3. Progress Update on the Model Plan Elements
3.1 Element 1: Senior management responsibility
PRSA section 1(2)(a)(i) states that authorities must identify the individual who is responsible for management of the authority's public records. An individual senior staff member must be identified as holding corporate responsibility for records management.
| RAG status rating: Green |
3.1.1 Self-assessment Update
No change.
3.1.2 Progress Review Comments
No immediate action required. Update requested on any future change.
3.2 Element 2: Records manager responsibility
Section 1(2)(a)(ii) of PRSA specifically requires a RMP to identify the individual responsible for ensuring the authority complies with its plan. An individual staff member must be identified as holding operational responsibility for records management and has appropriate corporate responsibility, access to resources, and skills.
| RAG status rating: Green |
3.2.1 Self-assessment Update
No change.
3.2.2 Progress Review Comments
No immediate action required. Update requested on any future change.
3.3 Element 3: Records management policy statement
The Keeper requires each authority’s plan to include a records management policy statement. The policy statement should describe how the authority creates and manages authentic, reliable and useable records, capable of supporting business functions and activities for as long as they are required. The policy statement should be made available to all staff, at all levels in the authority.
| RAG status rating: Green |
3.3.1 Self-assessment Update
In view of the current emerging technologies, FSS have developed an Artificial Intelligence (AI) policy adapted from Scottish Government (SG) AI strategy. The AI policy provides opportunities and guardrails to sustainably and securely use AI technology in Food Standards Scotland (FSS).
3.3.2 Progress Review Comments
Thank you for this update. The PRSA Implementation acknowledge the work done to develop an Artificial Intelligence (AI) policy and to ensure guidance on emerging technologies is incorporated into working practices. As with FSS’s records management policies and procedures, it would be expected that this new policy is made available to staff.
3.4 Element 4: Business classification
Records are known and are identified within a structure, ideally founded on function. The Keeper expects an authority to have properly considered business classification mechanisms and its RMP should therefore reflect the functions of the authority by means of a business classification scheme, information asset register or similar.
| RAG status rating: Green |
3.4.1 Self-assessment Update
No change.
FSS is awaiting the development and release of the new SG Information Asset Register (IAR). In the meantime the Information Assets (IAs) are managed manually in the FSS IAR.
3.4.2 Progress Review Comments
The PRSA Implementation Team note that there has been no change under this element and that FSS’s Information Assets (IAs) are managed manually in the IAR. It has also been noted that FSS are waiting for the development and release of the new SG IAR and that, after which, procedures around the IAR are likely to change.
3.5 Element 5: Retention schedules
The Keeper expects an authority to have allocated retention periods to its public records and for those records to be retained and disposed of in accordance with a retention schedule.
| RAG status rating: Green |
3.5.1 Self-assessment Update
No change.
The Scottish Food Crime Unit and Incidents team is currently in the process of reviewing their Standards Operating Procedure (SOP) documents.
3.5.2 Progress Review Comments
The PRSA Implementation Team note that there has been no change under this element.
Thank you for informing us that Scottish Food Crime Unit and Incidents team is currently in the process of reviewing their Standards Operating Procedure (SOP) documents. It assumed this includes SOPs relating to retention. A retention schedule is a living document liable to amendments in response to changing business needs. It is clear that FSS recognise the need for periodic review to address this.
3.6 Element 6: Destruction arrangements
Records are destroyed in a timely and appropriate manner and records of their destruction are maintained. Section 1(2)(b)(iii) of PRSA specifically requires a RMP to include provision about the archiving and destruction, or other disposal, of an authority’s public records.
| RAG status rating: Green |
3.6.1 Self-assessment Update
No change.
3.6.2 Progress Review Comments
No immediate action required. Update requested on any future change.
3.7 Element 7: Archiving and transfer arrangements
Records that have enduring value are permanently retained and made accessible in accordance with the Keeper’s ‘Supplementary Guidance on Proper Arrangements for Archiving Public Documents’. Section 1(2)(b)(iii) of PRSA specifically requires a RMP to make provision about the archiving and destruction, or other disposal, of an authority’s public records.
| RAG status rating: Green |
3.7.1 Self-assessment Update
No change.
At the final stage on agreeing an Memorandum Of Understanding (MOU) with National Records of Scotland (NRS).
3.7.2 Progress Review Comments
The PRSA Implementation Team note that there has been no change under this element. However, we acknowledge the positive update that work to secure an updated transfer agreement for the transfer of records to NRS for permanent preservation is nearing conclusion.
3.8 Element 8: Information security
Records are held in accordance with information security compliance requirements. An authority’s RMP must make provision for the proper level of security for its public records. Section 1 (2)(b)(ii) states and authority’s RMP must include provision about maintaining security of information contained in the authority’s public records.
| RAG status rating: Green |
3.8.1 Self-assessment Update
No change.
However, we are working on our cybersecurity posture through an external engagement with HEFESTIS - Chief Information Security Officer (CISO) Shared Service. In particular we are reviewing and monitoring supply chain and third party assurance.
