Our August 9 blog post addressed how current privacy and security regulatory developments were making the case for implementing processes for the prompt and defensible disposition of your company’s records and information. Before there can be defensible disposition, however, it is first necessary for a company to develop and implement an actionable, right-sized records retention schedule.
- What is an Actionable Records Retention Schedule?
A records retention schedule (commonly referred to as an “RRS”) defines the length of time that all company records should be retained prior to their prompt disposition. The RRS defines the different categories of records retained by your company, and sets forth a required retention period for each such category, based on existing legal, regulatory, contractual, and business requirements. An RRS is made actionable by including additional information directly relevant to the implementation and operation of the RRS, such as information concerning records location and confidentiality level.
- How an Actionable RRS Can Benefit Your Company
An actionable RRS benefits your company by mitigating the risk of over-retention of records after there is no longer a legal or business need to retain them. This not only saves money (i.e., reducing the costs of storing records that are no longer needed), but also helps ensure compliance with the law (e.g., laws that require the disposition of records containing personal data when no longer needed for legal or business purposes). An actionable RRS also helps to mitigate the risk of under-retention of records, meaning the disposal of records while they still have viable business value or while an existing law or regulation says they still need to be retained.
- Steps in Developing an Actionable RRS
Many companies turn to information governance (“IG”) experts like Fey LLC for assistance in developing an actionable, right-sized RRS – both for the United States and for international operations. An IG expert can first assist with the initial process of gathering the necessary information from all of a company’s business units concerning the categories of records they retain and their current practices with respect to how long, and why, they retain those records. Such information gathering can take the form of interviews with business unit stakeholders or surveys given to such stakeholders or to a broader group of employees, along with review of existing company policies, procedures, and departmental file plans pertinent to records retention.
An IG expert then processes all of that information in order to prepare a “shell” RRS, broken down by business unit, that clearly defines all of the categories of records retained by the company. Next, a records retention period is assigned to each category of records, based on legal research concerning legal and regulatory retention requirements in all applicable jurisdictions, as well as the company’s business needs. The actionability of the RRS can be enhanced through the addition of other information (e.g., the official storage location for each records category) that will help make the RRS more operative.
- Moving Forward with an Actionable RRS
Once an RRS is in place, the best practice is to train employees on consulting and using the new schedule. Best practices also include keeping the RRS evergreen by periodically reviewing it (e.g., updating any legal or regulatory retention requirements that have changed). By implementing an actionable, right-sized RRS and keeping it evergreen, your company can optimize compliance with its legal and regulatory obligations and foster the defensible disposition processes that follow.