HR Records in a Growing Privacy Climate: Webinar Transcript

Duration: 0:59:56 · Recorded: 2025-08-21

Speakers: Jerry Manter, Marketing and Communications Specialist, Zasio (host); Brandon Tuley, CIPP/E, Licensed Attorney, Senior Analyst, Zasio; Jennifer Chadband, CRM, IGP, CIPP/E, Licensed Attorney, Senior Consultant and Consulting Co-Manager, Zasio; Rick Surber, CRM, IGP, Licensed Attorney, Senior Consultant and Consulting Co-Manager, Zasio

Lightly edited machine transcript. Slides are summarized where they carry information not spoken aloud.

Jerry Manter: All right, everybody, it's the top of the hour, so we'll go ahead and get started. My name is Jerry Manter, Marketing and Communications Specialist here at Zasio. Thank you everyone for joining us today for another edition of Virtual Coffee with Consulting. Just a quick refresher that the following should not be considered legal advice. Leading today's discussion is a special guest, Brandon Tuley. He is a Senior Analyst here at Zasio, and joining him will be familiar faces Jennifer Chadband and Rick Surber.

[Slide: Meet Our Presenters: Jennifer Chadband, CRM, IGP, CIPP/E, Licensed Attorney, Senior Consultant / Consulting Co-Manager; Brandon Tuley, CIPP/E, Licensed Attorney, Senior Analyst; Rick Surber, CRM, IGP, Licensed Attorney, Senior Consultant / Consulting Co-Manager.]

They are Senior Consultants and Co-Managers of Consulting. If you have any questions during the webinar, please submit them via the questions panel and we'll be sure to get a reply to you shortly. And also thank you to everyone who submitted a question ahead of today's conversation. At the conclusion, we invite you to take a survey at the end, let us know how we did and if there are any topics you would like a future Virtual Coffee session to cover, as we're always open to ideas. And that is all from me. I will now hand things off to Jennifer Chadband. Jen.

Jennifer Chadband: Great. Thanks, Jerry, for that introduction, and thanks everybody for joining us today. We're really excited to have Brandon join us. Brandon's a Senior Analyst here with Zasio. He's been with us for a little over five years, and so far he has really established himself as an important part of our consulting division and definitely has had plenty of opportunities working with us to get in the weeds on this topic.

Super knowledgeable, so we're really happy to be able to have this conversation today. Just a high-level, I guess, introduction to Virtual Coffee if you haven't joined us today, or I should say before. We, I think, hope or encourage everybody to have your cup of coffee, whatever your beverage of choice is: Diet Coke, water, etc., etc. Whatever that might be. And we do try to kind of structure this to have visuals and some content to take away, slides to guide us through the conversations.

But we do try to kind of keep it conversational and share some of the industry common practice, just general common practices that we're seeing, and just our knowledge and some guidance, I think, that we have developed that's helpful on these topics. So again, we do try to keep it casual, but welcome questions. There's opportunities to submit some questions. We've had a lot of pre-submitted questions that we do plan to discuss today, and unfortunately we're not able to address all of them. But we can circle back with folks as well as a follow-up to the presentation today. So a little bit more just on the topic in general.

I think this is a fascinating area for a couple different reasons. We're thinking about HR records. We're also thinking about personal data. We're also thinking about the evolving technology to manage these types of records, and even on a very granular level. I think it was maybe eight years now, I had written a blog and it was titled "Is Big Bucket Dead in the Age of Privacy?" And we'll, I think, get to the bottom of that a little bit more: how has that evolved, what is it looking like? And that's really kind of the premise for today's conversation.

How that's evolving with regard to HR-related records. So lots to talk about with that. I don't want to hold us up any longer. I want to kind of shift it over to Brandon and let him introduce us a bit more on the agenda, the different kind of subtopics we'll be talking about, and a little bit more on the details. So thanks, Brandon, and I'll hand it over to you.

Brandon Tuley: Awesome. Thank you for the introduction, Jen, and thank you to everyone for joining our discussion today. I will be the one giving the spoiler alert that the big bucket retention schedule is still very much alive, and why it remains a best practice, as well as that evolving nature of the big bucket retention schedule as these privacy pressures continue to grow in our RIM space. From a high-level strategy to specific HR record series categories, we've got a full agenda ahead. So we have some big picture topics that we'll discuss, as Jen had mentioned: that big bucket versus data object level complexity, how to bridge that gap between simplicity in the big bucket retention schedule and having those carve-outs with privacy considerations in mind, and then also diving into those specific areas, sort of those hot ticket items of specific areas of HR records.

[Slide: Practical Strategies to Bridge the Gap Between Operational Simplicity and Privacy. Obstacles: Deletion vs. Retention Dilemma (deletion pressures: storage limitation principle, cost savings; retention pressures: recordkeeping requirements, operational needs); Global Operations (retention policy complexity, global retention periods); Granularity vs. Big Bucket (lacking granularity results in over-retention; excessive granularity likely not followed).]

