IMP 11: Information and Records Management Policy
1. Policy Introduction and Purpose
1.1 The University recognises that efficient and effective management of its records is necessary to support its core functions and activities, to comply with its legal and regulatory obligations and to contribute to the effective overall management of the institution.
1.2 This Policy sets out the principles that support the University in discharging its records management obligations and adherence to good practice. These legal obligations include, but are not limited to, the: Freedom of Information Act 2000, the Environmental Information Regulations 2004, the Data Protection Act 2018 and the UK GDPR (as amended) in addition to the University鈥檚 own regulations with particular reference to Regulation 31 Information Management, Security and Records ManagementLink opens in a new window
2.0 Scope and Definitions
2.0.1 The Policy covers everyone who has a contractual (formal or informal/implied) relationship with the University, including employees, students, visiting academics, and consultants. Please note that this list is not exhaustive.
2.0.2 For purposes of this policy, we will refer to everyone covered as 鈥渕embers.鈥�
2.0.3 The Policy covers all information processed by the University, regardless of ownership or format.
2.1 Records
2.1.1 This Policy makes provision for how records (and the data and information they contain) are managed at the 91福利.
2.1.2 To aid with the management of data and information as records at the University, this Policy provides a definition of a record and makes provision for its lifecycle management. The Policy adheres to the definition of a record as set out in ISO BS 15489:1 2016 (Information and documentation 鈥� Records Management). This standard defines a record as: 'information created, received and maintained as evidence and as an asset by an organisation or person, in pursuit of legal obligations or in the transaction of business'.鈥��
2.1.3 ISO BS 15489:1-2016 also sets out that 鈥楻ecords, regardless of form or structure, should possess the characteristics of authenticity, reliability, integrity and useability to be considered authoritative evidence of business events or transactions and to fully meet the requirements of the business鈥�. To these ends, this Policy sets out six principles that鈥痬ake provision for the management of records throughout their lifecycle with the aim of ensuring that a consistent approach is taken to their administration at the University.鈥�
3.0 Responsibilities (Policy and Operational)
3.0.1 The Chief Risk & Information Security Officer (CRISO) retains overall accountability for this Policy and for ensuring the Policy meets legal and regulatory requirements; for keeping this Policy up to date; and for ensuring that controls, checks, and audits are carried out as part of compliance with this Policy.
3.1 Operational Responsibilities
3.1.1 Adherence to this Policy and its supporting Standards and Standard Operating Procedures (SOPs) is achieved by following the Policy principles and the data restrictions and security provisions. It is everyone鈥檚 responsibility to ensure that they follow this Policy.
| Role | Function |
| Designate of Head of Department (e.g. academic lead on research, individuals with delegated authority for information, system administrators) |
Responsible 鈥� for overseeing compliance with the Policy within areas of responsibility |
| Head of Department (or equivalent) |
Accountable 鈥� for compliance with this policy within Departments |
| Information Risk and Compliance Team (with escalation to CRISO) |
Consult 鈥� to discuss organisational level compliance with the Policy |
| IDG Digital Business Partners |
Inform 鈥� must be informed of the content of the Policy to communicate it to their departments |
4. Principles of this Policy
The University has six principles for the management of records, which must be adhered to, these are:
Principle 1 - The record is accurate:鈥疶he University has the information that is needed to form a reconstruction of activities or transactions that have taken place.
Principle 2 - The record can be accessed:鈥疘nformation can be located and accessed by those with the authority to do so and the authoritative version is identifiable where multiple versions exist.
Principle 3 - The record can be interpreted:鈥�The context of the record can be established: who created the document and when, during which business process, and how the record is related to other records.
Principle 4 - The record can be trusted: the record reliably represents the information that was actually used in or created by the business process, and its integrity and authenticity can be demonstrated.
Principle 5 - The record can be maintained through time: the structural integrity of the record can be maintained for as long as the record is needed, perhaps permanently (and in line with the provisions of the University鈥�Records Retention ScheduleLink opens in a new window鈥痙espite changes of format.
Principle 6 - The record is valued: the record is understood to be an information asset, and provision is made to ensure that the principles of accuracy, accessibility, interpretation, trustworthiness and (physical/digital) continuity are upheld throughout its lifecycle.
