Records Management Compliance

Records Management Compliance Image
Keeping good records is vital for a business of any size. However, figures suggest that UK businesses are far from setting a good example when it comes to record-keeping. HM Revenue and Customs found that 39% of businesses had some issue with their record-keeping, highlighting how records management isn’t up to the standards it should be.

All information that is created, sent and received in a business is potentially a record. How you manage these records, whether they’re digital or paper, can be detrimental for a business.

The goal of records management is to help an organisation keep the necessary documentation accessible for both business operations and compliance checks, all things that save a lot of time and stress.

Making sure your business is compliant around record management is a must. By complying, the efficiency and accountability of the business increases, and it keeps you on the right side of legislation to avoid penalty fees.

Compliance Checklist –

Records management organisation: Your business has allocated records management responsibilities.

Records management policy: Your business has approved and published an appropriate records management policy. This should be subject to a regular review process.

Records management risk: Your business has identified records management risks as part of a wider information risk management process.

Training: Your business incorporates records management with a formal training programme. This includes mandatory induction training with regular refresher material, and specialist training for those with specific records management functions.

Monitoring and reporting: Your business carries out regular checks on record security and monitors the compliance with records management procedures.

Record creation: Your business has set minimum standards for the creation of paper or electronic records.

Information you hold: Your business has identified where you use manual and electronic record keeping systems and actively maintains a centralised record of those systems.

Information standards: Your business has processes in place to ensure that the personal data you collect is accurate, adequate, relevant and not excessive. Additionally, regular reviews are carried out to remove any records that are out of date or no longer relevant.

Tracking of paper records: Your business has tracking mechanisms to record the movement of manual records.

Offsite transfer of electronic record: Your business has appropriate measures in place to transfer electronic records off-site and protect personal data from loss or theft.

Secure storage of records: Your business stores paper and electronic records securely with appropriate environmental controls and high levels of security around special categories of personal data.

Access to records: Your business restricts access to records storage areas in order to prevent unauthorised access, damage, theft or loss. This can be done by implementing role-based access and checking it regularly.

Business continuity: Your business has continuity plans in place in the event of a disaster. This includes identifying records that are critical to the continued functioning or reconstitution of your business, also known as vital records.

Disposal of data: Your business has a retention and disposal schedule which details how long you will keep manual and electronic records. Your business has confidential waste disposal processes to ensure that records are destroyed to an appropriate standard.

Good Records Management…

Increases the ease and efficiency of the business, you can find the information you need quickly, allowing you to get on with your work
Increases your accountability by providing evidence of what has happened in the past, offering up clear information
that can be used whenever they’re needed
Gives you reliable records of a high value if they’re ever needed as evidence
Shows you’re following legislation by complying to the expected standards

Poor Records Management Means…

Poor service delivery through inefficiency
Inaccurate decision making from employees because they’re having to work with records of a low standard
Little or non-compliance with legislation that can lead to penalty fines from HMRC
Potential financial losses if an organisation is unable to defend itself
Wasted time and manpower from trying to find the records you need

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”