A quick guide on how to build excellence and drive compliance in the Record Management Function
The Record Management function, part of the broader Content Management landscape, has long been neglected by organizations or isolated in business units. This treatment has typically led to the hoarding of information, insufficient transparency into the location of physical/digital records along with high maintenance and/or reconciliation of data sources costs. In addition, organizations have borne high compliance risks, as not all applications may have the ability to securely store or dispose of data.
Big Data and Data Lake ecosystems, which were originally introduced to allow consumption and processing of large data volumes, business analytics and data privacy regulations (e.g. European General Data Protection Regulation (GDPR) or U.S. California Consumer Privacy Act (CCPA)) have recently put Record Management in the spotlight. A pertinent example, highlighting the shift in focus towards Record Management, is the CCPA right granted to consumers to request that their data, held by an organization or third parties thereof, be deleted.1 The strategic and operational implications derived from this use case are multifold, raising complex questions to be answered by firms:
- Is consumer data eligible for deletion without affecting compliance to regulatory requirements or impacting business operations?
- What are acceptable and feasible methods to dispose of data records? Are alternatives, ranging from full purging to other more “light” means of disposal (tokenization, encryption, archiving, masking), acceptable or practical?
- What is the best technical method of data disposal when alternatives range from manual erasure to state-of-the-art automated solutions?
It becomes obvious that establishing an enterprise-wide Record Management program is not an easy or quick exercise, but instead, requires strategic planning and careful execution considering both enabling factors and core facilitating dimensions. The overarching framework shown below summarizes these factors and serves as a guide during the implementation journey.
Source: Accenture, September 2019
While enabling factors are not further addressed in this post, they represent essential pre-requisites for the overall effectiveness of the program. Enablers primarily focus on identifying data locations by performing continuous data discovery and classification of content, preferably with the support of a discovery tool, and an understanding of data movements and processing via data lineage capabilities.
When it comes to the facilitating dimensions, an initial mandate of critical importance is the establishment of a sound enterprise governance concept for Record Management, with clear responsibilities and accountabilities for the first and second lines of defense. This should also promote the setting of tailored policies and procedures on the treatment of records and central maintenance of comprehensive records retention schedules, satisfying various retention requirements like operational, regulatory and legal holds.
From a technical perspective, one of the simplest ways to perform data deletion uses manual or semi-manual erasure. While this option seems appealing due to its simplicity, it also bears the risk of human error and high associated costs. The shortcomings of this approach have been recognized in Europe as the implementation of GDPR has raised concerns with the deletion of large volumes of consumer data. Solutions developed in Europe, typically include higher levels of automation using records retention rules engines and central orchestration of automatic deletion processes (e.g. batch or ad-hoc) in the system of records. Leveraging these leading practices and solutions can benefit U.S. companies aiming to enhance their Record Management capabilities and to comply with data privacy requirements.
While the journey to excellence in Record Management requires a strategic vision and management support, the long-term benefits can be substantial. Especially as organizations modernize their data architectures and develop increasingly advanced analytics or artificial intelligence and machine learning-based programs.
Are you ready for excellence in your Record Management function? Accenture can help.
- “Assembly Bill No. 375 – Chapter 55,” California Legislative information, June 29, 2018. Access at: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375