Here at filerskeepers, we have the creation of a retention schedule down to a ‘fine art’. But what is an effective retention schedule? How do you implement one? And what are the benefits of having an effective retention schedule in place?
Developing an effective retention schedule
Anyone can create a retention schedule. However, many people try to tailor someone else’s to fit their own business. You can’t just borrow another organization’s schedule and make it your own. This approach has the potential to go very wrong. This is because you need to understand multiple factors. Developing an effective records management retention schedule involves a structured approach. Initially, you’ll need to identify all types of records generated by your organization. The next step is to categorize them based on their content and purpose.
Ensuring your retention schedule is aligned with all legislation both locally and across your entire business is tricky. However, once you have consulted some experts on the topic, you’ll be flying (hi!). That said, if your business goes across multiple countries/states, it becomes even trickier. There are going to be a lot of factors to consider before you can confidently get it signed off. That’s right, no retention schedule should be implemented unless it’s been approved by the board.
Balancing Act:
The balancing act between different countries’ legislation can be particularly hard to navigate. This is especially true when the legislation doesn’t give you a retention period in the first place. What if they give you a retention that has a year, but also has a risk-based decision to trigger it?
e.g. The General Data Protection Regulation has retention within it but is legislation ever straightforward?
Article 5(1)(e) states:
“1. Personal data shall be:
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’).”
The above quote basically means that you cannot keep personal data longer than necessary. This necessity is based on the purpose of collection.
Some UK legislation has a trigger that states “6 years from the point at which they knew”. How do you make that decision?
We need to strive for a balance between retaining records for compliance and operational needs while avoiding unnecessary storage costs and legal risks associated with keeping records longer than required.
Documentation:
Maintain thorough documentation of your retention schedule, including the rationale behind each retention period. This will be crucial for audits and demonstrating compliance. You can show retention documentation by providing the citation from which you’ve derived your retention. However, in general, you need to be documenting your decisions in related policies and processes. You’ll need an end-to-end approach to ensure proper retention. This includes ensuring that any proposed destruction is reviewed.
Benefits of having a well-managed schedule
With a well-managed retention schedule, you’ll be able to; reduce legal risk, make cost savings, enhance your organization’s efficiency, retain records that enable the company’s history to be retained, and potentially minimize any unauthorized access to sensitive information.
- Reduced Legal Risk:
Compliance with retention periods reduces the risk of fines and penalties by ensuring records are disposed of in accordance with regulations. You can’t misuse data if it doesn’t exist anymore. You can’t be in trouble for keeping it longer than you should if it has been destroyed. It’s important to recognize that you shouldn’t go overboard and that you should balance legal risk with the benefits of retaining records. It’s worth noting that it’s not a bad thing to have data, you just need to weigh up whether you really need it or not.
- Cost Savings:
Properly managing records reduces the need for excessive storage space and helps allocate resources more efficiently. Costsavings will take time to become apparent and shouldn’t be the main focus. Although it is worth noting that there can be quick financial wins from freeing up storage space and staff time.
- Enhanced Efficiency:
Employees can locate and access relevant records in less time, boosting productivity and streamlining operations. When records are physical, a staff member may spend hours in the basement searching for a file! The cost of this in man hours can be excessive. The same goes for digital records; when someone uses the search function and it’s not on the first page of suggested files. It can be embarrassing to the organization when you’re unable to help a patron quickly. This can lead to poor efficiency when multiplied across a large number of people. No organization wants to be labeled slow and, by removing superfluous records, you’re decluttering basements and digital assets.
- Data Privacy:
Disposing of unneeded records minimizes the potential for data breaches or unauthorized access to sensitive information because it no longer exists. Pressing on the delete button is a huge thing for an organization though. It’s important to recognise the benefits of a well-managed schedule, but it’s more than having retention periods and destroying the material. It’s about having a full overview of all your data and its state. You want to ensure that data is not siloed and in different places. You need to be able to continue to access it when needed e.g. when a subject access request is received. A thorough understanding of privacy can help ensure that you don’t infringe on it.
How do you implement one?
First things first, your retention policy must be signed off by senior management. It’s important that they understand and buy into this as a policy and understand the ramifications of what it means to destroy records. Your strategy should also align with the aims of the organization. There is no point trying to run the opposite way, or the retention schedule just won’t fit. The retention schedule should be fit for purpose otherwise you are setting yourself up to fail before even starting.
Ultimately a retention schedule is a small cog in a big system. But if that small cog breaks, everything grinds to a halt.
Download our guide to implementing a global data retention policy here.
Stay tuned for more blogs coming on this topic.