The external review looked at the use of WhatsApp and personal devices to conduct government business.
It was led by former Channel Islands data protection commissioner Emma Martins.
Her report, which was delivered to the government last month, was published alongside Forbes’ statement to parliament.
The report found there was “little to evidence a consistent and widespread knowledge, understanding, or application” of mobile messaging apps, “including rules around retention, exportation, and deletion”.
The Scottish government’s policy required ministers and officials to transcribe “salient” points from business discussions on mobile messaging apps
Ms Martins said: “In the absence of any information about how much or how often such transcribing took place, it is impossible to take any comfort from the policy.”
While she acknowledged the “unprecedented challenges” of the pandemic could lead to the circumvention of some government rules, she said it was not “acceptable” for changes to procedures to remain in place “without proper scrutiny and review”.
