• Section 1 - Introduction
• Section 2 - Purpose
• Section 3 - Scope
• Section 4 - Audience
• Section 5 - Definitions
• Section 6 - Roles and Responsibilities
• Vice-Chancellor
• Committee Members
• Digital Technology Solutions (DTS)
• Data Governance Committee
• Information Owners 
• Procurement and Contract Managers
• Manager, Records Governance Services
• Senior Responsible Officer
• System Owners
• University Librarian (as the University Archivist)
• Section 7 - Records and Information Management Principles
• Strategic Assets and State Archives
• Section 8 - Records and Information Management Standards 
• Creation and Capture of University Records
• Section 9 - Monitoring and Compliance 
• Recordkeeping Incidents
• Access Management
• Compliant Access
• Access Directions
• Section 10 - Supporting Procedures 

Section 1 - Introduction

(1) The University of Newcastle (University) recognises records as a subset of its enterprise data assets.

(2) The Information Governance Policy and Framework (Framework), as the primary governance document for information governance, establishes the overarching arrangements for the governance of data, information and records across the University. 

(3) As a subordinate document to the Framework, the Records and Information Management Policy (the Policy) ensures that University records, information and data are managed as authoritative assets that support business operations, accountability and the information lifecycle as required under the State Records Act 1998 (the Act).

(4) The University is a public office for the purposes of the State Records Act 1998. The Vice-Chancellor, as principal executive officer of the University, is responsible under section 10 of the Act for ensuring that the University maintains an effective records and information management program and fulfils its statutory recordkeeping obligations.

(5) The policy documents relating to data, information and records operate subject to applicable legislative and regulatory requirements. Where a provision of this Policy or the Framework is inconsistent with a legislative or regulatory requirement, the legislative or regulatory requirement prevails to the extent of the inconsistency.

(6) Where a conflict exists between this Policy and the Framework, the Framework applies to the extent of the inconsistency.

Section 2 - Purpose

(7) This Policy codifies the University's obligations and responsibilities for the creation, management, access, retention and disposal of University records in accordance with the Act and associated standards, including the Standard on records management (Standard No.15, issued 14 February 2025).

(8) This Policy and its supporting Records and Information Management Procedure are resources for the management of the University's records. The Policy and Procedure establish the governance requirements, support accountability and compliance, and contribute to the preservation of corporate memory.

Section 3 - Scope

(9) This Policy applies to all records, information and associated data created, received, maintained or managed by the University regardless of format, medium, location, technology platform or storage environment, including records managed by third party providers and cloud service providers on behalf of the University.

(10) This Policy applies to:

1. all records, information and data created, received, maintained or managed during University business, including business of the University's controlled entities; regardless of format, medium, storage location or technology platform. Records may be physical, digital or held by third party service providers;
2. all University employees including academic and professional staff, and teachers; and
3. contractors, consultants, affiliates, visiting appointees and others undertaking work for or on behalf of the University, including members of advisory and governing bodies and staff of the University's controlled entities, including NAIHE.

(11) This Policy is supported by and must be read in conjunction with the Records and Information Management Procedure.

Section 4 - Audience

(12) This policy should be read and understood by all University staff; University volunteers, contractors and vendors; consultants and others doing work for or on behalf of the University.

Section 5 - Definitions

(13) Refer to the Information Governance Policy and Framework and Data Governance Policy for other definitions that are relevant this Policy. 

(14) In the context of this Policy and the Records and Information Management Procedure the following definitions apply:

