Records Management Policy

Purpose

The purpose of this Policy is to establish a University-wide Records Management Program to ensure that all of the University’s legal and operational record keeping obligations are identified and met. The University is committed to creating and managing Records consistently throughout the University, and ensuring the integrity of Records for their whole life-cycle.

Definitions

For the purposes of this policy the following definitions apply: 

“Approved Repository” means a records repository (physical filing or information system) that has been approved by the Record Authority for use in retaining and protecting University Records.

“Disposition” means the final retention action carried out on a Record. This may include destruction, deletion, secure destruction or deletion, or transfer for archival review or to a third party.

“Official Copy” means the copy of a record designated in local procedures to satisfy the University’s retention requirements where multiple copies of a Record exist.

“Record Authority” means the position designated in the RCRS as having authority over a particular Record Series.

 “Record” means any Record of information however recorded, whether by electronic means, in print form, on film or otherwise.

“Records Classification and Retention Schedule (RCRS)” means a comprehensive list of all of the types of records produced or received by the University. The RCRS groups records into Records Series and provides rules for each including a Retention Period, an appropriate level of protection, disposition method, and a citation to applicable legislation or regulations.

 “Records Hold” means a written notice to suspend disposition for designated records. A Records Hold may be authorized by General Counsel for legal reasons or by the Record Authority for unanticipated operational or audit needs.

“Records Series” means a classification of Records that are related by the function and activity they support. All Records in a Records Series are subject to the same Retention Period, active and inactive storage period, disposition method and legislative and regulatory requirements.

“Responsible Unit” means the unit that must ensure Official Copies of the University Records of a particular Records Series are retained in an Approved Repository for the full duration of their retention period and disposed of when eligible. This may be a particular unit, or it may be the originating unit if multiple units have responsibility for records in a Records Series.

“Retention Period” means the length of time Records in a Records Series must be retained before Disposition.

 “Transitory Record” means any Record other than a University Record. Transitory Records have only short term value and may include:

1. Announcements and notices of a general nature;
2. Drafts;
3. Convenience copies or exact duplicates of University Records;
4. Printouts of databases where the University Record resides in the database.

“University Record” means a fixed unit of information in any format that documents a transaction, decision or relationship made by the University. It has continuing value in the future to complete further work, to provide evidence, to serve as institutional memory of obligations, responsibilities, decisions and actions, or to document the unique character and history of the institution.

Scope and Authority

This Policy applies to Records of all formats created or received in the course of or arising from the execution of the duties of University employees, faculty, staff, volunteers and members of the Board of Governors.

Research Records

Records supporting research including administrative, financial and compliance records are University Records. Compliance Records are those required to comply with terms of Granting Agencies, legislation or regulations and/or contractual obligations. Records produced by research activities of Academic Personnel that are not required for those purposes, including Research Data (as defined in the IP Policy) and data from external sources used in research, are not considered University Records except where the University has been granted a license under the IP Policy or the research is being completed under contract to the University. Academic Personnel are free to retain and store Research Data subject to their individual legal and compliance obligations. 

The ownership of intellectual property by academic personnel is governed by the Intellectual Property Policy.

The University Secretary and General Counsel, or successor thereof, is the Policy Owner and is responsible for overseeing the implementation, administration and interpretation of this Policy.  

Policy

Records are a vital asset of the University. Accurate and complete Records are critical to accountability and sound decision making. They provide evidence of the transactions, decisions and relationships of the University. Records establish the documented history of the University, which will help define and shape the unique character and reputation of the University now and in the future.

Records are the property of the University, not the individual who created them. Records remain the property of the University even after termination of employment.

Systems for creating, tracking, protecting, organizing, retaining and disposing of Records must be developed and consistently followed to prove the reliability of Records and ensure Records are available when needed.

Authority and Responsibilities

1. The Office of the General Counsel and University Secretariat will:
   1. Develop and maintain University-wide policy and procedures on Records Management, including a Records Classification and Retention Schedule.
   2. Retain a permanent record of all University Record Disposition activities.
   3. Provide training to faculty and staff in their responsibilities under this Policy.
   4. Assess IT systems regarding their ability to meet the retention and protection aims of this policy and establish standards for records conversion to ensure the integrity of records.
   5. Develop procedures, guidelines and other tools to support implementation.
2. The Record Authority is responsible for ensuring compliance with Records Management Policy instruments and clearly delegating responsibility for Records Management in their unit. In fulfilling those responsibilities, the Record Authority has the authority to:
   1. Determine the operational value of records.
   2. Determine the Approved Repositories for records based on an evaluation of their ability to meet the retention and protection aims of this policy.
   3. Authorize the disposition of records in compliance with the RCRS.
3. Leadership of University departments, offices, services and faculties will:
   1. Retain records for the full duration of retention period.
   2. Develop and establish local procedures to apply records management principles to day-to-day operations, ensure there is a complete inventory of records, classified according to the RCRS and ensure that Retention Periods are tracked and University Records undergo Disposition at least once a year.
   3. Ensure that Retention Periods are tracked, and that records undergo Disposition once a year.
   4. Ensure the development of a sufficient procedures manual to support Document Imaging Programs.
4. The University Librarian is responsible for appraisal of the historical value of University Records to help determine the appropriate Disposition of records.
5. All University employees, faculty, staff, volunteers and members of the Board of Governors will:
   1. Follow University Records Management Policy and procedures including the Records Classification and Retention Schedule.
   2. Dispose of Transitory Records according to their discretion.
   3. Classify Records under their control and ensure that University Records are stored in an Approved Repository.

