Guidance on general principles of the data protection act can be found on the Information Commissioner’s Office website.

Transfer of functions may require revision of either organisation’s notification of personal data to the Information Commissioners Office (ICO) so current notifications should be checked with this in mind. When a function has been transferred but the records have not, the transferring organisation becomes the data processor and the receiving organisation becomes the data controller.

Data processor duties and obligations should be specified in an agreement on storage and should cover secure storage under Principle 7. Protocols should cover action required of the data processor in response to subject access requests. Any records that are being transferred to The National Archives should undergo a sensitivity review for personal data, to determine if an application for closure under s 40 of the FOI Act should be made.

For Freedom of Information (FOI) purposes, once a function has been transferred, records still held by the transferring organisation are considered to be held on behalf of the receiving organisation. Responsibility for compliance rests with the receiving organisation, which will need information about access issues surrounding series of records – what FOI exemptions have been applied and what complaints have been made to the Information Commissioner.

The position with the Environmental Information Regulations (EIR) is slightly different in that the organisation holding the records is responsible for compliance. Arrangements must be made to involve the Department with the policy lead – the receiving organisation – in any decisions to disclose or withhold information until the records have been transferred to it.

Particular issues arise in respect of records originating from third party organisations, for example international bodies, or where policy issues concern a number of departments or agencies. The organisation handling the request will need to ensure that all necessary consultations take place in the event of an FOI or EIR request. The transferring organisation will need to share information about contacts that they consult about these issues.

Some things will be essential whatever happens to the records. Responsibilities must be clearly defined so that staff in both organisations know what action they will be expected to take in any of the circumstances set out below.

Handover or guidance notes prepared by the transferring body should include:

• staff directory details indicating who is responsible for particular functions
• contact points for help during the transition period and, if applicable, subsequently
• an alert to when and for which records third parties might need to be consulted about disclosure decisions, with contact details
• details of previous requests that seem relevant, of exemptions and of the records likely to contain exempt information
• guidance on likely future request areas

FOI publication schemes

The transfer of functions may mean revising the Publication Scheme of either organisation. Schemes should be reviewed and revised as necessary.

FOI requests received before the transfer of functions

FOI requests received before the transfer of functions but which are not yet completed are known as ‘live FOI requests’ and they become the responsibility of the receiving organisation.

The transferring organisation should:

• provide details of live requests, including who is handling them, to the FOI officer of the receiving organisation.

The receiving organisation should:

• enter the case details in its FOI tracking system
• make sure policy officers handling requests are made aware of their new organisation’s guidelines, procedures and pro forma, and in particular whether draft replies must be sent to the FOI officer for clearance before despatch
• ensure that the applicant is told why the reply is being sent from a different organisation
• if there will be a delay in completing the public interest test, ensure the applicant knows who to contact for updates

Both organisations should:

• develop protocols to advise and exchange information and knowledge in relation to requests for a transitional period, designating staff to liaise on this

FOI requests received after the transfer of functions

These requests are the responsibility of the receiving organisation. The FOI Officer of the receiving organisation will need details of policy staff so that requests can be allocated appropriately or advice sought on allocation. Policy staff must be made aware of the guidelines, procedures and pro forma they are expected to use.

If any records have remained with the transferring organisation, protocols will be needed to provide for:

• advice as to the likely whereabouts of records relevant to the new FOI request
• searches of the records for relevance to new FOI requests by staff of the transferring organisation or provision of access to them to staff of the receiving organisation

Current FOI complaints and appeals

Complaints to the Information Commissioner’s Office (ICO) should be handled by the receiving organisation, even though it was not the body that handled the original FOI request.

The transferring organisation should:

• alert the receiving organisation to all active complaints and appeals and provide relevant paperwork
• provide details of the original case, including copies of correspondence and of the information provided or refused
• explain to the ICO that it has transferred responsibility for the complaint because of the transfer of function
• provide advice on request

The receiving organisation should:

• deal with the complaint
• consult the transferring organisation

With appeals to the Information Tribunal, the appeal is against the ICO, not the body involved in the original requests. An organisation can apply to be joined with the ICO if necessary and the receiving organisation should consider whether the issues are such that it should apply to be joined. Details of the original request and the ICO complaint will be required from the transferring organisation.

Past FOI requests, complaints and appeals

The transferring organisation should provide details of what has been disclosed or refused previously, and what exemptions have been used. This will be needed by the receiving organisation if similar requests are likely to be received.

