1. What & Why
A lot of information has little or no long term value, suchas lunchinvites, post-it
notes, leaflets advertising particular events etc.
YES NO

2. in every organisation there willbe a core of
records that make upthe corporate memory of
that organisation.
Within this core of records is the smaller subset of
Vital Records. These are the records without which
the organisation cannot function.

3. So what’s the
difference?
Information ought to be managed efficiently but records must
be managed efficiently and effectively. When we understand the
value of the information we hold, its value to us, to the
University and other people, then it is easier to understand why
we need to treat it carefully. Take an interest in its welfare!

4. Because the University owns the information with which we work, we are
merely the custodians for the duration of our employment. It is our
collective responsibility to ensure that, wherever we work, records are
being organised and processed correctly.
We are not the owners of the information with which we work. Even if you
are an academic with an exemption clause in your contract, this only relates
to a small, predefined part of your work. The rest remains the property of the
University and the
University has a legal obligation to manage its information and records
in accordance with the legal and regulatory framework in which it
operates.

5. Records share a certain set of
characteristics. They are authentic, reliable,
have integrity and usability.Pneumonic =
GANDALF
Genuine
Accurate
Necessary
Durable
Auditable
Legally Admissible
Findable

6. It is our responsibility to ensure that the University’s
records retain these characteristics, regardless of
format. Records are no longer just paper files, on dusty
shelves… they are not even restricted to corporate
databases, MS Office documents or PDFs… records can
be emails, chat messages, tape cassettes, DVDs, social
media posts, website content and even
tweets. Applying records management principles to
records in all these formats and more is the growing
challenge of the 21st Century.

7. Technology is now an essential part of
our lives – buttechnology has a dark side
– cyber-crime, identitytheft, phishing,
denial of service, these all resultin ‘data
leakage’.
Data leakage means the loss of privacy,
identity, money, intellectual property or
reputation. The most common cause of
data leakage is human error (e.g. laptops
left in taxis, weak passwords, hard drive
bought on EBay).

8. Data Protection
The Universityprocesses many differenttypes of informationandwe need to
knowwhichtype we aredealingwith. The Data ProtectionAct 1998defines
two types ofinformation...

9. This the data we hold about individuals, whether
applicants, students, graduates or members of
staff (past and present).
Not only does personal data relate to facts, but
also to opinions, so we should all take care to
write in a professional and neutral way,
regardless of how informal the communication
medium (emails, chat etc.) may appear.

10. Sensitive Personal Data
This is further data about these same individuals, but relating to certain defined
categories of sensitive data, that is:
Physical and mental health conditions
Religious beliefs or beliefs of a similar nature
Racial or ethnic origin
Sexual life
Political opinions
Whether or not a person is a member of a trade union
The commission or alleged commission of any offence
Or Any sentences from that offence
The Data Protection Act 1998 (DPA) only allows us to process this data in
certain circumstances, in order to protect the data and the individuals to
whom it applies. This means that we only ask for the minimum amount of
information for our needs on collection, that we keep that data even more
securely than personal data, and only use it in specific circumstances.

11. When we are collecting data, we need to consider what personal and
sensitive personal data we are collecting. If we think of this before we
collect it, then we only collect what we need. The Data Protection Act
requires us to only collect the data we need to carry out our jobs. We also
need to think about the data we hold as the work progresses over the years,
as we may need to collect new data, or we may no longer need some of the
data we originally collected.
When we collect data from individuals, the DPA requires us to tell people what we’re going to
do with their data [data protectionstatements
http://www.port.ac.uk/accesstoinformation/policies/information/]. We can’t then, use that
data foranything new without first asking the individuals, whether staff or students for
theirconsent. So its best to think about what you need the data for when first collecting it.

12. There are other types of restricted data, not covered by the DPA, such as
commercially confidential records or intellectual property that also need
to be given suitable protection and/or extra thought when we collect,
hold and use it.
The HE sector faces a growing challenge from cyber threats - targeted at our
Intellectual Property (IP). IP is vital to innovation and our economic development as a
nation.
Remember to hold, use and store restricted data on secure UoP computers only.

13. For most otherorganisations theconsequences are less
terminal in a humansense, butcould well cause big
problems in a businesssense. There has recently beena
lot of publicityover a University that didn’t keep
accurate records of its international students. As a
result it had its sponsor status temporarily suspended,
had to make arrangements for all of its international
students currently in thecountry and could notaccept
any new students for at least a term. This has had a
massive effect on its reputation as a University.

14. So longas we have a goodreason for whywe are
collectinginformation,whether personaland
sensitive personal data, ordata relatingto the
University, then we can collect it. However,just
because we thinkit might be useful orwe might
want itinthe future is not a goodenough reason
for processingthe information.
When thinking about the data we need to process, it helps to
think about why we need it. There may be legal or funding
requirements outside of our control that mean we have to
collect data, or we may need the information for our own
reasons. We need to know the details of a student's
qualifications, to know that they are capable of getting on their
course, and we have to provide this qualification information to
HEFCE. We also need to collect for our own purposes though,
student and staff emergency contact details, in case we need to
contact someone if something happens to you.