3.8.2 Progress Review Comments
The PRSA Implementation Team note that there has been no change under this element.
Thank you for providing an update on ongoing work around cybersecurity arrangements.
No immediate action required. Update requested on any future change.
3.9 Element 9: Data Protection
Records involving personal data are managed in compliance with data protection law. The Keeper will expect an authority’s RMP to indicate compliance with its data protection obligations.
| RAG status rating: Green |
3.9.1 Self-assessment Update
No change.
We are pleased to note that we reported two data breaches to the ICO since 2024 with no further actions required. ICO considered the information FSS provided and decided to close these cases and provided FSS with advice to take reasonable steps to contain the incidents and to consider any steps to mitigate the impact and support the individuals affected.
3.9.2 Progress Review Comments
The PRSA Implementation Team note that there has been no change under this element.
Thank you for providing an update on reported data breaches and outcomes.
No immediate action required. Update requested on any future change.
3.10 Element 10: Business continuity and vital records
An authority’s business continuity arrangements should include the recovery of records made temporarily unavailable due to an unexpected event.
| RAG status rating: Green |
3.10.1 Self-assessment Update
No change.
In May 2025 a tabletop exercise was designed and tested. Lessons learnt have been included in the relevant policies procedures and business continuity playbooks. FSS also, took part in the UK wide exercise Pegasus. We did the following during the exercise:
- Activated the Incident Management Framework and Business Continuity Framework
- Linked the Incident Response and Business Continuity functions
- Attended the Food Standards Agency Incident Management Coordinating Group and Scottish Government meetings
- Submitted Daily Situation Reports on staffing, impact, and food safety
3.10.2 Progress Review Comments
The PRSA Implementation Team note that there has been no change under this element.
Thank you for the update on the results of testing FSS’s business continuity arrangements. This indicates FSS’s commitment to ensuing practices remain up to date and that policies and procedures reflect the results of testing and review.
No immediate action required. Update requested on any future change.
3.11 Element 11: Audit trail
The location of records is known and changes recorded.
| RAG status rating: Green |
3.11.1 Self-assessment Update
Continuing to monitor our paper records that are kept on offsite storage and the plan is to transition to digital records on eRDM.
An audit trail is kept for all eRDM files to be permanently destroyed.
3.11.2 Progress Review Comments
Thank you for this update. It is noted that paper records continue to be monitored, and it assumed the tracking of these records through the use of a spreadsheet remains in place. The PRSA Implementation Team acknowledge FSS’s plan to transition to digital records on eRDM. As noted in 2018 at the time of the Keeper’s agreement, the eRDM system in use at FSS will provide audit trails for viewing, modifying, and deleting records.
It is noted that an audit trail is kept for all eRDM files to be permanently destroyed.
3.12 Element 12: Records management training for staff
Staff creating, or otherwise processing records, are appropriately trained and supported.
| RAG status rating: Green |
3.12.1 Self-assessment Update
Not a member of IRMS at the moment.
All FSS staff are required annually to complete the mandatory training for Data Protection.
3.12.2 Progress Review Comments
Thank you for providing this update on staff training and for confirming that mandatory data protection training remains in place for all staff.
3.13 Element 13: Assessment and review
Records Management arrangements are regularly and systematically reviewed with actions taken when required. Section 5(1)(a) of PRSA says that an authority must keep its RMP under review.
| RAG status rating: Green |
3.13.1 Self-assessment Update
No change.
Knowledge and Information Management (KIM) policies and procedures are being reviewed annually. FSS has now an AI policy that was adapted by SG.
FSS staff is kept informed through presentations (Data Protection, Records Management) and regular updates on any changes (eRDM updates, AI).
3.13.2 Progress Review Comments
The PRSA Implementation Team note that there has been no change under this element. This is understood to indicate that FSS continue to keep its RMP under review as required by the Act.
Thank you for the update confirming the annual review cycle of FSS’s Knowledge and Information Management (KIM) policies and procedures, the new AI policy and how updates are communicated to staff. This demonstrates a commitment to ensuring records management arrangements are regularly reviewed and that staff are kept up to date.
No immediate action required. Update requested on any future change.
3.15 Element 15: Public records created by third parties
Adequate arrangements must be in place for the management of public records created and held by third parties who carry out any functions of the authority, see section 3 of PRSA.
| RAG status rating: N/A |
3.15.1 Self-assessment Update
All public records created by our third party contractors, data processors or delivery partners are held and managed on our line of business applications and database.
Reports and records created by third parties on our behalf are securely kept on eRDM or published on the FSS website.
Contracts, MOUs, Data Protection Impact Assessments (DPIAs), Data Sharing Agreements (DSAs) are also produced to govern the creation and processing of public records by third party organisations on behalf of FSS.
3.15.2 Progress Review Comments
Thank you for this update.
As this Element was not assessed separately in 2018, at the time of the Keeper’s agreement, no RMP baseline RAG-status exists. However, the PRSA Implementation Team acknowledge that the update indicates FSS is aware of responsibilities under this element.
If you would like more information around this please contact public_records@nrscotland.gov.uk.