Current and new EIR requests

The organisation holding the records is responsible for compliance. Until the records have been transferred the transferring organisation should complete all necessary action but should consult the receiving organisation to ensure that disclosure decisions take account of its policy concerns.

While it continues to hold the records the transferring organisation should:

• consult the receiving organisation about disclosure or non-disclosure of information

The receiving organisation should:

• provide views on disclosure or non-disclosure within statutory deadlines

If the records are transferred before action is complete, the transferring organisation should:

• provide details of live requests to the FOI officer (or the EIR officer if different) of the receiving organisation
• provide advice on the likely whereabouts of relevant records

The receiving organisation should:

• enter the case details in its tracking system
• make sure policy officers handling requests are made aware of their new organisation’s guidelines, procedures and pro forma, and in particular whether draft replies must be sent to the FOI/EIR officer for clearance before despatch
• ensure that the applicant is told why the reply is being sent from a different organisation

Current EIR complaints and appeals

Complaints and appeals should be handled by the body holding the records, even if it is not the body that handled the original request.

While it continues to hold the records the transferring organisation should:

• consult the receiving organisation about disclosure or non-disclosure of information

The receiving organisation should:

• provide the Department’s views on disclosure or non-disclosure within statutory deadlines
• if it believes significant issues are involved in an appeal to the Information Tribunal, consider applying to be joined with the ICO

If the records are transferred before action is complete, the transferring organisation should:

• inform the ICO that responsibility for compliance has been transferred
• provide details of the case to the receiving organisation

The receiving organisation should:

• respond to the ICO or the Information Tribunal as necessary
• if it believes significant issues are involved in an appeal to the Information Tribunal, consider applying to be joined with the ICO

Transferring organisation

A major change of function will have a significant impact on the transferring organisation, and even a minor transfer will mean some upheaval for the staff immediately involved – they may be required to move to a new location and learn new systems and methods. Some jobs may be changed or even abolished. Knowledge networks may need to be rebuilt to enable remaining staff to function effectively.
As part of the transferring organisation’s responsibility to ensure the information required for a smooth transition is identified and prepared for transfer, they will need to consider capturing knowledge which is not written down or held in a formal way. This includes knowledge about the history of the function which is at risk of being lost if staff do not move with the function.

Useful tools for capturing this information include:

A function statement

This should be drawn up by the existing staff and should explain who they are and what they do. It should cover:

• the public task of an organisation
• purpose
• goals
• recent achievements
• introduction of collective knowledge/expertise
• risk register for current and planned activities with management strategies and contingency plans

Handover notes

These should include information about the way business is conducted and a list of key contacts. This is especially important if staff are not moving with the function.

Questionnaires

These should be given to transferring staff where necessary with the purpose of gaining knowledge of records, processes and contacts. Suggested questions include:

• What key skills do you have that enable you to do your job?

• What are the key resources you need to do your job?

• Is there anything that would help you function more effectively?

• If your job didn’t exist what would happen?

• Who are your key contacts internally/externally?

• Who are your customers internally/externally?

• What service do you provide to them?

Risk register

This should include current and planned activities with management strategies and contingency plans.

Maximum use should be made of existing knowledge management tools such as corporate directories and intranets to ensure that all those affected are fully informed of the changes. Explore the possibility of using social media tools (such as Wikis, blogs, instant messaging, podcasts, social bookmarking, knowledge networks) to maintain existing knowledge networks.

Receiving organisation

The receiving organisation will need to provide accommodation, equipment and training for incoming staff, and inform existing staff of the new arrangements.

When staff are moving with the function, it is important that they receive full training in the new organisation’s records management systems and procedures.

 Communications plan

This should be devised to keep staff informed of changes. This could include:

• a launch session
• briefing on the machinery of government change
• publication of the function statement
• welcome packs for new colleagues
• a welcome email introducing key figures in the organisation, explaining aims and objectives and advertising corporate services
• inductions for all new staff (including senior staff)

Corporate directories should be updated before the date of transfer.

Both organisations should undertake a joint appraisal of storage costs once records have been identified for transfer. The aim of this should be to find the most cost-effective option.

