Our records management policy

1. Introduction

1.1    VisitScotland is Scotland’s national tourism organisation and is a publicly funded body (a NDPB, or ‘non-departmental government body’) accountable to Scottish Government. The Scottish Tourist Board was established under the Development of Tourism Act 1969. The Tourist Boards (Scotland) Act 2006 changed the legal name of the Scottish Tourist Board to VisitScotland.

1.2    VisitScotland recognises that the effective management of its records, regardless of format, is essential in order to support its functions, to comply with legal, statutory and regulatory obligations, and to demonstrate transparency and accountability to all its stakeholders. Records are a vital information asset and a valuable resource for the organisation’s decision-making processes, policy creation and operations, and must be managed effectively from the point of their creation until their ultimate disposal.

3. Roles of records management

3.1    A record is written information (regardless of medium) that is created, received or maintained by an organisation in order to fulfil its legal obligations or in the transaction of its business.

3.2    Records management can be defined as the process whereby an organisation manages its records, whether created internally or externally and in any format or media type, from their creation or receipt, through to their destruction or permanent preservation.

3.3    Records management is about placing controls around each stage of a record’s lifecycle:

• at the point of creation (through the application of metadata, version control and naming conventions),
• during maintenance and use (through the management of security and access classifications, facilities for access and tracking of records),
• at regular review intervals (through the application of retention and disposal criteria),
• and ultimate disposal (whether this be recycling, confidential destruction or transfer to the archive branch for permanent preservation).

By placing such controls around the lifecycle of a record, we can ensure they demonstrate the key attributes of authenticity, reliability, integrity and accessibility, both now and in the future.

3.4    Through the effective management of the organisation’s records, VisitScotland can provide a comprehensive and accurate account of its activities and transactions. This may be achieved through the management of effective metadata as well as the maintenance of comprehensive audit trail data.

3.5    VisitScotland retains records that provide evidence of our functions, activities and transactions, for:

• Operational Use – to serve the purpose for which they were originally created, to support VisitScotland’s decision-making processes, to allow VisitScotland to look back at decisions made previously and learn from previous successes and failure, and to protect the organisation’s assets and rights.
• Internal & External Accountability – to demonstrate transparency and accountability for all actions, to provide evidence of legislative, regulatory and statutory compliance and to demonstrate that all business is conducted in line with best practice.
• Historical and Cultural Value – to protect and make available the corporate memory of the organisation to all stakeholders and for future generations.

5. Principles of records management

5.1    VisitScotland will adhere to the following records management principles:

• Records must be managed in accordance with legislation, corporate policy, procedures and standards
• Records are a valuable resource and must be managed accordingly.
• Records must be disposed of in accordance with approved Records Retention Schedules.
• Records that are identified as vital must be protected.
• Records that are identified as of historical significance must be preserved.
• Records must be stored within record keeping systems and appropriately secured.
• Records must be shared and not duplicated.
• Records management is a responsibility for all staff and therefore records management procedures must be understood by all staff who are  provided with appropriate training.
• Records keeping systems must be compliant with the requirements to manage records through their lifecycle.

7. Roles and responsibilities

7.1    All staff have a responsibility to manage records effectively through the documentation of all decisions and actions made by VisitScotland; the effective maintenance of records throughout their life cycle, including access, tracking and storage of records; the timely review of records and their ultimate disposal, whether this be for permanent preservation, or confidential destruction and recycling.

7.2    All Information Asset Officers (IAOs) are responsible for ensuring that their department’s record series in the Information Asset Register is accurate. They must provide an up to date report of their department’s IAR to the Data Governance and Security Group by 31 October every year. They are responsible for offering advice and guidance regarding records management to staff within their department, enforcing housekeeping and record retention requirements, highlighting any records management issues or concerns to the Records Management / Data Protection Officer (RM/DPO).

7.3    The lead responsible officer for records management in VisitScotland is the Director of Corporate Services. The Director of Corporate Services is also VisitScotland’s Senior Information Risk Officer (SIRO) and reports to the Chief Executive of VisitScotland. The SIRO attends the Audit and Risk Committee, is the sponsor of the Data Governance and Security Group (DGSG), and is responsible for managing departmental information risks, including maintaining and reviewing the Corporate Risk Register. The SIRO must understand the strategic business goals of the organisation and how these may be impacted by failure of information assets. The SIRO is responsible for ensuring that the management of information risks are weighed alongside the management of other risks facing the organisation such as financial, legal and operational.

The SIRO, together with the support of Legal Counsel and the RM/DPO, has the responsibility for ensuring compliance with this records management policy.

7.4    The RM/DPO reports to the Legal Counsel, (who in turn reports to the Director of Corporate Services) and is responsible for ensuring that records management practices and procedures are established in line with all legal obligations and professional standards. This includes issuing advice and guidance to all staff throughout VisitScotland, providing training and liaising with DIAOs and IAOs throughout VisitScotland.

7.5    All Heads of Departments are responsible for approving a corporate approach to the management of records as defined within this policy, promoting a culture of excellent recordkeeping principles and practices in order to improve business efficiency, supporting records management through commitment and the provision of resources and recognising the importance of preserving VisitScotland’s corporate memory.

7.6    Departmental Information Management Officers (DIAOs) are Heads of Departments for each identified information asset. Each DIAO must understand what information is held, what is added and what is removed, how information is moved, and who has access and why. As a result they are able to understand and address risks to the information and ensure that information they are responsible for is fully used within the law for the public good and provide written input to the SIRO annually (via the RM/DPO) on the security and use of their asset. Each DIAO must ensure that information is managed according to VisitScotland retention schedules which are set by either required legislation or best practice. Each DIAO must assign an Information Asset Officer (IAO) to maintain an up to date list of record series within the Information Asset Register.

7.7    The Data Governance and Security Group (“DGSG”) consists of representatives from the key areas responsible for managing data flows and providing a coordinated organisational response to ensure legal and regulatory compliance. The DGSG, which is chaired by the Head of Procurement, is also responsible for ensuring that appropriate data handling and information related policies, procedures and guidelines are in place to minimise data misuse and loss across VisitScotland.

9. Relationship to other VisitScotland policies

9.1    This policy forms part of VisitScotland’s overall governance framework but specifically relates to the following policies and procedures:

• Business Continuity Management Policy & Plan
• Data Incidents and Breaches Guidelines
• Data Protection Policy
• Information Systems Acceptable Use Policy
• Mobile Home Lone Working Policy
• Privacy Policies
• Gifts, Hospitality and Hosting Policy
• Smartphone Usage Policy
• Social Media Policy

11. Monitoring & review

11.1    Compliance with this Policy and related standards and guidance will be monitored by the RM/DPO in consultation with DIAOs, IAOs, the DGSG, and the Director of Corporate Services (as SIRO).

11.2    Regular reports will be submitted to the Audit and Risk Committee and updates will be disseminated to all colleagues via the corporate intranet.

11.3    This policy will be next reviewed in May 2023. Further reviews of the policy will then take place at least every three years or at such time that a significant change is made to legislation, regulations or business practices.