Data retention policy

1. Introduction

1.1 Records management is essential for the efficient conduct of business and adherence to legal obligations. The University is committed to establishing and maintaining good records management to ensure that it retains important information while also ensuring that data no longer required is disposed of in line with its obligations under Data Protection legislation. A robust records management process also ensures that the University can fulfill disclosure requirements to data subjects and also under the Freedom of Information Act (2000).

1.2 This policy supplements the University’s data protection policy and should be read in conjunction with it. It should also be read in conjunction with the information security policy and guidance on email usage.

2. Records

2.1 Records can be defined as ‘Information created, received and maintained as evidence and information by an organisation or person in pursuance of legal obligations or in the transaction of business’ (ISO 15489).

2.2 Records are an essential resource and contain information which is unique and invaluable. They can be used as an audit trail as they provide evidence/proof of a specific activity. Records come in electronic (including emails, video and audio materials) and paper format. It is important that both types must be managed equally well, especially in terms of storage, accessibility and disposal.

2.3 Records should be managed in accordance with the principles below:

• Records: Records are evidence of our actions and decisions and must be retained as long as required
• Responsibility: All staff have responsibility for records and should be aware of what they are using and creating and how they should be retained
• Risk: There are significant risks from loss, damage or unauthorised access which need to be managed effectively. There are also risks from loss of control of records
• Retention: Keep records only as long as they are needed
• Rights: The public has a right to access our records subject to data protection regulations and freedom of information exemptions
• Reliability: Records should be managed effectively to ensure that they are high quality and reliable

3. Retention schedule

3.1 The purposes of retention schedule are to:

• Improve efficiency of working practices and enable easy and speedy retrieval of records;
• Prevent records from being discarded prematurely;
• Ensure that information is not kept unnecessarily;
• Eliminate retention of duplication of records;
• Provide a consistent, controlled system for the disposal of material across the University;
• Help in saving space, time, effort and money;
• Comply more readily with requests for information, both internally and externally (e.g. request made under data protection legislation or the Freedom of Information Act 2000).

3.2 A properly implemented and consistently applied records retention schedule improves the efficiency of working practices, and protects the interests of the University by ensuring that records are not kept for longer than they are needed to meet operational needs.

3.3 The University does not keep all records permanently. Only records which have, evidential, legal, historical or business importance are retained for a specific length of time or permanently (in limited cases). The time periods for retention are outlined in the retention schedule.

3.4 Multiple copies of records should not be retained. Extraneous copies of paper documents are to be disposed of. Where these include personal data or confidential information these should be disposed of securely in a confidential waste bin or shredded. Only one copy of the document is therefore retained for retention purposes. This also applies to emails. Key emails should be retained and care is taken to establish which should be maintained and which deleted.

4. Staff responsibilities

4.1 Heads of Schools and central service departments have overall responsibility for the management of records generated by activities within their departments.

4.2 The Head of HR and the Academic Registrar have particular responsibility to ensure the integrity of the staff and student records respectively. The Director of Alumni and Development is responsible for managing alumni records and those of donors while the Head of Admissions is responsible for applicant data.

4.3 All staff that create, receive and use documents have record management responsibilities. Each member of staff is responsible for ensuring that records within their control are not kept permanently, unless they fall within the various categories listed in the retention schedule and need to be retained for archival purposes.

4.4 All staff should be aware that they are creating records through their work and ensure that these are secured and disposed of appropriately, including emails. They should establish which emails are key records and act accordingly.

5. Format of retention schedule

5.1 The retention schedule which forms part of this policy has been prepared to assist in the effective management of records by identifying types of documents held by each School/College and central service departments which require retention, setting out the retention period for each type of document, who is responsible and the reasons for keeping it.

5.2 The records retention schedule can be found in Appendix A. The information is organised by class which relate to the type of record. In each class a list of records associated with the business function responsible for the class is provided, along with the retention period applicable to each record and the justification relating to the retention period.

5.3 The retention periods are independent of format and therefore apply to any medium whether paper or electronic records.

5.4 There is an “Owner of Records” category which identifies the head of each School, department or support service who has overall responsibility for the management and disposal of the record. The owner of the record is responsible for the implementation of the retention policy within their area of responsibility must ensure that records are managed in accordance with the schedule and disposed of when required on an annual basis.

5.5 Where documents do not fall within the various categories set out in the retention schedule, advice should be sought from the University Secretary.