Creating a records and information management policy

About records and information management policies

The records and information management policy establishes the governance framework for the creation, capture, control, use, maintenance, and disposal of records, information and data in your organisation. The records and information management policy works in conjunction with records and information management strategies developed by your organisation. The strategies implement and deliver effective records and information management within the organisation and thus help support and facilitate good business.

There are many different styles and templates used for policy within NSW public sector organisations and you should use your organisation’s policy template.

The checklist below can be used to assist your organisation to confirm that the records and information management policy establishes the governance framework for the creation, capture, control, use, maintenance, and disposal of records, information and data.

Checklist

The policy…

• is adopted at the senior executive level, e.g. signed by the CEO of the organisation
• identifies that senior management provide direction and support for records and information management and reflects the Chief Executive’s responsibility to ensure compliance with section 10 of the State Records Act 1998
• assigns responsibilities to the Senior responsible officer (SRO) for the oversight of records and information management, including:
  • access directions,
  • transfer plans,
  • approval of all records storage areas and facilities, and
  • notifications of State Records NSW if records are damaged, impaired, or destroyed due to flood, fire or disaster, or data breaches, or have been deemed officially lost by the public office
• assigns responsibilities to records and information management staff, including:
  • the development and implementation of records and information strategies,
  • notifications of damaged records to management,
  • transferring State archives to the State Archives Collection (held at Museums of History NSW),
  • submission of the 5-yearly transfer plans to Museums of History,
  • notification of changes to key contacts such as SRO to State Records NSW,
  • assessment and approval of physical storage of records, eg, storage areas are secure and appropriate for the storage of records
• assigns responsibilities to business owners and business units to ensure that records and information management are integrated into work processes, systems and services
• assigns recordkeeping responsibilities of all staff and contractors, including the requirement to make and keep records
• assigns responsibilities to the Senior responsible officer (SRO) to update State Records NSW when there are changes to key contacts
• identifies that the organisation values records, information and data as a strategic resource that is integral to good business
• requires that records and information management is assessed and addressed in all outsourced, cloud, contracted and similar service arrangements
• requires that records, information and data needed to meet or support short and long term business and recordkeeping requirements, including accountability and community expectations, are identified
• requires that systems which hold high risk and/or high value records, information and data are identified
• requires that records and information management is a designed component of all systems and service environments where high risk and/or high value business is undertaken
• requires that risks to information are identified, managed or mitigated
• addresses the importance of managing all records, information and data across all operating environments, including diverse system environments, physical locations and how physical records are controlled
• requires that records are protected from unauthorised or unlawful access, destruction, loss, deletion or alteration
• requires that access to records, information and data is managed appropriately in accordance with legal and business requirements
• addresses the safeguarding, management, and preservation of records, information and data with long term value, ensuring their accessibility as required under section 14 in the State Records Act
• addresses the migration of records, information and data through system and service transitions
• requires that records, information and data are kept for as long as they are needed for business, legal requirements (including in accordance with current authorised records retention and disposal authorities), accountability, and community expectations
• requires that migration and decommissioning of systems takes into account retention and disposal requirements for records, information and data held in the system
• requires that records, information and data are sentenced according to current authorised retention and disposal authorities or normal administrative practice provisions (see State Records Regulation 2024)
• requires that those records required as State archives are routinely transferred to the State Archives Collection (Museums of History NSW) when no longer in use for official purposes
• records, information and data are systematically and accountably destroyed  when legally appropriate to do so
• requires that records and information management is monitored and reviewed to ensure that it is implemented, accountable, meets business needs, and that the organisation is complying with the State Records Act and associated standards and codes of best practice
• requires that the organisation cooperates and liaises with State Records NSW in relation to monitoring compliance and submission of assessment responses to the Recordkeeping Monitoring Exercise, per section 12(4) of the State Records Act 1998
• requires that the organisation liaises with Museums of History NSW in relation to registering and/or renewing applicable early access and closed to public access directions for records where an OPA (open to public access after 20 years) is not appropriate for the records per part 6 of the State Records Act 1998
• requires that the organisation liaises with Museums of History NSW in relation to the submission of the 5-yearly transfer plans under section 32(4) of the State Records Act 1998
• requires that systems are tested or audited to ensure that systems are operating routinely and that there are no issues affecting information integrity, useability or accessibility
• requires that the policy is reviewed on a regular basis and that reviews take into account changes in business activities and priorities
• includes information on the legislative and external requirements which may affect records and information management in the public office
• has a revision date and contact for the policy (Senior Responsible Officer).

Records and information management strategies

Records and information management strategies are at the heart of managing records and information
across all operating environments of the organisation. Robust strategies should be designed to meet
organisation’s needs and requirements in order to deliver effective records and information
management. This in turn ensures that records and information supports and facilitates good business.

Records and information management strategies may include:

• integrating records and information management into work processes, systems and services
• implementing records and information management to ensure that it is accountable and meets
  business needs
• managing email
• managing risk assessments and use of cloud or similar service arrangements
• managing the use of removable storage
• managing and maintaining the corporate records management system or EDRMS or ECM
• integrating records and information management into business systems and managing and
  preserving records and information of long term value in these systems
• managing records and information held in social media applications
• managing records and information used with mobile devices or BYOD.

Effective records and information management strategies ensure that:

• information assets are managed responsibly and in accordance with best practice
• accurate, reliable and relevant information can be provided to the business and clients
• the organisation’s investment in their information assets is not wasted: information can be
  reused and repackaged to enhance business opportunities and stimulate innovation
• records and information are more accessible and useable and available for those with
  appropriate authority
• costs are reduced as the organisation does not retain records and information unnecessarily
• the organisation can provide stakeholders, with transparency around and accountability for
  government operations
• the organisation is compliant with legislative and audit requirements.