• Section 1 - Introduction
• Section 2 - Purpose
• Section 3 - Scope
• Section 4 - Audience
• Section 5 - Definitions
• Section 6 - Roles and Responsibilities
• Section 7 - Procedures 
• Part A - Create Records
• Creation of Records
• Part B - Capture Records
• Capture Requirements
• Procurement of new systems and/or upgrades
• Implementing new technology and approvals of Systems of Record
• Third Party and Cloud Services
• Management of Physical Records
• Part C - Organise, Store and Access Records
• Information Asset Register
• Metadata
• Protection and Access
• High-Risk and High-Value Records
• State Archives
• Part D - Retain Records
• Retention Requirements
• Access Directions
• Part E - Dispose of Records
• Principles of Normal Administrative Practice (NAP)
• Destruction of Records
• Pre-approved Destruction
• System Decommissioning
• Leaving the University
• Section 8 - Monitoring and Compliance

Section 1 - Introduction

(1) This Procedure supports the Records and Information Management Policy by establishing requirements for the creation, capture, organisation, storage, access, retention, disposal and transfer of University of Newcastle (University) records and information throughout their lifecycle. 

Section 2 - Purpose

(2) This Procedure establishes the requirements to:

1. ensure records and information are created, managed and protected in accordance with the State Records Act NSW 1998 (the Act);
2. ensure records remain authentic, reliable, accessible and usable for as long as required;
3. support Information Owners meet their responsibilities across the information lifecycle;
4. support privacy, cyber security and data minimisation principles;
5. enable lawful disposal of records and transfer of State archives; and
6. support integration of records management, data governance and information governance across the University. 

Section 3 - Scope

(3) This procedure applies to:

1. all records, information and data created, received, maintained or managed during University business, including business of the University's controlled entities; regardless of format, medium, storage location or technology platform. Records may be physical, digital or held by third party service providers;
2. all University employees including academic and professional staff, and teachers; and
3. contractors, consultants, affiliates, visiting appointees and others undertaking work for or on behalf of the University, including members of advisory and governing bodies and staff of the University's controlled entities including NAIHE.

Section 4 - Audience

(4) This Procedure has been developed primarily for Information Owners, however, it should also be read and understood by University staff; University volunteers, contractors and vendors; consultants and others doing work for or on behalf of the University and its controlled entities.

Section 5 - Definitions

(5) Refer to the Information Governance Policy and Framework, Data Governance Policy, and Records and Information Management Policy for other definitions that are relevant to this Procedure. 

Section 6 - Roles and Responsibilities

(6) In addition to the roles and responsibilities outlined in the Records and Information Management Policy, the Records Governance Team (team) supports the Manager, Records Governance Services to maintain and implement the principles and procedures in relation to records and information management program. The team is responsible for:

1. providing support to Information Owners for the management of their records, regardless of format, including establishment of access protocols and the use of the enterprise recordkeeping systems including but not limited to systems listed in the Schedule of Approved Systems of Record;
2. delivering records and information management training and similar initiatives to the University's community to improve records and information management practices;
3. providing advice on records and information management, including business processes and identification of digital recordkeeping solutions;
4. providing advice on the authorised disposal of records, information and data;
5. responding to records and information management legislative and regulatory requirements; and
6. working collaboratively to maintain the University's Records and Information Asset Register.

Section 7 - Procedures 

Part A - Create Records

Creation of Records

(7) Full and accurate records must be created to document University business activities, decisions, actions and transactions.

(8) Records include any information, regardless of format, that provides evidence of University business activities.

(9) Examples of records include, but is not limited to:

1. emails, sent or received, that document business activity;
2. official reports;
3. official correspondence;
4. briefing notes;
5. meeting agendas and minutes;
6. file notes of conversations; and
7. decisions.

Part B - Capture Records

Capture Requirements

(10) Records must be captured into an approved storage location or business system that ensures they remain identifiable, retrievable, accessible and protected from unauthorised access, loss, alteration or destruction.

(11) Information Owners must periodically assess storage arrangements to ensure records remain secure and compliant. 

Procurement of new systems and/or upgrades

(12) Procurement documentation, contracts and service agreements must address:

1. ownership of records;
2. retention requirements;
3. disposal requirements;
4. access controls;
5. export capability;
6. migration requirements; 
7. security requirements; and
8. ensure that records remain accessible, reliable and usable throughout all lifecycle activities.

Implementing new technology and approvals of Systems of Record

(13) To determine if a business system is a System of Record, an assessment must be completed by an Information Owner using the evaluation form and submitted via records@newcastle.edu.au for review.

(14) Authorised business systems will be included in the Schedule of Approved Systems of Record.

(15) TRIM (OpenText) is the University's preferred enterprise records management system (EDRMS) for inactive, long term and High-Risk High-Value (HRHV) records. 

