Introduction
The Public Records (Scotland) Act 2011 places an obligation on named authorities in Scotland to produce a records management plan which sets out their arrangements for the effective management of all records.
The offices of the Keeper of the Records of Scotland and Registrar General for Scotland are named as authorities in the schedule of the Act. A joint records management plan for the Keeper and Registrar General is maintained.
What is Records Management?
Records management can be defined as the process whereby an organisation manages its records, whether created internally or externally and in any format or media type, from their creation or receipt, through to their destruction or permanent preservation.
Records management is about placing controls around each stage of a record’s lifecycle, at the point of creation (through the application of metadata, version control and naming conventions), during maintenance and use (through the management of security and access classifications, facilities for access and tracking of records), at regular review intervals (through the application of retention and disposal criteria), and ultimate disposal (whether this be confidential destruction or transfer to the archive branch for permanent preservation). By placing such controls around the lifecycle of a record, we can ensure they demonstrate the key attributes of authenticity, reliability, integrity and accessibility, both now and in the future.
Through the effective management of the organisation’s records, NRS can provide a comprehensive and accurate account of its activities and transactions.
This may be achieved through the management of effective metadata as well as the maintenance of comprehensive audit trail data.
We retain records that provide evidence of our functions, activities and transactions, for:
- Operational Use – to serve the purpose for which they were originally
created, to support our decision-making processes, to allow us to look back at decisions made previously and to learn from previous successes and failure, and to protect the organisation’s assets and rights.
- Internal and External Accountability – to demonstrate transparency and accountability for all actions, to provide evidence of legislative, regulatory and statutory compliance and to demonstrate that all business is conducted in line with best practice.
- Historical and Cultural Value – to protect and make available the corporate memory of the organisation to all stakeholders and for future generations.
Why is Records Management Important?
Information and records are a valuable corporate asset without which we would be unable to carry out our functions, activities and transactions, meet the needs of our stakeholders, and ensure legislative compliance.
The benefits of implementing records management systems and processes include:
- Improved information sharing and the provision of quick and easy access to the right information at the right time;
- The support and facilitation of more efficient service delivery;
- Improved business efficiency through reduced time spent searching for information;
- Demonstration of transparency and accountability for all actions;
- The maintenance of the corporate memory;
- The creation of better working environments and identification of
opportunities for office rationalisation and increased mobile working;
- Risk management in terms of ensuring and demonstrating compliance with all legal, regulatory and statutory obligations;
The meeting of stakeholder expectations through the provision of good quality services.
Records Management Policy
The purpose of this policy is to demonstrate the importance of managing records effectively within the organisation and to act as a mandate for the support and delivery of records management policy, procedures and initiatives across the organisation.
General Principles
There are several key general principles that must be adopted when consideringrecord retention and protection policy. These are:
- Records must be held in compliance with all applicable legal, regulatory and contractual requirements
- Records must not be held for any longer than required
- The protection of records in terms of their confidentiality, integrity and
availability must be in accordance with their security classification
- Records must always remain retrievable in line with business requirements
This policy applies to all teams and business areas of NRS and all records created by our employees.
It relates to the management of records as an internal, facilitative function of the organisation and covers the records created by the organisation, about its activities.
It does not relate to the management of historical records and archive collections that have been transferred to, or purchased by, NRS, for permanent preservation (including NRS’s own records, once accessioned as archives).
It applies to all records regardless of format or medium, including paper, electronic, audio, visual, microform and photographic.
Policy Statement
It is the policy of NRS to maintain authentic, reliable and useable records, which are capable of supporting business functions and activities for as long as they are required. NRS is therefore committed to the operation and continuous improvement of effective records management policies and procedures.
Roles & Responsibilities
The lead responsible officer for records management in NRS is the Director of Information and Records Services. With the support of the Head of Information Governance, who acts as the corporate records manager, they have responsibility for ensuring compliance with this records management policy.
The Head of Information Governance is responsible for ensuring that records management practices and procedures are established in line with all legal obligations and professional standards, issuing advice and guidance to all staff throughout NRS, establishing and liaising with branch representatives throughout NRS and meeting the aims and objectives as outlined in the records management strategy.
Record Types and Guidelines
In order to assist with the definition of guidelines for record retention and protection, records held by NRS are defined with retention periods in the NRS Retention and Disposal Schedule.
This policy applies to all teams as a minimum, however, teams may have additional arrangements documented.
Storage of Official Records
eRDM, the Scottish Government’s electronic Record and Document Management system, is the corporate repository for NRS information and records.
Emails which form part of our official record must be stored in eRDM.
Teams chat and instant messaging may be used for routine communications where it is not expected that there will be a need to retain a record of the communication. If the content of a chat or instant message is required for the official record or as an audit trail, then a note for the record must be created and the message content saved eRDM.
All documents forming NRS official records must be stored within an appropriate file in eRDM with appropriate access controls including;
- Create,
- Read,
- Update,
- Delete.
Media Selection
The choice of long-term storage media must take into account the physical characteristics of the medium and the length of time it will be in use.
