Let’s say there were guidelines you could put in place that would protect your company from noncompliance fines, reduce storage costs and help avoid legal action and cyberthreats. Wouldn’t you want to establish them right away? It would be even better if these policies could be enforced automatically and without administrative effort. That’s where the creation of document retention policies comes in.
In this blog post you’ll learn why your company should have document retention policies, how to create them and why digitalization plays an important role.
Table of Contents
Definition of a document retention policy
A document retention policy (DRP) outlines the procedures that employees must follow to correctly manage both electronic and hard copy documents and data. It spans the document lifecycle from creation to archiving and proper disposal. A DRP can also be applied to audio and video, appointment books and calendars, emails, handwritten notes social media posts and other information formats. DRPs help employees understand how applying these rules safeguards confidential information and protects data privacy.
A DRP is sometimes called a records and information management, information governance or data retention policy. Retention schedules can be time-based or determined by an event. So, some documents must be kept for a certain number of years while others are saved after an event like termination of a contract.
These policies should outline the types of materials and documents that need to be preserved, the amount of time that they should be retained, and who is responsible for monitoring them. They play a central role in providing access to a company's information, while ensuring adherence to regulatory standards, audit readiness and responding to legal issues. Some retention policies apply to the whole company while others are in effect for a single department or document type.
Why should your company create these policies?
Keeping data longer than necessary can lead to legal exposure, an increased risk of cyberattacks and higher storage costs. If your company is involved in litigation, having a written policy in place demonstrates to a judge or government body that a company's document disposal is unbiased and executed according to regulatory requirements.
Lack of a defined policy, which leads to over-protection of outdated or unregulated documents, can slow down your company’s response to a potential data breach. This opens up more opportunities for hackers and unauthorized users to access confidential information. And it can compromise the privacy, integrity, and availability of your data and your network. Archiving data in multiple locations rather is also problematic. So, centralize document storage and keep them for the designated period required -- not more and not less.
Before you start
1. Conduct an audit of your data and organize your files
A company should have a retention policy that includes original documents, electronic media, photos, emails, financial records and many other types of information. Not all data is equally important so don’t create a one-size-fits-all retention policy. To be effective, a policy should set out precise legal and industry requirements for each document category.
2. Outline the policy’s purpose
A record retention policy explains the reasons behind its implementation and its significance for the business. This informs employees of the importance of monitoring documents throughout their lifecycle. Clarifying its purpose motivates employees to follow the policy's rules. Explain whether the policy applies across the business or only to certain departments or locations.
3. Define the scope and responsibilities
Who is accountable for evaluating and updating the policy? Who will oversee and maintain the documents that fall under its scope? Typically, the records management, legal and compliance teams are responsible for developing and implementing a document retention policy. However, in smaller organizations a committee consisting of members of different departments usually performs this task. You may also want to consult outside counsel or hire a consultant.
How to create a retention policy
Include these components:
- Categories: List each record type your organization produces or receives that is subject to internal audits, and federal and state laws and regulations.
- Retention requirements: Indicate how long each record should be kept and when it should be securely disposed of.
- Disposal Instructions: Outline how to safely dispose of records while following data privacy and security protocols.
- Security Protocols: Specify who can delete certain documents and if they require a password or encryption code to access them. Your policy should also establish processes that prove the document's authenticity.
- Approvers: Provide contacts for employees who have questions, and list who can authorize changes to the policy.
- Instructions on how often the policy should be reviewed and updated.
- An appendix of unfamiliar terms.
Adapting a game plan for your industry
Healthcare: Medical retention schedules vary by state. In addition, the federal Health Insurance Portability and Accountability Act (HIPAA) mandates that organizations must maintain medical records for at least 6 years from their date of creation or their effective date.
Finance: Banks are subject to the Equal Credit Opportunity Act; the Truth in Lending Act & Truth in Savings Act; and the Electronic Funds Transfer Act; as well as other regulations. The Financial Industry Regulatory Authority (FINRA) requires investment and brokerage firms to follow the Securities & Exchange Commission’s (SEC) and FINRA books and records requirements.
K-12 education: Each state determines how long public-school records should be kept. The Federal Rights and Privacy Act (FERPA) ensures data privacy and provides rights for parents regarding access to educational records which are transferred to the student when they reach the age of 18. However, FERPA does not specify how long records should be retained.
