Guidance on taking or sending records out of NSW
The page provides information and guidance to public offices in meeting their statutory obligations under the State Records Act 1998 for the ‘safe custody and proper preservation’ of State records when they are taken or sent outside of NSW for certain purposes.
Background
Under section 21 of the State Records Act 1998, (the Act) State records cannot be taken or sent out of NSW unless permitted by section 21(2) of the Act. Generally, approval from State Records NSW is required.
However, there are times when public offices need to take or send State records out of NSW, for example:
- public offices located near state borders may need to store records with interstate service providers
- public offices may use data storage service providers whose servers are based outside of NSW, including outside of Australia for those with international operations
- public offices may need to send records out of the state temporarily for conservation, remediation or copying.
General authority: taking or sending records out of NSW (GA50)
To allow public offices to take and send State records out of NSW, State Records NSW has approved General authority: taking or sending records out of NSW (GA50). GA50 supersedes General authority: transferring records out of NSW for storage with and maintenance by service providers based outside of the State (GA35).
GA50 permits the taking or sending of State records out of NSW for certain purposes, provided the records are managed according to the requirements of the State Records Act.
The purpose of this advice is to guide public offices on:
- how to follow the conditions of GA50
- how to meet the requirement of the State Records Act for records created and stored out of NSW
- key considerations when making arrangements for storing or managing records with service providers out of NSW.
What is permitted under GA50?
| Records | What is permitted | What the public office needs to do |
|---|---|---|
| Digital records | Digital records can be taken or sent out of NSW and outside of Australia for storage with service providers whose data management facilities or servers are based outside of NSW. Note: this permission is given under the State Records Act only. Public offices need to comply with cyber security policies that apply to NSW Government Departments and public service agencies, or that are recommended for adoption by state-owned corporations, local government and universities, e.g. NSW Government Cloud Policy. | Meet all conditions in GA50, Part 2 Conditions for approval (see below) Arrangements should be made with Museums of History NSW to transfer digital State archives no longer in use for official purposes to the State Archives Collection. |
| Physical records not required as State archives1 | Physical records not required as State archives can be taken or sent out of NSW - but must remain within Australia - for storage, conservation, remediation, copying or display. Note: there is no permission to take or send physical records out of NSW for storage in private residences under remote working arrangements with staff. The originals should be retained in NSW and copies provided to staff. | Meet all the conditions in GA50, Part 2 Conditions for approval (see below) |
| Physical records required as State archives2 that are still in use for official purposes | Physical records that are required as State archives but are still in use for official purposes can be taken or sent out of NSW - but must remain within Australia - for storage, conservation, remediation, copying or display. | Meet all the conditions in GA50, Part 2 Conditions for approval (see below). Previously (under GA35) these records needed to be less than 25 years old to be taken or sent out of NSW. This has been changed to those still in use for official purposes. |
| Physical records required as State archives that are no longer in use for official purposes. | Physical records that are required as State archives that are no longer in use for official purposes can be taken or sent out of NSW – but within Australia - for conservation, remediation or copying only. There is no permission to take or send records required as State archives that are no longer in use for official purposes out of NSW for storage. These records must be transferred to Museums of History NSW. Approval is needed from Museums of History NSW to take or send physical records that are required as State archives that are no longer in use for official purposes out of NSW for exhibition or display. | Meet all the conditions in GA50, Part 2 Conditions for approval (see below). Previously (under GA35) there was no permission for State archives more than 25 years old to be taken or sent out of NSW. This has been changed to those records that are required as State archives that are no longer in use for official purposes. Physical records that are required as State archives that are no longer in use for official purposes should be transferred to Museums of History NSW. |
1 Records that are not required as State archives can be identified via the disposal action column in records retention and disposal authorities. These records have a minimum retention period before they can be destroyed.
2 Records that are required as State archives can be identified via the disposal action column in records retention and disposal authorities. Required as State archives means that the records can be transferred as State archives when they are no longer in use for official purposes.
Conditions applied by the general authority
The conditions that need to be met to take or send records out of NSW in GA50 are:
Condition 2(a) an appropriate risk assessment has been made and the risks involved in taking or sending records out of NSW have been addressed. This includes physical risks to hard copy records and cyber security risks to digital records
Some key risks to consider are:
- the maturity of the service providers capability to manage security risks
- records might not be returned when requested or when the contract ends
- the service provider or the business could cease operating
- the Privacy and Personal Information Protection Act 1998 (section 19) has restrictions about sharing information outside NSW, which must be followed.
The level of risk depends on the type of records, their sensitivity, and how important they are to the organisation or the NSW Government. After identifying the risks, public offices should take steps to mitigate the risks by using clearly written contracts, getting legal advice, monitoring service arrangements. Public offices should not enter into agreements with an unacceptable level of risk.