5. Content Considerations
5.1 The University must maintain an Information & Records Management Policy that enables it to adhere to a number of legal requirements around the public鈥檚 right of access to:
a. The recorded information held by the University under the Freedom of Information Act 2000.
b. Environmental Information under the Environmental Information Regulations 2004.
c. A data subject鈥檚 own personal data under the UK General Data Protection Regulation and the Data Protection Act 2018
d. Access in line with the provisions of any other legislation that provides a right of access to information.
(In each case access is granted unless an exemption applies under each of these access regimes.)
5.2 This means that: email correspondence, physical documents, electronic documents (digitised/born digital), microfiche, sound and audio-visual records (this list is not exhaustive) could be in scope of an information access regime (each access regime has specific requirements of what is in scope of its provisions).
5.3 The information all members create is representing the University and therefore its content must be in line with the University鈥檚鈥�vision and valuesLink opens in a new window.
6. Capture and control of records
6.1 All digital records created or received during the course of University business must be adequately maintained during their lifecycles at the University within established and approved University information systems. (If there is uncertainty about the use of any information system then ensure this is clarified before its use with the appropriate System Owner).
6.2 System Owners must ensure all systems processing digital records鈥痬ust鈥痓e designed and implemented to ensure that the six Records Management principles and the provisions of the Information Management Framework are adhered to for the entire lifecycle of the record. Where a records system is being replaced or superseded by another system the records management principles and the wider information management framework must be adhered to. Where a records system is to be decommissioned, provision must be made for maintenance or transfer of the records so that they remain accessible for the required retention period.
6.3 All records (including both physical and digital) created or received during the course of University business must be maintained in accordance with IMST 01 Information Classification StandardLink opens in a new window and IMST 03 Handling Information StandardLink opens in a new window.
7. Email
7.1 Emails may contain actions and decisions and must be managed as effectively as other digital information. Email messages that constitute a record with long-term interest to University work must be stored in accordance with the 鈥榮uitable storage鈥� section in IMST 03: Handling Information StandardLink opens in a new window rather than using an email inbox as the system of record. This process helps ensure that the information emails contain can be located and retrieved and regularly reviewed and deleted when that is the appropriate action.
7.2 Email retention considerations are determined by the subject matter the email contains and with reference to the University鈥�Records Retention Schedule.Link opens in a new window
8. Vital records
8.1 Vital records are records which are essential to the University in order to continue with its business-critical functions both during, and after a disaster or records which would present significant risk to the University if their integrity or availability were compromised. (E.g. Disaster recovery plans, the University Charter, operational manuals for critical infrastructure etc.)
8.2 Vital records must be stored in accordance with IMST 03: Handling Information StandardLink opens in a new window, so that they are protected by measures in compliance with the Backup and Recovery Standard (currently in development). Vital records that are only available in physical format should be digitised (where possible) or duplicated and the originals and copies stored in separate locations. (The duplicates should be clearly marked as a copy of an original record.) If, however, duplication is impracticable or legally unacceptable, fire protection safes must be used to protect the documents.
8.3 Vital records must be identified by Information Asset Owners (IAOs), and it is their responsibility to ensure appropriate action is taken to comply with this policy.
9. Classification, storage and handling of records
9.1 To ensure that the core principles of records management are adhered to, all University information must be classified, stored and handled in accordance with the University鈥檚 IMST 01 Information Classification StandardLink opens in a new window.
9.2 All records require storage conditions and handling processes that take into account their specific properties. The University will produce and maintain guidance on the storage of records on its鈥�Information and Records Management Link opens in a new windowweb pages.
10. Digitisation
10.1 The University adopts the principle of creation of information as digital by default.
10.2 In instances where digitisation is considered by the University then all processes associated with this activity must adhere to the IMST 01 Information Classification Standard Link opens in a new windowand IMST 03 Handling Information StandardLink opens in a new window and鈥痶he provisions of the University鈥檚 guidance in relation to鈥痶he digitisation鈥痮f records.
10.3 If the original physical record is to be destroyed post-digitisation,鈥痶hen the digitised rendering must be managed as the authoritative record throughout its lifecycle and disposed of, or preserved, in line with the provisions of the University鈥檚 Records Retention ScheduleLink opens in a new window (RRS).
10.4 If you have any doubt if any original physical document may have historical or preservation鈥痸alue鈥痽ou must consult with archivists at the Modern Records CentreLink opens in a new window before it is destroyed.