Third Party and Cloud Services

Records Created Using Artificial Intelligence (AI)

(16) Records created using artificial intelligence technologies are University records and must be managed in accordance with this procedure.  

(17) Where AI contributes to creation of records, Information Owners must ensure sufficient documentation and metadata exists to explain outputs, recommendations and resulting actions.

(18) Records created via AI must meet the State Records NSW recordkeeping obligations and standards, including the AI and Recordkeeping. 

Management of Physical Records

(19) Digitisation is the preferred method for managing physical records unless:

1. the original must be retained;
2. digitisation is impractical; or
3. destruction of the source record is not permitted under GA51 – Original or source records that have been copied.

(20) Digital copies must be created in accordance with State Records NSW requirements.

(21) Original records may be destroyed according to the principles of normal administrative practice (NAP) once three months have elapsed and digitisation quality assurance activities have been completed.

(22) Physical records must be stored in a suitable location to ensure compliance with the NSW Standard on the Physical Storage of State Records.

(23) Scanning records from hardcopy to digital only impacts their format; it has no bearing on the minimum legal period for which they must be retained. It may be possible, however, to destroy the source paper records as part of this process if the conditions for their destruction have been met. Contact records@newcastle.edu.au for all your scanning needs.

(24) Loss of or damage to physical records must be promptly reported to records@newcastle.edu.au, who will notify State Records NSW as required.

(25) Contact records@newcastle.edu.au for assistance with storage and disposal of physical records.

Part C - Organise, Store and Access Records

Information Asset Register

(26) The Enterprise Records and Information Asset Register provides a central record of the University's records and information assets, including ownership, storage locations, protection requirements, access arrangements and business continuity dependencies.

(27) Some of the University's records and information assets are held by third party providers on our behalf.

(28) The Enterprise Records and Information Asset Register is maintained by DTS and aligned to the Configuration Management Database (CMDB) identifying:

1. information assets;
2. approved business systems;
3. Systems of Record;
4. Information Owners;
5. System Owners;
6. information classifications;
7. retention requirements; and
8. high risk and high value records.

(29) Information Owners must periodically review and update the Enterprise Records and Information Asset Register.

(30) For more information about the Enterprise Records and Information Asset Register or to provide an update, contact records@newcastle.edu.au. 

Metadata

(31) University records and their metadata are created as part of the day-to-day business practices of its employees including teachers, researchers and affiliates. 

(32) Records must contain sufficient metadata to support their authenticity, reliability, accessibility and business context.

(33) Authoritative metadata for digital records includes:

1. Content: What the records contain.
2. Structure: The format and layout of the records.
3. Business Context: The circumstances under which the records were created, received, and used.
4. Relationships: How the records relate to other records, information and data.
5. Actions and events: The business activity connected to the records.
6. Retrieval information: Data needed to find and present the record in its entirety.

(34) Metadata must be maintained throughout the lifecycle of the record and be updated when significant changes occur to ensure records remain understandable and reliable. 

Protection and Access

(35) Records must be protected against unauthorised access, alteration, loss, destruction or disclosure. 

(36) Access to records must be restricted to authorised users based on business need and legislative requirements.

(37) Records must be classified, stored and accessed in accordance with the Information Classification and Protection Policy.

(38) Records must be stored in secure, approved locations, with appropriate access restrictions, security controls and preservation measures based on their confidentiality, sensitivity and format (see Information Security Access Control Policy).  

(39) Any University records (physical or digital) stored outside New South Wales must be managed in accordance with GA50 – Taking or sending records out of NSW. 

High-Risk and High-Value Records

(40) High-Risk and High-Value (HRHV) records require additional controls due to their business, legal, regulatory, financial, privacy or community significance. 

(41) Information Owners must ensure HRHV records:

1. are identified and listed on the Enterprise Records and Information Asset Register;
2. are stored in an EDRMS or an approved System of Record or another approved storage solution;
3. are included in business continuity and disaster recovery arrangements;
4. have appropriate access controls applied; and
5. remain accessible throughout their retention period, including through system migrations and technology changes. 

State Archives

(42) Information Owners must support the identification and ongoing management of records likely to be required as State archives.

(43) Physical and digital records that are identified as State archives and that are no longer needed by the University for ongoing business must be routinely transferred to the Museums of History NSW (MHNSW), or Auchmuty Library’s Special Collections and Archive.

(44) Records Governance Services and Special Collections and Archives teams collaborate to manage records that are no longer in use in accordance with the State archives principles, ensuring that:

1. physical records are managed by the Special Collections and Archives;
2. digital records are managed by Records Governance Services; and
3. Transfer Plans are jointly developed and submitted every five years, even if there is no intention to transfer records. 