State and local government: Government entities need to balance the importance of secure data storage with accessibility. Compliance and security are both components of good governance. So, implementing sound cybersecurity practices helps to ensure that all relevant laws are being followed and that compliance is a priority. Compliance best practices indicate the need for the right digital tools that work to safeguard sensitive information while providing access to citizens.
Nonprofit: There are no definitive regulations that all nonprofits can follow when establishing retention policies. These organizations should limit retention to documents they create or receive that relate directly to what they do. Documents they’re required to retain include articles of incorporation, reports from independent audits, personnel records and year-end financial statements.
Document management case study
DocuWare ensures compliance for a public school district
At the Daviess County Public Schools (DCPS) in Kansas, prior to implementing DocuWare, employees kept track of document retention schedules on paper. Because different document types are purged on varying schedules, this was a labor-intensive task. For example, attendance data must be kept for 20 years while health information obtained by school nurses is kept for only 5.
Now, DocuWare workflows automatically enforce retention schedules established by the Kentucky Department for Libraries and Archives, making compliance easier and more transparent. State auditors review retention practices, and it's much easier to provide them with requested documents. DCPS also switched to the newer transcript archiving method that allows for faster searches. The use of electronic forms helped to further streamline the process
Managing document retention policies with DocuWare
Today’s operational standards surrounding document security, data privacy, retention policies and disclosure are complex and penalties for noncompliance are steep. DocuWare brings your policies to life through automated workflows that enforce retention schedules for documents and other media. The software enables you to apply business rules that dictate how information is stored, when it’s flagged for disposal, and how it can be deleted securely.
Access control adds another level of protection
With DocuWare, you govern access and determine who can view, store, modify, transfer, alter, or delete documents. Requiring a unique password and other security measures are combined with the creation of a complete audit trail that details which document was accessed, by whom, and what actions were taken.
Digital workflow replaces dependence on manual processes
Workflow automation ensures a consistent, predictable flow of information by managing tasks, documents, and data. It breaks down enforcement of retention schedules into a logical "if/then" format. These "if/then" statements are translated into workflow steps that can run independently or with a combination of human intervention and automation.
A workflow function connects process stages with actions. For instance, if a document’s retention requirement ends on a certain day, then it will be routed to the first step in the destruction cycle. A built-in control center can monitor user tasks flag potential errors.
By automating your retention policies with DocuWare, your organization will no longer deal with issues like a lack of clarity about when a retention policy was last updated, tracking down disorganized documents, and difficulty in coordinating the efforts of team members. Automated workflow management executes your retention policies through a predefined series of activities to administer retention and destruction efficiently and eliminate risks associated with regulatory noncompliance.
What is the difference between a document and a record?
After a business process is completed, a document becomes a record. The record may also include related photos, videos and other components. Records prove that an individual, company, non-profit organization or government agency performed an action like executing a transaction or signing a contract.
Records are preserved in their final form in case they are needed for verification. To preserve their authenticity, they are usually not edited or amended. Records are subject to internal and external audits to ensure compliance with industry, state, and federal regulations. A document management system allows your company to digitize and archive both records and documents.
What is disposable information?
Disposable information is data that can be thrown away or removed by the user if it is no longer needed or can be deleted safely because it has not been classified as essential.
Examples include:
- Copies of documents that do not contain notes.
- Preliminary drafts, SPAM and junk mail.
- Letters, reports, and memos that do not relate to the creation of an official record.
- Printed materials like books, training binders, and magazines or newsletters from external sources.
What is a records series?
A record series groups files or documents to be managed as one unit. Items in a series relate to a particular topic, verify the same type of transactions or have another relationship relating to the creation, receipt, or use of the material.
For example, a group of contract files would constitute one series. Other series in that office might include correspondence, budgets and performance reviews. The concept of the records series is also applicable to videos, photographs, sound recordings, data tapes and other media.
What is a litigation hold?
If a company is facing or expects to be in litigation, including arbitration, a government inquiry or an audit, it should be cautious so that relevant information is not deleted nor destroyed. So, a company should develop a litigation hold policy that requires the suspension of normal destruction practices for any record or disposable information that is relevant to a particular legal issue.
A litigation hold may be used in other exceptional circumstances, such as a merger, a divestiture, or an acquisition, that require document retention beyond the time mandated by law. Usually, a company’s legal department is responsible for deciding when to implement a litigation hold. In companies without a legal department, the chief operating officer or the director of information technology (IT) may make those decisions with the input of outside counsel.