Data retention policy - emails and records: FOI release

Information requested

You asked for information on:

• What exactly is the Scottish Government’s data retention policy for emails?
• Would you be able to provide a copy of that policy?
• What is the Scottish Government’s data retention policy for other types of data?
• Again, would you be able to provide a copy of that policy?
• Does the Scottish Government operate a "Off Site" backup procedure?
• When emails are deleted under the existing policy, are their backups also deleted?
• When other types of data are deleted under the existing policy, are their backups also deleted?

Response

All information which is part of the corporate record is retained in our electronic Records and Document Management (eRDM) system in line with the procedures that are set out in our Records Management Plan which is available from the Scottish Government website (/publications/scottish-government-records-management-plan/). The file type guidance documentation (see Supporting Files link from the website) provides detail of how long we retain information in line with the type of file it is held in. 

We have an e-mail archiving system (Enterprise Vault) that is applied to staff mailboxes which enables transient data that is not part of the corporate record to be managed appropriately. This sees mail messages which are older than 60 days moved from an individual’s mailbox to a vault where it will be held for a period of one calendar year before it is permanently deleted. Any non corporate record e-mails which a user wishes to retain for a longer period can be moved to an archive folder from where it is archived overnight to Enterprise Vault and retained for 3 years before deletion. Once archived, this data is replicated to the Scottish Government’s secondary datacentre for resilience purposes and is not backed up as this material is deemed to be of no corporate value. Therefore, archived data automatically deleted from the vault is not recoverable.

I have provided an excerpt of the policy relating to Enterprise Vault at Annex A.

In terms of backup procedure we operate a twin datacentre model in order to provide maximum resilience and disaster recovery. Data which is deleted from eRDM and Enterprise Vault is retained in back up for a period of 28 days after which it is no longer recoverable.

Annex A
Explanation of Enterprise Vault  

We send and receive more than one million e-mails every month - around 95 per cent of these are of no business value after three months and are not required to be kept for the corporate record. 

A decade ago, and in line with other large organisations and guidance from National Archives, the Scottish Government introduced an e-mail archiving system (Enterprise Vault) to help manage increasing volumes of e-mail and substantial demands on digital storage. 

Enterprise Vault will scan your mailbox (Inbox, Sent Items etc.), to determine which mail messages are older than 60 days, then archives these emails to a temporary central repository, leaving a reference ‘stub’ in your mailbox. You then have a further 12 months to determine whether specific e-mails should be saved to the official record – which is our corporate electronic Records and Document Management (eRDM) system. After 12 months, these archived e-mails are then deleted from Enterprise Vault. 

You will also be presented with a #Archive folder.  This folder archives emails approximately twice a week as soon as mail is added and these messages will be kept for 3 years then deleted permanently from Enterprise Vault. 

Calendar items will also be archived, but this will not happen until they are 1 year old.  Calendar items will be deleted after being stored in your vault for 2 years.

Links in Outlook to archived messages use a different icon to the normal envelope displayed for e-mail .

As part of your induction, you will receive mandatory training on information management and how to use eRDM.

About FOI
The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at http://www.gov.scot/foi-responses.