Some records may be too sensitive or important to risk storing with an out-of-state or overseas provider. Public offices should also check if there are any laws in the state or country where the records will be stored that could affect how State records are managed. For example, privacy laws in another country might impact how information is stored, even if it didn’t originate there, and access to information laws in another country could be used to access NSW government records stored with commercial providers.
Condition 2(b) the records are managed in accordance with all the requirements applicable to records under the State Records Act (GA50, 2(b)).
Facilities and services offered by service providers must comply with:
- the State Records Act
- the relevant standards issued by State Records NSW:
These standards provide specific benchmarks that should be communicated to service providers through contractual arrangements. Public offices are responsible for ensuring these requirements are met.
Condition 2(c) the records are covered by a current retention and disposal authority
If you have been advised by State Records NSW that your records do not have current disposal coverage, then there is no permission to take or send them out of NSW.
A records retention and disposal authority informs risk assessments as it identifies records that have short or long term retention requirements and also records that have been identified as State archives.
The majority of NSW public offices have disposal coverage through a general or functional records retention and disposal authority. The Records retention and disposal authorities page has links to all current disposal authorities as well as a Directory of retention and disposal authorities for each public office. If you are unclear about whether your public office has disposal coverage please contact govrec@staterecords.nsw.gov.au
Public offices and their providers must be aware of retention and disposal requirements, especially for records stored with interstate providers. Disposal of records can only occur with authorisation from State Records NSW. This authorisation can be through general or functional retention and disposal authorities or other forms permitted under the State Records Act. Destruction must follow State Records NSW guidelines. More information is available under Destruction of records.
Condition 2(d) the records are accessible because they are adequately controlled (i.e. sufficiently described or tagged with metadata in compliance with standards issued by State Records NSW)
Records should not be sent out of NSW without sufficient metadata to be able to identify what they are. Not having control over records makes it difficult to meet the requirements of section11(1) of the State Records Act to ‘ensure the ‘safe custody and proper preservation’ of State records.
Records should not be taken or sent out of NSW unless they have been sentenced to determine when they can be destroyed and if they are required as State archives.
Condition 2(e) the ownership of the records remains with the public office
The ownership of the records must remain with the public office to avoid someone in another state or country claiming ownership or taking control of the records. Contracts with service providers, including those outside of NSW, must include provisions to ensure the following:
- ownership of State records remains with the state
- the public office retains responsibility for the proper management of these records
- records will be returned to the public office upon request.
Condition 2(f) contractual arrangements and controls are in place to ensure the safe custody and proper preservation of records
To mitigate risks, contracts should also include provisions that:
- ensure the portability of records (i.e. the ability to transfer the records back to the public office) at the end of the contract
- ensure no copy of records or information is retained by the service provider after contract termination
- address requirements for security, privacy, and confidentiality.
Contracts involving records should specifically address the return of records to the public office upon contract termination. For digital records this ensures that accessibility is maintained and avoids complications such as:
- inability of the service provider to export digital records from the system that has held/managed the records.
- records being provided in proprietary formats without appropriate licences or documentation, making them difficult to integrate into recordkeeping systems.
- loss of accessibility to critical records post-termination of a contract.
For additional advice on contract inclusions, see:
Outsourcing physical records storage
Condition 2(g) the service provider’s facilities and services conform to requirements in standards issued by State Records NSW
This includes:
Condition 2(h) the arrangements are monitored to ensure the service provider is meeting relevant requirements
The public office is responsible for monitoring the arrangements with the service provider on a regular basis to ensure that all relevant requirements are being met.
Contracts should specify that public offices have the right to monitor the service provider to ensure compliance with the contract, the State Records Act, and any other applicable legislation or standards.
Under section 15 of the State Records Act, the public office must give the State Records Authority NSW and its officers access to State records. Contracts should explicitly address how such access will be facilitated to:
- monitor compliance effectively
- provide third-party access as required under applicable laws.
By embedding these provisions in contracts, public offices can maintain proper management, security, and accessibility of State records.
For more guidance, see Monitoring records management.
Condition 2(i) arrangements are made for State archives that are no longer in use for official purposes to be transferred to Museums of History NSW after remediation, conservation, preservation, digitisation or copying. State archives that are no longer in use for official purposes should not be taken or sent out of NSW solely for storage purposes as these records can be transferred to the custody of Museums of History NSW
If public offices are holding records required as State archives that are no longer in use for official purposes then arrangements must be made to transfer the records to the Museums of History to become part of the State Archives Collection.
GA50 permits these records being taken or sent out of NSW to be conserved, remediated or copied but once these processes are complete the records must be returned to NSW and transferred.
Condition 2(j) a loan agreement is in place to take or send records out of NSW for exhibitions or displays. Approval is needed from Museums of History NSW if this includes records required as State archives that are no longer in use for official purposes
Previously separate permission was needed to take or send records out of NSW for exhibitions. Permission is now granted by GA50 provided that conditions are met. However, if the records are required as State archives and are no longer in use for official purposes, then separate permission is required from Museums of History NSW.