The appraisal exercise should identify the costs of the current storage arrangements, which may take a number of forms:

• one or both organisations store files on their own premises
• both use the same third party contractor to store files
• they use different third party contractors

The appraisal should look at a range of solutions, for example:

• moving documents to the storage used by the receiving organisation
• leaving documents in their existing location
• the possibility of continuing with existing contracts, for example the transferring organisation passing parts of its contract to the receiving organisation
• any cross-governmental savings that can be made by sharing storage services

Costs to consider:

• removal from storage – as well as the costs of the physical move, most storage contractors impose a charge to remove boxes from storage
• indexing – removal of a file to a new location will involve updating location indexes

What records should be transferred?

There are a number of options for transferring the relevant records to the receiving organisation.

Transfer all information less than 20 years old

In order for organisations to fulfil their statutory responsibilities under the Public Records Act, they need to transfer all records worthy of permanent preservation to The National Archives no later than 20 years after the record was created.

If the transferring organisation has records that are older than 20 years, with the agreement of the receiving organisation, it could retain these records and carry out the process of appraisal and selection and transfer these to The National Archives following the usual process.

Transferring only the information less than 20 years old would ensure that the receiving organisation does not inherit a review backlog. It may also slightly reduce costs as fewer records will need to be handed over to the receiving organisation.

Conduct an early review and transfer only records of value to the receiving organisation

The transferring and receiving organisations could jointly carry out an early review of the paper records, taking into account business and long-term historical value, and statutory retention requirements. Existing retention/disposal schedules should also be referred to during this process.

This option may not be appropriate, however, if large numbers of files are to be transferred or there is only a short time to complete the transfer. It is the most resource-intensive option as staff time will be needed to carry out the review, added to the cost of disposal. However, if the volume of records to be transferred can be reduced, transfer, indexing and storage costs may be significantly lower over time.

Transfer all records regardless or age of value

If a machinery of government change has to happen very quickly then the decision may be made to transfer all paper records to the receiving department regardless of age or value. This is the simplest and quickest option but depending on the amount of material to be transferred, it could have substantial cost implications for both the transferring and receiving organisations. Also, if any of the records for transfer are over 20 years old, the receiving organisation may not wish to inherit records that could potentially put it in breach of the Public Records Act.

Find guidance on appraising and selecting records for permanent preservation.

Finding aids, reference material and metadata

The transferring department must ensure that all finding aids, reference material and metadata around the paper records are transferred along with the records. These include, but aren’t limited to:

• card indexes, docket books and other finding aids
• retention/disposal information relating to records of the function
• zero files
• appraisal information, for example, selection criteria, information on past reviews
• paper files relating to databases
• printed guidance or manuals relevant to the function or relating to databases

The team responsible for digital records will need to identify the relevant records and information at the outset, including those stored on:

• electronic documents and records management systems (EDRMS)
• business systems (such as HR systems, case management systems)
• websites and intranets
• collaboration systems
• shared drives
• personal drives and hard drives
• email systems
• CDs or other removable storage devices
• social media sites maintained by the business unit
• externally hosted information (with particular consideration for access, such as passwords and contracts with third party providers)
• structured data (datasets, GSI systems)

Select records and information for transfer based on their business need, current and future business value, as well as potential historical value. Ensure close consultation with business units when making decisions about which records and information are transferred. Use What to Keep schedules, Appraisal Reports and Operational Selection Policies to help select the relevant records.

Migrating information from one form of data structure and technology application to another can increase the risk that you will lose:

• content and context of information
• ability to access information

For more information about mitigating these risks please read our digital continuity guidance.

Plan and manage migration carefully to ensure:

• the receiving organisation understand how information is used
• the completeness, availability and usability of information is maintained throughout the migration process
• risks involved in migrating information are recognised and mitigated
• no digital information is destroyed until it is loaded successfully into the new operating environment and has been quality checked

Options for transferring digital information:

Transferring the whole system to the receiving organisation

If the whole system contains information relating to the business function being transferred then it may be appropriate to transfer the whole system to the receiving organisation.

In this case, the licence and ownership of the business system will need to be transferred and there will need to be discussions with the system developer as well as the IT teams in both the transferring and receiving organisations.

Leaving the information where it is

The transferring organisation may be able to continue holding the information as a service to the receiving organisation. Although no physical migration would occur, ownership of and responsibility for the information would transfer to the receiving organisation. The precise rights and responsibilities of each organisation would need to be established in an agreement or memorandum of understanding. Any agreement would need to consider intellectual property rights, Crown copyright and database rights, use and re-use of information as well as FOI and DPA legislation.