Compliance Requirements

1. The University is subject to the Freedom of Information and Protection of Privacy Act (FIPPA), as amended. FIPPA requires that the head of an institution ensure that reasonable measures are developed, documented and put into place to preserve Records in accordance with any record keeping or Records retention requirements in laws or regulations.
2. The University is subject to compliance requirements in legislation or regulations that may dictate the creation of a certain Record, duration of retention, format of Record, or the requirement that Records be held within a certain location or jurisdiction. All compliance requirements must be documented in the RCRS and fulfilled.
3. Records containing personal information must be protected from unauthorized access and disclosure.
4. All Records, including Transitory Records, in the custody or control of the University must be available for production if an access to information request is made under the Act, subject to certain exemptions or exclusions, as prescribed in the University’s Access to Information and the Protection of Privacy Policy.
5. Contractual obligations regarding record keeping must be identified and fulfilled where they do not conflict with requirements in laws or regulations.

Records Retention

1. Records must be retained and protected for as long as they have ongoing value to the institution. The value of Records changes over time.
2. A Record has value when:
   1. It supports future operations.
   2. It provides evidence of the University’s transactions or relationships.
   3. It may serve as evidence in a legal matter.
   4. It protects the rights of the University, employees, students or other stakeholders.
   5. It documents the history and unique character of the institution. OR
   6. The institution is obligated to create or retain the Record by law, regulation or other compliance requirements.

Records Classification and Retention Schedule

1. The University Secretariat, working in conjunction with University departments, offices, services and faculties will develop a comprehensive list of all University Records, known as a Records Classification and Retention Schedule (RCRS). The RCRS is a Procedure under the Policy Framework.
2. The value of Records over time according to the criteria in Section 11.2 will be evaluated in developing the RCRS. All University Records will be assigned to Records Series and a Retention Period will be assigned to each Record Series based on a consensus between the Record Authority and University Secretariat as to when the value of Records has declined sufficiently for disposition.
3. Transitory Records will not be included on the RCRS and may be disposed of according to individual discretion.
4. All University Records must be classified according to the RCRS. The assigned Retention Period must be tracked until the Record is eligible for disposition.
5. For each Records Series, the RCRS defines at a minimum:
   1. The Record Authority.
   2. A Retention Period after which disposition must be completed.
   3. A method of disposition.
   4. The Responsible Unit(s).
   5. Scope notes explaining the type of Records included.
   6. An appropriate level of protection.
   7. Compliance requirements.
6. The RCRS will be modified to accommodate any changes to legislative requirements, operational needs, or a new function or activity that necessitates the creation of a new Records Series. The Responsible Unit should notify the University Secretariat of any such changes.

Records Protection

1. Records must be protected from risks such as flooding, fire, unauthorized access and loss. Appropriate protections will be determined by the sensitivity of the Records, the cost to reconstruct, and the risk to the University of not having a particular Record. Records must be protected whether they are in paper or electronic format.

Records Disposition

1. Records become eligible for disposition at the end of their Retention Period. All eligible records must undergo disposition unless disposition is suspended by an authorized Records Hold. Records of disposition activities for University Records must be recorded and retained permanently.
2. Methods of disposition must take into account the level of sensitivity of the Record Series and may include recycling, secure destruction (shredding, pulping, or incineration), transfer to University archives, or transfer of custody and control to a third party.
3. Destruction of Transitory Records does not need to be recorded. Transitory Records containing sensitive information must be destroyed securely. Copies of University Records must be destroyed prior to the Official Copy.

Records Storage

1. Official Copies of University Records must be stored in Approved Repositories for retention and protection purposes. Criteria to evaluate Approved Repositories will be based on Canadian and international Records Management Standards. Other copies of University Records are considered Transitory Records and may exist in email, paper, shared drives or collaboration tools.
2. University Records must be indexed and stored to facilitate retrieval and retention. Records should be arranged to allow for disposition of a complete folder at one time, not individual documents in a folder.
3. University Records may be retained and stored in any format as long as the content of the Record is complete and accurate and the context of the Record, including any changes in format, is tracked along with the Record. All legal, regulatory and contractual obligations regarding format must be identified and met.
4. Long-term storage of electronic Records requires protection against modification of Records and a technology migration strategy to ensure electronic Records remain accessible until the end of their Retention Period.

Records Hold

1. The General Counsel will issue a written Records Hold where there is actual or potential legal dispute, litigation or other legal matter, identifying Records related to the matter. Upon being notified of a Records Hold, all disposition of affected Records will be suspended immediately. The Records Hold will remain in effect until rescinded.
2. Records identified in an access to information request or those that are involved in any legal dispute, litigation or other legal matter must not be destroyed until notified by the Office of the General Counsel that the matter is resolved.
3. Upon receipt of a FIPPA access to information request, or when it becomes apparent that a FIPPA request is forthcoming, all disposition of potentially responsive Records is to be suspended. Disposition may resume when the FIPPA request has been resolved.
4. Records that are eligible for disposition, or nearing the end of their retention period required for unanticipated operational or audit needs may be placed on Records Hold by the Records Authority. The Retention Periods of Records Series requiring repeated Records Holds should be reviewed to ensure that they meet the University’s operational needs.

Monitoring and review

This policy will be reviewed as necessary and at least every three years.  The University Secretary delegate is responsible to monitor and review this Policy.

Relevant legislation

Freedom of Information and Protection of Privacy Act, RSO 1990, c F.31

Related policies, procedures & documents

Records Retention and Classification Schedule

Records Disposition Procedures

Document Imaging Policy

Document Imaging Guidelines

Access to Information and the Protection of Privacy Policy

Protocol for Records Protection