66
The Data Protection and Information Governance Officer for Scottish Enterprise has overall responsibility for monitoring and ensuring organisational compliance with Data Protection legislation and wider organisational Information Governance. Policies and guidance are in place to ensure that Scottish Enterprise meets its legislative and procedural obligations and all colleagues are required to undertake annual data protection training.
Statutory compliance includes reporting reportable data protection breaches to the Information Commissioner's Office and other Supervisory Authorities where relevant. During 2025-26 Scottish Enterprise had no reportable data breaches (2024-25: one). All internally reported incidents (for example misdirected emails) are assessed and actions are taken where necessary to minimise impact and recurrence.
Scottish Enterprise manages its operational offices in accordance with the Scottish Government's Asset Management Policy and the Single Scottish Estate Programme. The Scottish Enterprise property portfolio includes our current operational premises. Our strategy is to ensure assets are utilised in the most efficient and effective manner possible. Scottish Enterprise works closely with the Scottish Government and the Smarter Workplaces team at Scottish Futures Trust to achieve this aim. Our accommodation strategy seeks to right-size the number and capacity of our offices to reflect their current and anticipated future use. We work with partners to ensure that we maximise the potential for co-location with other public bodies and other organisations that share SE's strategic objectives.
Scottish Enterprise's Risk Management Policy was updated during 2024/25 and sets out a clear and consistent approach to risk management, including risk appetite, specific roles and responsibilities and the key steps in the risk management process. The Policy is aligned with the risk management requirements of the Scottish Public Finance Manual, the UK Government's Orange Book and best practice. The operation of the policy is reviewed by the Audit and Risk Committee to ensure it continues to support the effective and efficient operation of the organisation, helping to respond to business risks and to implement adequate controls. In accordance with the Risk Management Policy, the Board determines the level of risk we are willing to accept in the pursuit of our objectives and obtains assurance from management that risks are being managed accordingly within our appetite.