Records Management Policy

Overview

The University Records Management Policy provides department managers with guidance covering the lifecycle of records. The policy was updated by the University Management Committee (UMC) in 2012 to be more concise and better address digital records. A major feature of the update is the requirement for prior approval of new projects and contracts for storage of RESTRICTED information (CCN, SSN, Health Records, Drivers License, Passwords, etc.).

1.0 Purpose and Scope of Policy

The Records Management Policy is designed to provide guidance on the creation, preservation, and security of records to be retained for legal, operational, or historical reasons, and to encourage the disposal of records of no further value. Refer to the Information Classification and Protection Policy for definitions of Confidential and RESTRICTED information, as well as security controls that apply to records management.

Specifically, department managers should:

• Create only the records the department needs.
• Retain records according to the Records Retention Schedule.
• Maintain records in appropriate storage and locations.
• Limit access to records of confidential information on a "need to know" basis.
• Secure access to records of RESTRICTED information (e.g., SSN, HIPAA, etc.) either by:
  
  
  • Encrypting digital records.
  • Keeping physical records locked or supervised at all times.
• Preserve records of historical significance.
• Dispose of records no longer required in the proper manner.

The Records Management Policy applies to all University Records. Only those records created, received, or recorded outside the scope of employment are considered personal records.

2.0 Definition of University Records

Records shall mean information stored on any media (e.g., paper, electronic, and so forth). University records shall include all forms of recorded information created or received by officers or employees of Pepperdine University acting in the course and scope of their duties, in the course of University business, or filed pursuant to the University's legal obligations. University records include but are not limited to: printed or handwritten text; moving images and photographs; sound recordings; drawings and maps; and computer data or other machine-readable electronic records. University records are the property of the University, except as prescribed in other University policies on intellectual property (e.g., University Policy on Patents and Copyrights).

3.0 Responsibility for Management of University Records

The primary responsibility for managing the University’s records rests with each department. Departments shall maintain and dispose of all University records in accordance with the “Records Retention Schedule.” Although departments and offices may contract with third-party commercial vendors for records storage, imaging, and destruction services, each department remains ultimately responsible for the proper management of its records. In addition, each department is strongly encouraged to designate one day or a portion thereof each year to allow its employees to focus on the requirements in the Records Management Policy.

Departments with external reporting or audit requirements or which generate records that require permanent retention are encouraged to develop written procedures for complying with this policy.

4.0 Records Retention Schedule

The “Records Retention Schedule” may be referenced from the current University policies webpage and is updated annually or as needed by General Counsel. The schedule is a non-exhaustive timetable stating a recommended retention period. Where possible, it provides the legal authority for a minimum retention period. The retention periods in the timetable apply to the official record copy of certain records. The data manager will retain an official record copy, in accordance with this Records Management Policy. Additional "convenience" copies may be retained or disposed of as necessary, but shall not be retained longer than the official record copy. The various federal and state laws may not be the only factors to consider when determining the period of time to maintain records. Other University or departmental policies or contracts that Pepperdine has entered into may dictate an extended retention period. Further, University records retention may need to be extended for operational reasons (i.e., records that are needed so the user can do his or her job).

5.0 Records Storage

6.0 Records Disposal

Records should be disposed of in accordance with the “Records Retention Schedule.” When large quantities of records are disposed of, each department is encouraged, where appropriate, to document the destruction of such records. An optional records disposal log form may be obtained as part of the "Records Retention Schedule." Digital media, computers, and devices containing University Records shall be disposed of in accordance with the Information Technology Electronic Device Transfer and Disposal Standard.

7.0 Records Holds

Records otherwise due for disposal may become subject to a litigation hold or "preservation order." General Counsel shall notify departments of records that are subject to a litigation hold, and such records should not be disposed of until the hold has been lifted. Departments shall maintain records subject to a hold in such a way that they are not inadvertently disposed.

8.0 Historical Records

Some records should be maintained for historical value. The University Archive is the repository for the University's historical records. The University Archivist is available to review records to determine their archival value and/or to provide advice regarding the necessary procedures to properly archive materials.

Revision History

See Also:

• Information Classification and Protection Policy
• Records Retention Schedule

← Back to Policies & Standards.