10.5 Whilst in certain instances digitisation might help reduce physical storage space requirements through the disposal of the hard copy鈥痳ecord, on other occasions it may not be appropriate to destroy the original post digitisation. An example of this might be where the record has intrinsic value (e.g.鈥痟istorical) in its original physical format or the digitised image is not able to be relied on as the authoritative records.鈥�
11. Access to records
11.1 The Content Considerations section of this policy sets out the main access regimes that apply to University records. In terms of internal access to records then in each case, it must be for a valid and authorised business reason.
11.2 Those creating and or storing records must ensure that adequate controls are in place to protect records from unauthorised access, disclosure, alteration and destruction and that they are managed in line with the provisions of the Information Management Policy FrameworkLink opens in a new window.
12.0 Digital continuity
12.0.1 Digital Continuity means ensuring University information can be found, accessed, understood and used for as long as required in line with the Records Retention Schedule (RRS).
12.0.2 To prevent information becoming unusable during system change, System Owners must ensure Digital Continuity is built into the design, implementation, migration and decommissioning of systems, working with Information Asset Owners (IAOs), who remain accountable for the information itself.
12.1 Requirements
- System Owners must identify what information a system holds, who the Information Asset Owner (IAO) is, and how long the information must be retained in line with the RRS.
- System Owners must ensure that, when designing or procuring new systems, information will remain accessible, readable and understandable for its full retention period.
- System Owners must ensure systems support appropriate formats, metadata and structure so that information remains usable over time.
- System Owners must ensure that information can be exported, migrated or transferred without loss, including all necessary metadata and context.
- System Owners must ensure that, during system changes or migrations, all required information is transferred completely, accurately and remains usable.
- System Owners must ensure that no information required by the RRS is lost, corrupted or made inaccessible during system change.
- System Owners must ensure that, before decommissioning a system, all information that must be retained is identified, securely transferred, and remains accessible and usable in its new location.
- Information Asset Owners (IAOs) must ensure that risks to the Digital Continuity of their information assets are identified and appropriately managed.
- System Owners must implement technical and architectural controls that enable IAOs to meet their Digital Continuity responsibilities.
- System Owners and IAOs must ensure that business needs, technical systems and information management practices remain aligned throughout the system lifecycle.
13. Disposal of records
13.1 When a record reaches the end of its retention period, a decision must be taken on its disposal, with the three possible outcomes:
a. Reappraisal
b. Preservation/ Transfer to University Modern Records Centre
c. Destruction
13.2 The University manages the lifecycle of its records in line with its University鈥檚 Records Retention ScheduleLink opens in a new window鈥�(RRS). The RRS is a tool that transparently demonstrates to third parties (e.g. via the publication of the RRS on the internet) how the organisation complies with its data protection obligations, and other legislation and regulations as appropriate, by making provision for the time periods for which common types of records are retained by the University.
14. Preservation of records
14.1 The RRS also makes provision for the selection and preservation for certain categories of record created in any format at the University to be transferred to the鈥�Modern Records CentreLink opens in a new window鈥痑nd there in preserved. These records form part of the University's archive for historical research purposes and are the enduring record of its functions and activities. The University has a specific policy related to IMP 15 Digital Preservation Policy (currently in development).
15. Exceptions
15.1 under this Policy must be submitted to the CRISO or their designate. Authority to approve exception requests is delegated to the Information Risk and Compliance Team. Activities that have received prior approval by the Research Governance and Ethics Committee will be exempt, but the CRISO must be notified.
15.2 This Policy may have an impact on users of assistive technology or assistive software dependent on circumstances. These individual cases will be considered on a case-by-case basis.
16. Compliance monitoring
16.1 All members of the University are expected to comply with this document as part of the Information Management Policy Framework (IMPF). Where breaches of the IMPF present a significant risk, including those falling under Regulations鈥�痑nd Regulation鈥�, they will be subject to the appropriate student or staff disciplinary procedure or applicable contractual terms for staff not employed directly by the University or contractors.
16.2 It is the responsibility of all members to report any instances of non-compliance to the Information Risk and Compliance Team. This can be done via the鈥�. This team monitors adherence to the IMPF using reported data and other available tools.
16.3 Where issues require escalation or further review, they will be referred to the Information Security and Data Protection Committee via the Chief Information Security Officer (CRISO) and include either Conduct and Resolution Team or Employee Relations Team, as appropriate.
Amendment History:鈥����
| Version | Date Created | Date Published | Next review | Notes/outcomes |
| 1.0 | November 2026 | November 2026 |
November 2027 | This Policy replaces IG03 Information Records Management Policy |