1. “appraised” or “appraisal” refers to the recurrent process of evaluating business activities to determine which records need to be created and captured as well as how, and how long the records need to be kept. The process combines an understanding of business activities and their context with:
   1. the identification of business needs, regulatory requirements and societal expectations relating to records; and
   2. the assessment of opportunities and risks associated with the creation and management of records;
2. “approved business system” means a business application or information system that has been assessed and approved by the Senior Responsible Officer for the creation, capture, management and retention of University records;
3. “destruction” and/or “destroy” means the complete and irreversible physical erasure of a record(s) ensuring that it cannot be reconstructed;
4. “disposition” is the authorised and documented process of deciding what happens to records when they are no longer needed for current business purposes, whether that means destruction, transfer, or permanent preservation;
5.  “defensible disposal” is the systematic and documented disposal of records, undertaken in accordance with business needs, and in a way that demonstrates that data, information and records are disposed of appropriately, consistently, with due diligence according to the State Records Act requirements;
6. “Normal Administrative Practice” or “NAP” refers to a provision under the State Records Regulation 2024 that permits the routine destruction of certain types of facilitative and duplicate records that have limited or incidental relevance to University activities. NAP records are usually not required for ongoing business or accountability purposes;
7. “access directions” refers to the State Records NSW framework for regulating public access to State records;
8. “disposal” means the range of processes associated with implementing appraisal decisions. These include the retention, deletion or destruction of University records in or from a business system. This may also include the migration of University records between recordkeeping systems, and the transfer of custody or ownership of University records;
9. “high-risk and high-value records” or “HRHV”  means:
   1. records with retention periods greater than 20 years;
   2. records documenting the University's core teaching, research and student administration functions;
   3. significant corporate records;
   4. records containing personal information or health information;
   5. major contracts and agreements with expenditure of $150,000 or more (including GST);
   6. records documenting significant organisational change; and
   7. records identified as State archives. 
10. “Enterprise Records and Information Asset Register” refers to the register maintained by the University which identifies information assets, systems, Information Owners, System Owners, classifications, retention requirements and high risk and high value records;
11. “records continuum” refers to the ongoing management of records from their creation and capture through to retention, disposal or permanent preservation;
12. “retention” refers to the minimum period for which records should be kept to meet regulatory, business, and community requirements before their disposal can be authorised. Disposal may be either destruction or transferred into the MHNSW.
13. “Senior Records Officer”: in accordance with the State Records Act 1998, the Senior Responsible Officer is the officer nominated by the Vice-Chancellor to hold corporate responsibility for records and information management across the University. At the University of Newcastle this responsibility rests with the Chief Digital & Information Officer (CDIO);
14. “State archive” refers to a State record identified for permanent retention under an authorised retention and disposal authority determined by State Records NSW;
15. “Systems of Record” or “SoR”: SoR are Information Business Systems approved by the Senior Records Officer (SRO) following assessment for acceptable security and recordkeeping functionality (refer to Digital Security Policy). A System of Record must:
    1. support records lifecycle management;
    2. maintain authoritative metadata;
    3. maintain audit logs;
    4. prevent unauthorised deletion;
    5. support retention and disposal requirements;
    6. restrict and manage access appropriately;
    7. have an assigned Information Owner and System Owner; and
    8. be approved under this Policy as a System of Record. 
    9. be listed in the relevant Schedule (see Section 10). 
16. “Transfer” means the authorised transfer of records between business systems, custodians or archival repositories.

Section 6 - Roles and Responsibilities

(15) In addition to the roles and responsibilities codified in the Information Governance Policy and Framework, the following roles have specific records management responsibilities under this Policy and the Records and Information Management Procedure.

Vice-Chancellor

(16) As the principal executive officer of the University:

1. is responsible under section 10 of the State Records Act for ensuring institutional compliance with records legislation and standards;
2. ensures appropriate resources are available to support records and information management;
3. appoints the Senior Responsible Officer; and
4. receives reports on major records management risks and compliance matters.

Committee Members

(17) Chairs have a responsibility to ensure full and accurate records of committee business are created, retained and protected (see Committees Governance Policy).

Digital Technology Solutions (DTS)

(18) DTS is responsible for:

1. maintaining approved records systems;
2. supporting migrations and decommissioning projects;
3. maintaining integrity, availability and security of records; and
4. managing outsourced and cloud service arrangements supporting recordkeeping.

Data Governance Committee

(19) The Data Governance Committee:

1. provides strategic oversight of records, information and data governance;
2. monitors records management risks and compliance;
3. endorses records management strategy and major initiatives; and
4. supports continual improvement of records and information management practices.

Information Owners 

(20) Information Owners are responsible for the management, access and protection of records and information within their assigned domain.

(21) Information Owners are responsible for:

1. approving access to, use of and sharing of records and information within their domain, subject to relevant delegated authorities, legal requirements, including but not limited privacy obligations and the responsibilities defined in the Data Governance Policy’s Ownership Role Reference Guide;
2. identifying and managing high-risk and high-value records and information created, received or maintained within their domain and ensuring their protection through appropriate business continuity, disaster recovery and information security arrangements;
3. ensuring staff, contractors and other workers within their domain understand and fulfil their recordkeeping responsibilities, including the prohibition on the unauthorised destruction of University records;
4. ensuring appropriate systems, controls and business processes are in place to support the creation, capture, storage, access, retention and authorised disposal of records within their domain;
5. maintaining access to technology dependent records and information until their authorised disposal;
6. confirming that new business systems are assessed and approved as University systems of record, where applicable, prior to implementation;
7. ensuring records and information remain accessible, usable and appropriately managed through all stages of the information lifecycle, including system changes, migrations, replacements and decommissioning activities;
8. supporting the lawful retention, transfer and disposal of records in accordance with approved retention and disposal authorities and University requirements;
9. identifying and managing high risk and high value records within their domain;
10. ensuring recordkeeping requirements are incorporated into business processes;
11. ensuring records remain accessible throughout system lifecycles; and
12. supporting authorised disposal and transfer activities.

