FOI/202600507135 · FOI · released
Information regarding software based data destruction assurance: FOI release
Information requested
Information regarding software based data destruction assurance used by the Scottish Government.
The questions are listed below with the responses directly below each numbered item.
Response
I enclose a copy of the information you requested in the text below. The questions provided appear below in the exact order provided. All of the questions have been typed in bold to help differentiate between the questions posed and the answers provided.
1. Please confirm whether departmental policy, contractual terms or internal procedures require an explicit outcome based warranty or guarantee confirming that personal data has been rendered irretrievable through software based erasure, whether carried out internally or by an external provider.
No. Scottish Government policy and contractual terms require secure and compliant data erasure, but they do not mandate a separate, explicit outcome based warranty.
2. Where software based data destruction is performed internally, what recorded evidential assurance does the department rely upon to conclude that the final data state is irretrievable?
This process is not carried out internally. All our devices are sent to a 3rd party for secure data erasure.
3. Where software based data destruction is performed by a third party provider, does the department hold recorded information demonstrating that any warranty or assurance provided explicitly extends to the software erasure method used and its claimed effectiveness? If so, please confirm the recorded nature of that verification.
Yes. Scottish Government holds recorded assurance confirming that the provider’s certified erasure process is effective and that documented evidence is supplied for each device.
4. Where no explicit outcome based warranty is required or provided, what recorded form of evidential assurance does the department rely upon to conclude that software based erasure has rendered personal data irretrievable?
Scottish Government relies on documented erasure certificates, asset tracking records, audit compliant process evidence, and compliance with recognised information security standards.
About FOI
The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at https://www.gov.scot/foi-responses.
Contact Please quote the FOI reference Central Correspondence Unit Email: contactus@gov.scot Phone: 0300 244 4000 The Scottish Government St Andrew's House Regent Road Edinburgh EH1 3DG
Attachments
No attachments found.