles and responsibilities
5.1 All RoS staff and contractors have responsibilities for records management, are bound by the commitments of this policy, and are required to effectively operate the various operational procedures which facilitate its fulfilment in practice.
5.2 Area Information Managers (AIMs) will be supported by the Risk and Information Governance function to promote effective records management and improvement locally.
5.3 The Head of Information Governance acts as Records Manager for RoS and has operational responsibility for records management within RoS. The Records Manager is responsible for ensuring that the procedures and training which support the fulfilment of the policy are operated effectively.
5.4 The RoS Accountable Officer has strategic oversight and overall accountability for records management within RoS. They work with RoS Executive Management Team to ensure that the commitments given in this policy are met, and that the records management function is appropriately resourced and accounted for within the wider governance of the organisation.
6. Approval and Review
This policy will be reviewed and approved by the RoS Executive Management Team annually.
| Author | Alison Kendall, Head of Information Governance | ||
|---|---|---|---|
| Reviewed | Aidan Robertson, Head of Risk & Information Governance | ||
| Cleared | Chris Kerr, Director of Policy and Corporate Services | ||
| Approval | Executive Management Team | Approval date | 22 February 2024 |
| Policy version | Version 3.1 | ||
| Review responsibility | Information Security and Assurance Group | Review date | 1 February 2025 |
| Publication scheme | Yes | ||
| Email to contact | |||