Information Governance: know what you have, know why you have it

‘Everybody gets so much information all day long that they lose their common sense.’

– Gertrude Stein

It is important for any business or organisation to know what information they hold, where they hold it, and why.

Information can be highly sensitive, private or valuable. Sometimes it can be all these things at once. When this is the case, measures can be put in place to control and protect it, such as Data Loss Prevention (DLP). Other times, information can be redundant, obsolete or trivial (ROT). It this case, information may have no inherent need or value. It may simply be taking up space on servers, on hard drives, or in filling cabinets and creating organisational risk.

Identifying where your information is, and what value it holds, is one the biggest challenges facing information owners and controllers. Not knowing the answer to these questions can cost an organisation time, money and efficiency, leading to commercial and reputational damage. Sensitive, personal information can become compromised, while useful, valuable information can become lost or forgotten. This article will examine Information Governance in broad terms and consider how one of its key components, the retention and deletion of information assets, can help organisations minimise risk and maximise value.

What is Information Governance?

Information Governance is central to how an organisation controls, deploys and safeguards its information assets. Gartner defines information governance as the identification of the rules and practices to be built into a framework to ensure the appropriate management of information throughout its lifecycle, from valuation, creation, storage, use, archiving and deletion. This includes such things as policy, processes, roles and responsibilities, standards and metrics that ensure the effective and efficient use of information.

Information Governance is a broad church. Needs vary between organisations, depending on business priorities and information and organisational maturity. Some of its key disciplines include:

• Information Management
• Information Security, Content Management
• IT and Data Governance
• Privacy and Data Protection
• Digital Preservation
• Digital Continuity
• Knowledge Management

Although Information Governance is typically referenced in a digital context, it also incorporates physical assets, such as hard-copy documents, hardware and removable media. It applies to information stored locally as well as on the cloud. It applies to structured information, such as customer account data held in a CRM or other database, as well as unstructured data, such as medical records or general business documents (emails, presentations, spreadsheets) that are not mapped to structured information systems.

There are numerous laws and regulations that apply to Information Governance, across multiple jurisdictions. Themes include:

• Data Protection and Privacy
• Cybersecurity
• Freedom of Information
• Public Records / Archives
• Records Management
• Computer Misuse
• Human Rights
• Health and Social care

However, Information Governance is more than just a series of legal requirements set out for an organisation to follow. Establishing a bespoke and adaptable Information Governance framework and programme can help organisations derive greater value from their information assets, while minimising risk. It is important to understand what your organisation’s drives and objectives are when establishing an Information Governance strategy. Knowing what you have and why you have it can not only protect you from legal and security risks, but it can also aid with corporate decision making and improve productivity, insight and efficiency.

One of the key universal principles of Information Governance – and one which all organisations should address – is the appropriate retention and deletion of information.

Knowing what you have, knowing why you have it

Knowing what information you have and why you have it is a vital step to maximising value and minimising risk.

The over-retention of information is often a needless and self-imposed burden organisations place upon themselves.

There are some practical steps you can take to address this:

1. Perform a data mapping exercise on the information you hold, with the aim of creating an Information Asset Register (IAR) of both personal and non-personal information assets.
2. Use this Register to evaluate information assets and assign appropriate retention triggers, leading to the creation of a stable of Retention Schedules.
3. Formalise a Retention Policy, identifying roles and responsibilities, process and sign off, building on the above.
4. Formalise a Deletion Policy and process, alongside a formal Record of Destruction document – this is used to capture some key metadata relating to the information deleted.

When evaluating what information is suitable for retention and deletion, careful consideration must be given to legal and regulatory requirements. In many industries, certain types of data must be retained for set periods of time, while other records – for example, financial and HR information, may be subject to requirements from national agencies and bodies. Retention Schedules and policy must take all relevant regulations and laws into account, including data protection legislation. It’s vital to understand the legal and regulatory landscape, as well as how to implement deletion activities securely across systems, structures and format types, before you proceed. For a more in-depth analysis of Retention Schedules, please see our related post here.

The Trilateral Research Data Protection and Cyber-risk team has extensive experience and expertise in dealing with Information Governance and data protection, helping clients design and complete IARs and data mapping exercises, develop retention schedules and implement compliant deletion processes. If you need help, please contact one of our experts, or email dcs@trilateralresearch.com to discuss your requirements. Our team would be happy to help.