 Transferring the information to The National Archives

Consider transferring information to The National Archives if the information is no longer in active business use and has been selected as being worthy of permanent preservation. Contact your Information Management Consultant to discuss the potential of transferring this information to The National Archives.

Disposing of the information

If the information is no longer required for ongoing business use by the receiving organisation and the information is not worthy of permanent preservation, disposing of it is a preferable alternative to transferring the information. This should be done in line with our  disposal guidance and in consultation with your Information Management Consultant.

Migrating systems

Before systems are migrated:

• know what version of what system is in use in both the receiving and transferring organisations
• know the information architecture used in both systems and in both organisations
• know the file formats used in the system (if migrating data from shared drives, use DROID to identify the file formats and duplicates)
• know the volumes of information to be transferred and received so that resources can be allocated accordingly taking into account government data handling and data security
• ensure that software and hardware licenses are transferred along with the records
• provide an administrative history or brief regarding the evolution of the function to accompany the transfer

While preparing to migrate systems:

• ensure a backup of the information and records to be transferred has been created before the migration process takes place
• transferring organisations should not transfer redundant or duplicated information to the receiving organisation. Any redundant or duplicated information should be destroyed, in line with guidance on keeping and disposing of records, Operational selection policies or other guiding retention and disposal documents
• ensure that the format used for migrating the data is known and make sure that the receiving organisation is able to receive and support this format
• both organisations should agree what the minimum mandatory metadata requirements are and map these metadata fields against each other before migration
• know the minimum metadata elements that the transferring organisation can export and the receiving organisation can receive

Transferring digital information securely

• export the data securely, for example via a Secure File Transfer Protocol (SFTP) or an encrypted High Density Drive (HDD). Both organisations will need to determine the appropriate transfer mechanisms. If using encrypted HDDs, the transferring organisation will need to send these via secure courier and provide a decryption password separate from the HDD. Never transmit the HDD and password together. If using SFTP, the transferring and receiving organisations will need to agree a transmission time for the secure transmission of information
• If an HDD is used, the transferred information will need to be held in a non-networked computer until the appropriate virus scans have been provided and quality checks on metadata carried out
• If SFTP is used, it will need to be transferred to a computer that is not attached to the wider IT network to safeguard against viruses.

Please note that iron keys, USB keys or thumb drives are not secure methods for transferring digital information between government organisations.

Acknowledgement of receipt of records:

• ensure that the completeness, availability and usability of the information (and its metadata) throughout the migration process
• no records can be destroyed by the transferring organisation until confirmation of receipt and accessibility has been confirmed by the receiving organisation

Email

Emails form an important part of the records relating to government functions. They should be managed in line with our guidance on managing email.

You may be required to transfer emails during a machinery of government change. For more information, please contact your Information Management Consultant.

 Datasets

Datasets related to a function will need to be identified and listed. Datasets can be found in:

• databases
• intranets
• websites

Consulting closely with the business unit, decisions will need to be made about which of the datasets should be transferred. Datasets should be selected for transfer based on whether they are still required for ongoing business purposes and/or they have been identified as records worthy of permanent preservation.

Published datasets

If the dataset being transferred is published (for example, on a website) it can be downloaded from the website in machine readable format and then be transferred to the receiving organisation.

If the dataset is published on the website please see our advice on websites.

Unpublished datasets

If the dataset is unpublished the organisation can transfer the entire database provided the receiving organisation is capable of loading and running the database. Alternately the dataset can be migrated from the database and transferred to the receiving organisation, as a flat file.

The transferring organisation needs to provide guidance on the FOI and DPA requirements related to the dataset or database.

Transferring organisations should:

• ensure that website content sits within the context of the receiving organisation from the moment responsibility is handed over
• ensure they are aware of where all their web content is published online including all non GOV.UK presence such as campaign websites and social media (for example Twitter, YouTube, Instagram, Medium)
• understand where and when any online content may need to be altered substantially or closed and take the appropriate steps to ensure that information is not lost as a result

Where an organisation’s web content is solely published on GOV.UK, any changes required e.g. to departmental name or status, role holders or policy area ownership can be handled with the help of the Government Digital Service (GDS) through their established processes.

Websites outside of GOV.UK

For websites and social media accounts outside of GOV.UK, organisations should apply best practice to redirecting customers from the old domain, with an explanation of what has happened. They should keep this in place for a set period of time that is made clear to the user. Communications and marketing should support this to ensure that machinery of government changes do not affect customer services or the customer journey.

