Compliance with laws and regulations like GDPR and CCPA requires a comprehensive analysis of existing retention schedules, your company’s data inventory and data maps.
Records retention is first and foremost about complying with laws and regulations. However, a retention schedule, when properly developed and utilized, is not simply a tool that tells us how long we must keep our records, it is a record itself that provides powerful insight into the information lifecycle and knowledge management capabilities of our company as a whole. It also saves us money on storage and helps shape the way we curate our information.
A retention schedule reflects the doings of the business, the facts of its output as measured on paper and in database tables. With this one tool we can decommission legacy systems, identify and refine workflows related to our information life cycle, know where our information lives, reduce risk and help our employees enjoy working with information resources.
- What documents need to be retained and for how long?
- In what cases are paper records still necessary?
- What are the sanctions for non-compliance?
- In what circumstances can/must documents be destroyed?
- Who may documents have to be handed over to?
- What is our duty to preserve?
- How can retention assist me with electronic disclosure (e-discovery) orders?
- How long do we keep records in each country my company operates in?
- How will jurisdiction specific privacy requirements impact us?
- For larger enterprises a consultant may begin by building a Records Retention Committee made up of representatives and stakeholders.
- For smaller organizations a consultant might work with your designated point of contact such as a Records Manager. Together, you build an interview schedule with your subject matter experts and record custodians to help them understand how the records they use might impact your retention periods.
- While interviews with your subject matter experts are being calendared we begin to evaluate your existing policy and schedules, if any, analyze your global record keeping procedures, document your record classification and file plans, perform legal research into your retention, privacy and media requirements and identify your target employees for eventual training.
- Retention schedules will identify your company’s record types, record descriptions, retention periods and triggers, state and federal regulatory citations, reflect the office and systems of record, and provide other practical information such as whether the record is historical or requires special attention. These schedules are generally provided in either Microsoft Access and Excel formats to best support system integration.
- A periodic regulatory and legal review of your schedule
- An annual offsite storage inventory report and process to identify records eligible for destruction
- IT System Administrator meetings twice per year to review purging opportunities for ESI based on the schedule
- Managing requests for changes to the schedule and for general guidance
- Coordinating record clean-up days
Planning communications and implementing training
A good consultant will clients step-by-step through a strict yet flexible set of communications guidelines and training initiatives that make the benefits of your records retention program evident to employees up and down the chain of command. Frequently companies begin our post schedule publication phase with an executive level communication that may include:
- Notification of the policy
- Benefits of the schedule to all employees
- Notification of upcoming training(s)
- Link to records retention page / resources / FAQ’s on a corporate intranet
Build retention resource and training sites for all of our clients from which to command their program. Initial training for large enterprises often takes place over the course of 1 year (from approval) and are broken into groups:
- Corporate Wide (optional/on-boarding) – No formal meetings or training sessions. Corporate-wide training video, resources and guidance provided via email distribution, intranet and one-on-one management training
- Records Program Customers – Trained annually – Five 1 hour classroom sessions. Contact info available through intranet
- Other Personnel – Trained annually – 1 hour classroom session. Contact info available through intranet
- IT Staff – Trained annually – 1 hour classroom session. Contact info available through intranet
DATA INVENTORIES AND DATA MAPS
A records inventory is a detailed listing of the volume, scope, and complexity of an organization’s records, usually compiled for the purpose of creating a records schedule. An inventory can be used to analyze your records for various purposes including improving access, document retention and protection.
Process At A Glance
- Define the inventory’s goals. While the main goal is gathering information for scheduling purposes, other goals may include preparing for conversion to other media.
- Define the scope of the inventory; it should include all records and other materials.
- Obtain top management’s support, preferably in the form of a directive, and keep management and staff informed at every stage of the inventory.
- Decide on the information to be collected. For electronic records we also include:
- Name of the system
- System control number
- Agency or department / division /program supported by the system
- Purpose of the system
- Data input and sources
- Prepare an inventory form, or use an industry standard.
- Decide who will conduct the inventory and train them.
- Identify where your organization’s files are located, both physically and organizationally.
- Conduct the inventory.
- Verify and analyze the results and provide our client with the resource and tips on how to manage inventory going forward.