Part D - Retain Records

Retention Requirements

(45) Records must be retained in accordance with the applicable Retention and Disposal Authority issued by State Records NSW. 

(46) Retention requirements apply regardless of format, storage location, business system and technology platform. 

(47) Records may need to be retained for longer than the life of the system in which they are stored. 

(48) Some record types will have additional and/ or specific storage and management requirements codified in relevant policies and procedures. For example:

1. Research Data and Primary Materials Management Procedure; 
2. Legal Procedure – Legal Records; and
3. Private Education regulation.

(49) Records that may have cultural significance or value to Aboriginal and Torres Strait Islander peoples’ decision-making should be retained for future use in accordance with Indigenous data governance principles.

(50) Personal information and/or health information must only be collected in accordance with the Privacy Management Plan and retained in compliance with the University's Privacy Policy and the Records and Information Management Policy.

(51) DTS will support the implementation of approved retention schedules as directed by Information Owners, and apply automated retention controls within enterprise systems, including Microsoft 365 environments, whenever practical.

(52) In consultation with Records Governance Services, Information Owners are responsible for:

1. ensuring retention requirements are applied to records within their domain of responsibility. Refer to the Enterprise Information Asset Register.
2. ensuring records remain accessible through system upgrades, migrations and decommissioning activities. 

Access Directions

(53) The Act promotes public access to State records once they reach the open access period.

(54) Information Owners are responsible for identifying records within their domain that are required to be held more than 20 years and require ‘Closed to Public (CPA) directions’ or ‘early access (EA) directions’. 

(55) In consultation with Information Owners, Records Governance Services will coordinate the submission, maintenance and review of access directions, in accordance with Museums of History NSW – Public Access to State Records Guidelines.

(56) Where an access direction is not renewed, records may become publicly accessible in accordance with legislative requirements. 

Part E - Dispose of Records

Principles of Normal Administrative Practice (NAP)

(57) Records that have no ongoing business, evidentiary or accountability value may be destroyed under the principles of Normal Administrative Practice (NAP).

(58) Examples may include, but are not limited to:

1. duplicate copies;
2. facilitative material;
3. working papers;
4. drafts not required as evidence;
5. transitory communications; and
6. unsolicited material. 

(59) NAP destruction of records must be secure and appropriate for their content. 

(60) For more information about NAP review State Records Regulation 2024, Schedule 2.

Destruction of Records

(61) Official records, regardless of format may be destroyed by the Information Owner when:

1. the record’s retention period has expired; and
2. they are no longer required for business purposes; and
3. there is no legal hold, investigation, audit or access request pending; and
4. the destruction is authorised by the Manager, Records Governance Services or another authorised delegate. 

(62) Destruction must be secure, irreversible and appropriate to the sensitivity and format of the records.

(63) To ensure defensible disposal the documentation and evidence of destruction should be submitted to records@newcastle.edu.au for safe keeping in accordance with the State Records Act.

Pre-approved Destruction

(64) Pre-approved destruction of records may be granted by the Manager, Records Governance Services or another authorised delegate, where it has been determined that the records are low risk and/or managed-in-place within a System of Record. The automated disposal may be managed by the University or an approved vendor.

(65) Pre-approved destruction arrangements will be documented in the Pre-approval Schedule and/ or a University approved Policy that is held in the Policy library.

(66) To ensure defensible disposal the evidence of destruction should be submitted to records@newcastle.edu.au for safe keeping in accordance with the State Records Act.

System Decommissioning

(67) Before a business system is decommissioned, upgraded or replaced, Information Owners and System Owners must assess:

1. retention requirements;
2. disposal requirements;
3. migration requirements; and
4. ongoing access requirements. 

(68) Records required to be retained must remain accessible and usable following system transition activities. 

(69) Complete the Checklist for Decommissioning Systems and submit via records@newcastle.edu.au for final assessment and advice.

Leaving the University

(70) Staff, affiliates and contractors leaving the University must ensure that records created, received or managed on behalf of the University remain accessible to authorised personnel and are managed in accordance with this Procedure. 

(71) Prior to separation, staff must:

1. transfer business records from personal drives, email accounts and local storage locations to approved University repositories;
2. ensure records required for ongoing business activities are accessible to their manager or nominated successor;
3. dispose of records only when authorised to do so; and
4. return any physical records or storage media held on behalf of the University. 

(72) Managers are responsible for ensuring appropriate arrangements are made for the ongoing management, custody and accessibility of records following the departure of a staff member. 

(73) Records must not be removed, deleted, copied for personal use or destroyed as part of a staff departure process unless authorised by the University.

(74) For more information use these resources and download the Records Checklist for Departing Staff.

Section 8 - Monitoring and Compliance

(75) Refer to Section 9 of the Records and Information Management Policy.