Where records are legally (or practically) required to be stored on paper, adequate precautions must be taken to ensure that environmental conditions remain suitable for the type of paper used. Where possible, backup copies of such records may be taken by methods such as scanning or microfiche. Regular checks must be made to assess the rate of deterioration of the paper and action taken to preserve the records if required.
For records stored on electronic media such as tape, similar precautions must be taken to ensure the longevity of the materials, including correct storage and copying onto more robust media if necessary. The ability to read the contents of the particular tape (or other similar media) format must be maintained by the keeping of a device capable of processing it. If this is impractical an external third party may be employed to convert the media onto an alternative format.
Record Retrieval
There is little point in retaining records if they are not able to be accessed in line with business or legal requirements. The choice and maintenance of record storage facilities must ensure that records can be retrieved in a usable format within an acceptable period of time. An appropriate balance should be struck between the cost of storage and the speed of retrieval so that the most likely circumstances are adequately catered for.
Record Destruction
Once records have reached the end of their life, they must be securely destroyed in a manner that ensures that they can no longer be used.
Disposal Methods
There are three methods for the disposal of official information:
- Confidential Destruction – official information in physical formats should be destroyed in such a way that it cannot be reproduced and is completely illegible. This may be achieved through cross-cut shredding before recycling, either internally or by an approved third party contractor.
- Deletion – deleting documents and records from electronic systems
- Transfer to Archive – records of enduring value selected for permanent retention should be transferred to archive.
Both paper and electronic records should be regularly reviewed. Please note that any information currently subject to a Freedom of Information or Data Protection request should be retained until at least 40 days after the request has been fulfilled.
For information on all current requests, please contact the NRS Information Governance Team.
Confidential Disposal of Official Physical Waste
Any information that NRS collects, stores, processes, generates or shares to deliver services and conduct business will be considered official material, with a security classification of at least OFFICIAL.
Some official material will attract an OFFICIAL-SENSITIVE handling caveat. This classification will apply to information which could have more damaging consequences for individuals, NRS or government generally if it were lost, stolen or published in the media.
All official paper waste should be placed within the lockable consoles which are in use in all NRS buildings in Edinburgh.
Do not place any official material within the non-confidential ‘Recycling’ bags or bins. The consoles are emptied regularly and their contents are shredded onsite. If you find that a console is full please notify Estates, via the iFix Portal, who will direct you to another one which has capacity. Estates can provide guidance on the location of consoles within buildings and on bulk waste disposal.
In the offices occupied by the NHSCR at the Mountainhall Treatment Centre in Dumfries, official paper waste should be placed in a confidential waste sack and secured with a zip tie before uplift by NHS Dumfries and Galloway’s waste contractor.
NRS also makes shredders available in all of its buildings. These should be used to dispose of OFFICIAL-SENSITIVE material or other sensitive material which particularly merits a securer form of destruction. For example, spoils or returns of controlled numbered extract paper are shredded. However, the majority of official waste should be disposed of in consoles rather than shredders.
If you have multimedia which requires confidential disposal raise a request through the iFix Portal. Estates will arrange for the collection and disposal of this material by the third party contractor.
A confidential waste skip will be available at Thomas Thomson House for the disposal of archives waste during the summer weeding programme. The skip must be kept locked at all times when not being filled or emptied of waste. Access to the skip is controlled by the TTH Archive Attendants and any material which is placed in the skip must be recorded in their secure waste disposal log book. For bulk disposal of archives waste at other times of the year please log a call via the iFix Portal.
As specified in the Records Management Code of Practice, issued under Section 61 of the FOISA, and in Element 6 of the Keeper’s Model Records Management Plan, issued under the PRSA, a record of destruction should be retained for all material destroyed confidentially. Certificates of destruction are provided by the contractors who uplift waste. These certificates are then scanned and saved into eRDM by the Estates.
Deletion of Electronic Information
When deleting electronic information from systems ensure that any duplicates are also deleted and that you regularly empty the Recycle Bin on your computer desktop.
Hard disk drives and removable media must be security wiped of data before they are disposed of in accordance with the IT Hardware Asset Disposal Procedure.
Disposal of Unofficial Waste
All unofficial recyclable material should be placed in the clear recycling bags which are available from Estates in all NRS buildings. The waste recycling bins, which are colour coded green and most frequently located in mess room areas, can also be used to dispose of unofficial recyclable waste. These sacks and bins will be checked regularly and their contents disposed of appropriately. Staff should not use confidential waste consoles for the destruction of unofficial material as this is very
costly to the organisation. Unofficial waste which cannot be recycled should be placed in general waste sacks.
Transfer of Records to Archive
Any records of enduring value should be transferred to the NRS archives, in accordance with NRS’s Archiving Arrangements.
The Head of Information Governance and the Information Asset Owners are responsible for identifying records which merit permanent preservation on account of their enduring historical, cultural and research value. Advice on selection is available from Archive Depositor Liaison Branch.
Record Review
The retention and storage of records must be subject to a regular review process carried out under the guidance of management to ensure that:
- Records are being retained according to the policy
- Records are being securely disposed of when no longer required
- Legal, regulatory and contractual requirements are being fulfilled
- Records are appropriately identified and kept for permanent preservation
- Processes for record retrieval are meeting business requirements
The results of these reviews must be recorded