So to kick things off, we'll explore some of these challenges that organizations will face from a 30,000-foot view when balancing operational simplicity with growing privacy demands, starting with the deletion versus the retention dilemma. I like to think of this as a classic tug-of-war: delete it or keep it. Privacy tells you to delete it. Operations says to keep it. Legal tells you that it depends. All these stakeholders do have solid reasoning backing for why they have that opinion.

Unfortunately, oftentimes we're the one stuck in the middle that has to navigate this situation. For those that say to delete it, they're often going to cite privacy concerns, administrative costs for retaining information. Those that want to keep it, they'll reference express retention requirements, maybe a doomsday scenario 40 years ago where they had to produce something, and legal still just doubles down on "it depends." But just once you figured that out and worked through that process of that dilemma, then we throw in global operations. You're trying to account for various jurisdictions with different HR record types, and you want to account for all those in one policy.

You're trying to make sort of a one-size-fits-all for global operations, so it can be, to say the least, very difficult. But with that, in sort of the past couple years, I've been in a position, lucky enough to see a couple years post-GDPR and how that's evolved, and every day how that's changing, even year by year, seeing some of those changes. Specifically, we've seen an increased number of organizations reassessing that global retention period, specifically in those buckets where personal information is contained, trying to be aware of that limitation principle, really slam down those retention periods where they can and avoid that over-retention. And then where the rubber hits the road, we have the content and structure of the retention schedule. And what I mean by that is, are we trying for a big bucket or are we trying to have a very granular retention schedule?

Well, neither and both at the same time. That goal is to strike the right balance in the schedule so that you have those big buckets, but you're carving out that granularity as needed to be reflective of those privacy considerations. When you have that schedule that lacks granularity, it's ultimately going to result in over-retention of a lot of personal information. But on the flip side, when your schedule's too granular, it's something that looks great on paper, but from an operations standpoint, it's likely not going to be followed. It's too difficult. There's too many instances to navigate for stakeholders there. So we want to find that nice middle ground and carve out as necessary.

So building on that, I'm going to pass it back to Jen on some data object level management and how that fits with the big bucket retention schedule.

[Slide: Reconciling Data Object-Level Management With Big Bucket Retention Schedules. Graphic: tangled data object-level management vs. big bucket schedule (Legal, Finance, Personnel buckets); misalignment = risk. Key considerations: data object-level complexity (payroll entry, performance review, email); privacy and compliance risks (misalignment with retention categories: over-retention, under-retention); technology enables targeted deletion and data minimization.]

Jennifer Chadband: Yeah, great. Thanks for that, Brandon. I think you hit on some of the most important key points, this tension where we're trying to strike that balance, and thinking about how we go granular, why. I think this is definitely being driven by these privacy laws. Stepping back a little bit and looking at the retention schedule, though, we're also kind of thinking about this in the context of general personal information as well as sensitive personal information driving that granularity, as well as, I think, the legal recordkeeping requirements that really kind of help drive and define what should this level of granularity look like. At the same time, we are more and more managing information at the data object level, and we are having to reconcile that with the big bucket retention schedule. Two different sides of the spectrum, really.

And what does that look like? How do we do it practically? As Brandon noted, we go too granular and it's really just a matter of, this becomes very overly complex, difficult to manage. And it's also very costly to manage a schedule at that level, all the laws that are associated with everything on that very granular level. So really, it's finding that right balance. And what we're seeing with the management of data object level, the complexities.

And just to kind of introduce, for anybody who might not have familiar, might not actually be working with a system that does manage at the data object level, data objects can really comprise a variety of different things. It can be an individual electronic document, for example, like a performance review. It can be an email. It can also be at a kind of field entry level, so simply data or information that's entered into a field within a system, and it is defined in that system. And I think a lot of the benefits that come with this is that now there are increased capabilities for being able to manage information at that level and be very precise about, and having the ability to apply retention in various ways, event trigger management as well.

And so it does help kind of mitigate risk, because you're able to identify, tag, add metadata for identification and management to these different data objects within systems, apply retention, have audit trails, and all these different capabilities. So I think maybe the most common term that maybe people have heard for managing this type of stuff, it's an HRIS system. So human resources information management system, essentially. And common, like Workday is one that might come to mind immediately. And these systems also have kind of capabilities to integrate with wider document management systems, enterprise content management systems, capabilities within our software that we have, Versatile Retention and ERMS, our electronic records management system, to help automate the classification and retention, and kind of help your retention schedule flow through to these systems and apply that retention at the most granular kind of data object level.