Procurement and Contract Managers

(22) Procurement and Contract Managers are responsible for:

1. incorporating records, information and data management requirements into procurement documentation and contracts;
2. ensuring contractual arrangements support University recordkeeping obligations; and
3. ensuring third party providers comply with this Policy.

Manager, Records Governance Services

(23) The Manager, Records Governance Services has a responsibility for management of the University's records in accordance with this Policy and the Records and Information Management Procedure.

Senior Responsible Officer

(24) The Senior Responsible Officer:

1. oversees the University's Records and Information Management Program;
2. approves:
   1. Systems of Record and approved business systems;
   2. retention and disposal project activities;
   3. access directions; and 
   4. transfer arrangements relating to State archives;
3. monitors compliance with this Policy;
4. coordinates participation in State Records NSW monitoring exercises;
5. escalates significant records management risks; and
6. notifies State Records NSW where records are damaged, impaired, lost or unlawfully destroyed.

System Owners

(25) System Owners are responsible for:

1. ensuring systems meet recordkeeping requirements;
2. preventing unauthorised destruction or deletion of records;
3. implementing access and security controls;
4. supporting retention and disposal requirements; and
5. ensuring records remain accessible following upgrades, migrations and system replacements.

University Librarian (as the University Archivist)

(26) In consultation with Manager, Records Governance Services, the University Librarian has a responsibility for the care of the University's physical records that are identified as State Archives under the Act, in accordance with the University's Regional Archives Centre Agreement.

Section 7 - Records and Information Management Principles

(27) The University of Newcastle is a public office for the purposes of the Act. This Policy and its associated Procedure is aligned to the Standard on records management and the Information Governance Policy and Framework to ensure that the University: 

1. consistently operates within an approved governance framework for the management of records, information and data in a manner that supports all business operations, instilling a good recordkeeping culture and robust provisions for outsourcing and service delivery arrangements and monitoring;
2. identifies and defines records, information and data to support business activities, enabling the University to effectively support the information life cycle and protect its high-value and high-risk areas of core business and the records that provide evidence of these activities; 
3. effectively manages its records, information and data to ensure they are trustworthy, accessible and retained for as long as they are needed regardless of format, environment and system used; and
4. records, information and data are managed throughout the records continuum and protected according to their business value, risk, evidential value and legal requirements.

Strategic Assets and State Archives

(28)  The University recognises records, information and data as strategic assets that:

1. support teaching and learning;
2. support research activities;
3. support decision making;
4. protect legal rights and obligations;
5. preserve institutional memory; and
6. document the history of the University and higher education within New South Wales.

(29) Records identified as State archives will be preserved, protected and transferred in accordance with authorised retention and disposal authorities, the State Records Act 1998 and the University's Regional Archives Centre arrangements.

(30) Records of enduring value must remain reliable, accessible and usable for as long as required under the State Records Act.

Section 8 - Records and Information Management Standards 

Creation and Capture of University Records

(31) All staff, contractors and persons acting on behalf of the University must:

1. create full and accurate records of University business activities;
2. create records that document decisions, actions and transactions;
3. capture records as soon as practicable following a business activity;
4. create file notes or meeting notes where no other record exists; and
5. ensure records created or received via email, Microsoft Teams, SharePoint, OneDrive, social media platforms, mobile devices and business systems are appropriately captured and retained.

(32) Effective management of University records:

1. provides evidence of our actions and decisions;
2. creates vital assets that support daily functions and operations;
3. protects our interests, the rights of our community and the people of New South Wales;
4. ensures our services are delivered consistently and equitably; 
5. captures our corporate memory for posterity;
6. recognises that University records are the property of the University of Newcastle, not of individual staff or contractors;
7. allocates responsibilities for the day-to-day management of records aligned to the designated data owners in accordance with the Data Governance Policy.  

(33) University records must always be:

1. created and retained within an authorised System of Record, or another approved business system or, for physical records, held in an appropriate location (refer to the Records and Information Management Procedure) where they are subject to a retention greater than 30-years;
2. discoverable by those with legitimate need and appropriate access for as long as required; and
3. accurate, up to date and complete and never destroyed without authorisation.

(34) University Systems of Record protect records from unauthorised access, alteration, deletion and misuse, and ensure that records retain value as evidence. Refer to the Records and Information Management Procedure.

