Scottish Government records management plan

Element 10: Business continuity and vital records

Record recovery, prioritising vital records, is an integral part of the authority's business continuity planning.

An authority's business continuity arrangements should include the recovery of records made temporarily unavailable due to an unexpected event.

Current data protection law emphasises that the loss of personal data may constitute a breach.

In particular, the Keeper will expect an authority's RMP to indicate arrangements in support of records vital to core business activities. Certain records held by authorities are vital to their function. These might include insurance details, current contract information, master personnel files, case files, etc. The RMP will support reasonable procedures for these records to be accessible in the event of an emergency affecting their premises or systems.

Authorities should therefore have appropriate business continuity plans ensuring that the critical business activities referred to in their vital records will be able to continue in the event of a disaster. How each authority does this is for them to determine in light of their business needs, but the plan should point to it.

Best Practice might include:

• An authority's business continuity arrangements should recognise the importance of the recovery of records.
• Vital records are identified, perhaps as part of an Information Asset Register (see element 4), and the mechanisms for their protection and recovery included within the authority's Business Continuity Planning.
• Arrangements are in place within the Plan that ensures that copies of vital records will both survive envisaged incidents and be available thereafter in accordance with defined criteria.
• Arrangements are in place to ensure the ongoing confidentiality, integrity, availability and resilience of records involving personal data.
• The authority's business continuity arrangements are reviewed regularly.

Read further explanation and guidance about element 10.

Scottish Government Statement

Scottish Government has a number of Business Continuity and disaster recovery plans in place.

All records and data held on the Scottish Government network are subject to regular back up and associated recovery procedures.

Evidence

E28: eRDM Business Continuity Plan

E39: SCOTS Back up and Destruction procedures

Further Development

Business Continuity Plans will continue to be reviewed regularly.