Web archiving

The National Archives captures snapshots of all UK central government websites regularly. Most websites are captured in full at least once every six months. This should be sufficient to capture significant documents and information in most cases.

However, The National Archives can help by archiving a final copy of the website before any machinery of government changes are made. Contact the Web Archiving team at The National Archives at least eight weeks before the planned change in order to agree the most suitable approach.

The web teams in both transferring and receiving organisations should check that their websites and social media channels are included in the UK Government Web Archive. You can do this by accessing the A-Z list or through the Web Archiving team

Please be aware that not all content on the live website is capable of being harvested into the Web Archive. In particular content which requires user participation such as a login, or any selection filtering by the user before downloading, cannot be captured. The National Archives carries out an extensive quality assurance process to ensure that the harvest is as complete as possible. However if departments are relying on any particular content to be archived, they should check – before removing the content from the live site – that the content has been preserved in the web archive. Tips on finding content in the web archive are provided on The National Archives’  website, including a bookmarklet that you can add to your browser to check the web archive for a known URL quickly.

Full guidance for web teams is provided on our web pages. It includes guidance for managers of websites which are closing and guidance on how to make your website web archive compliant.

Transferring information is a complex and demanding project, so it is vital that there is a clear plan and it is managed well. Your transition plan should include the following steps.

Planning

Start planning for the transfer of information as soon as there is a decision about any machinery of government changes.

You will need to:

• define outcomes and success measures
• assess and manage risks: to the security, completeness, availability and usability of information
• comply with legislation
• identify the required and available resources and capabilities
• ensure that the senior management of the transferring organisation, their parent department (if applicable) and the receiving organisation understand what is required, understand their legal obligations and responsibilities, and allocate appropriate resources
• refer to published guidance and best practice and contact other organisations that have undertaken similar work
• ensure the long term survival or availability of the information for future public use
• consider whether any legal instrument transferring public functions is the right way to handle information management issues. Primary or secondary legislation may already provide for the transfer of other types of property for example intellectual property

Define roles and responsibilities

The team responsible for the transfer of information should include officers from transferring and receiving organisations as well as relevant suppliers and should ensure they:

• identify and draw on relevant expertise within both the transferring and receiving organisations
• define who will do the tasks identified during the planning stage
• define joint and individual roles and responsibilities
• define ownership of the information at each stage of the process

Decide what to transfer

You will need to decide what information should be transferred (or loaned) and to where. Transfer all information of continuing business use to whoever is taking over that function, whether an agency, the parent department or another organisation. Transfer information of archival value to The National Archives and dispose of any information (using the appropriate disposal and retention guidance) that has no continuing business use and which is of no historical value.

Ensure you consider information in all formats and media such as:

• paper files, digital records
• emails, websites, intranets
• copies (publications, backups and so on)
• shared drives, databases
• tape or CD collections, photographs, film

It is important to capture the knowledge of staff from the original organisation, particularly if they are not transferring with the function. Ensure that arrangements for the management of websites and their content including datasets are made and that issues relating to copyright have been addressed.

Define requirements

The receiving organisation will need to continue to be able to find, open, work with and understand the information. This depends on the files themselves, their contextual and management metadata, and the technology that supports their use.

You will need to:

• define usability requirements for information to be transferred
• identify dependencies on supporting information or technology:
  • metadata, indexes, documentation
  • asset registers, audit records, retention schedules
  • protective markings and access controls
  • supporting technology and licences
• test against usability requirements throughout the transfer process

Comply with legislation

You will need to:

• identify all relevant legislation, such as the Data Protection Act (DPA), Freedom of Information Act (FOIA), Environmental Information Regulations (EIR) and Public Records Act
• identify all relevant sensitivities within records being transferred for example under FOIA and DPA
• clarify responsibility for requests, complaints and appeals (FOIA and EIR) and prepare handover or guidance notes
• maintain compliance with data handling guidance and the Security Policy Framework throughout the process
• secure information assets for the public good by being aware of what information is subject to Crown copyright, and that such information is not passed beyond Crown control unless safeguards or assignments are in place

Deliver savings and efficiencies

Consider shared service options for data storage or information systems in order to capitalise on opportunities to increase efficiency and make savings.

Ensure that disposal policies are followed so that resources are not spent transferring information that is no longer required for business use or historical preservation.

Download our checklist for transferring organisations

Download our checklist for receiving organisations

Download our template transfer agreement