(35) Records management practices:

1. support good decision-making, accountability and transparency to deliver best practice business outcomes;
2. are intrinsic to all processes, systems and services offered by the University; 
3. ensure:
   1. records, information and data are managed throughout the records continuum;
   2. recordkeeping requirements are incorporated into outsourcing and cloud service arrangements;
   3. records and information management risks are identified and managed through appropriate governance mechanisms;
   4. high risk and high value records are subject to enhanced controls and oversight;
   5. records are kept for as long as they are needed for business and legal accountability in accordance with retention and disposal authorities codified by the Act. (For details of the authorised destruction process refer to the Records and Information Management Procedure);
   6. controls placed on records and information are proportionate to their value, sensitivity and risk associated, and align to the Information Classification and Protection Policy;
   7. access to records is authorised and managed appropriately in accordance with the Information Security Access Control Policy;
   8. records and information assets are managed across all formats, systems, environments (including cloud services) and physical locations, and remain accessible through system changes; and
   9. records required as State Archives are subject to additional requirements, including access directions and transfer arrangements.
4. ensure University records are only destroyed when: 
   1. an approved disposal authority is issued;
   2. a pre-approved destruction agreement has been implemented; or
   3. Principles of Normal Administrative Practice (NAP) are applied. 
5. demonstrate that disposal activities conducted by the University are lawful, authorised and documented. 

(36) An Enterprise Records and Information Asset Register is maintained by the University. Refer to the Records and Information Management Procedure for more information.

(37) Whenever new systems are procured or replaced the records lifecycle must be considered, ensuring that records remain accessible, reliable and usable across the lifecycle activities. Refer to the Records and Information Management Procedure for more information.   

(38) Physical records must:

1. be securely stored and protected;
2. have known and controlled locations;
3. be protected from environmental damage and unauthorised access; 
4. be managed in accordance with authorised retention and disposal authorities; and

(39) Whenever physical records are digitised, destruction of source records may only occur where authorised by relevant State Records NSW disposal authorities in accordance with the Records and Information Management Procedure.

Section 9 - Monitoring and Compliance 

(40) The University will monitor compliance with this Policy through:

1. audits and risk reviews;
2. records management assessments;
3. system monitoring;
4. compliance reporting; and
5. State Records NSW monitoring activities.

(41) Findings from compliance activities will be used to:

1. identify risks;
2. address non-compliance;
3. improve records management practices; and
4. support continual improvement.

(42) Serious or repeated non-compliance with this Policy may result in disciplinary action, contractual remedies or other corrective action as authorised by the SRO.

Recordkeeping Incidents

(43) Any incident impacting University records must be reported accordance with the University's Compliance Management Framework. 

(44) Incidents include:

1. unauthorised destruction;
2. loss, damage or corruption;
3. unauthorised alteration; and
4. unauthorised disclosure.

(45) Significant incidents will be subject to a breach report and escalation to the SRO.  The SRO will notify State Records NSW as required following the loss, impairment, damage or unlawful destruction of State records.

Access Management

(46) Information Owners and System Administrators must ensure that the University records for which they are responsible for are protected from unauthorised access, disclosure, modification, loss, or damage.

(47) Attention must be given to restricting access and securing sensitive information, personal information, health information, and confidential records.

(48) Access must be monitored to ensure all access remains relevant and current, and a person’s access must be removed once it is no longer required.

Compliant Access

(49) All employees and contractors (refer to Audience) must comply with the:

1. Digital Security Policy, Privacy Policy and Privacy Management Plan and their associated documents when accessing University records; and
2. Research Data and Primary Materials Management Procedure when accessing research data / primary material.

(50) Access to University records that are not made publicly available by the University may be provided to external parties if:

1. considered permissible under all relevant University policies or where required by law; and
2. authorised by the relevant delegate; or
3. where not required to be authorised by the delegate, authorised by the Information Owner.

Access Directions

(51) State archives enter the open access period after 20 years unless subject to an approved Closed to Public Access direction.

(52) The State Records Act 1998 promotes the principle of open government by presuming all records are open to public access by default after 20 years.

(53) Refer to the Records and Information Management Procedure for more details. 

(54) The Act prohibits the unauthorised disposal of State records, and a penalty may be imposed for breaches of its disposal provisions. The Act does not override any other obligations of the University to retain records.

(55) Any suspected or actual breach of this Policy, supporting procedures or records legislation must be reported in accordance with the Information Governance Policy and Framework.

Section 10 - Supporting Procedures 

(56) This Policy is supported by the following procedures and guidelines:

1. Enterprise Records and Information Asset Register;
2. Access Directions Register (link to MHNSW Services Portal);
3. Records and Information Management Procedure;
4. NAP schedule;
5. M365 records schedule;
6. Systems of Record Schedule.