So where I think we're dealing with this complexity is, well, we have these big buckets, and we do have multiple data objects that might relate to a bucket, for example, different jurisdictional requirements. How do we manage this? Which retention period do we go with? And so introducing another complexity for us to address and solve. I think it's worth mentioning, too, some of the benefits to this.

There's really also kind of enhanced automation capabilities that come along with these systems, and enhanced compliance, of course, for like GDPR, CCPA, the different privacy, being able to track, audit on that very granular level. So definitely this is the new kind of age, what we're dealing with, the technology to handle this type of information. And it's not just within the realm of HR and these types of personnel records. There are systems across the board that are designed to manage at the data object level in other areas, industry-specific areas, whether it's customer information for financial services, whether it's patient information for health care providers. And so I think this is just the emerging reality that we are dealing with, and how do we kind of bridge that gap between the big bucket and retention schedule. And I love it when we get a question that comes in that is just so on topic and just pertinent, and it just fits right in.

In fact, our questions were so great, we basically pasted them to slides and just kind of put some of these pre-submitted questions in here. You'll see this viewer asked: [audience question] "What is the recommended industry approach for managing the retention of employee source data, particularly when the data set itself serves as a foundational record due to its extensive interdependencies with other HR records that rely on it for downstream data integrity? Is it appropriate to retain employee source data until all dependent records have reached the end of their retention periods? If so, what are the best practices for documenting this approach to ensure, excuse me, compliance with regulatory requirements?" So this really kind of hits on all these different points that we're talking about, where we have a certain, and here they're kind of calling it a source data, but also could be a data object, and particularly, I think, maybe thinking it on the data field entry level. This is most common, for example: within a system, you could have an entry that captures an employee's address.

It could capture their benefits enrollment details within that field. It could capture their Social Security number. And each of those different sources could be needed for a number of different types of HR records. So lots of dependencies that could flow into the benefits, could flow into payroll processing, it could flow into the personnel file. So you kind of get the idea of how we start to build this spiderweb that, really in the center of it all, is this data source object, and various different records that have dependencies, potentially within different relational databases downstream, that rely on and require this source data or these data objects in order to kind of fulfill their business needs.

So with that, why don't we talk a little bit more about our next slide, which has a visual on this, and what this— [Rick Surber: Can I add something to that last one, Jen?] Yeah, of course.

Rick Surber: Yeah, I would say the answer to that is yes. Most clients are keeping source data for as long as the dependent records, to ensure that downstream data integrity, to prevent orphan records, allow for verifiable audit trails. So this is typically going to be documented potentially in the records retention schedule itself at a high level, by aligning the repositories and systems to categories of records produced. But it also probably should be documented within a data disposition policy that calls out the specific categories to which the data aligns. So it's hitting on these key things that we need to be able to audit and verify our records.

And this data is what these records are comprised of, and it is part of that audit and verification process. So that's one of the justifications to tie to records and the retention schedule and the legal requirements that align with those things. But also this orphaned records thing: too many times you hear horror stories about data disposition teams going in and trying to clear out personal information, and they're trying to do the right thing and get rid of things that they think aren't necessary anymore, but it ends up resulting in orphaned records downstream that now don't have identifiable information that they could potentially need. So, yeah.

[Slide: Bridging the Gap – From Data Complexity to RRS Clarity. Managing object-level data effectively: classification rules (align granular data with broader retention categories); metadata; leverage automation tools to assist (identify personal data, suggest retention categories, flag misclassified records). Diagram "Mapping Object-Level Data to the RRS": object-level data maps to Recruitment Records, Background Checks, Personnel Files, Labor Relations & Leaves of Absence, and Pension and Benefits.]

Jennifer Chadband: Yeah, I think it's absolutely, that's on point, Rick. The general rule of thumb is we do have to kind of consider the longest requirement when setting the retention periods. A lot of things to think about there. How do you do it practically? Generally, this process looks like what you might think. We kind of have to do a mapping, basically, to the records retention schedule.

So thinking about those granular objects, aligning it to the records retention schedule, and so that you can then consider what the retention periods might be, whether that's a global retention period or a country-specific exception. There might be a data object that relates to an application submitted, for example, and maybe it's a hire or a non-hire. For a non-hire, if this person is not ultimately, following a decision, hired within the organization, then that would align to the recruitment record series at a global retention period that might be low, but it might be higher for the U.S. For example, California's got four years, Colorado, five years. So you start kind of seeing how there are a number of different complexities as far as how to manage the retention period, how does it flow.

But essentially, getting it organized under your retention schedule lets you look at where all the retention periods are and what are they. And it kind of helps you start creating a trail for how you make the decisions, ultimately, for the final determination as to what a retention period should be for that data object. Maybe it is a retention period of, for hired employees, of personnel record series, you might need a data object only for duration of employment plus seven. But maybe because of ongoing potential obligations for benefits, you might need that data object for, say, long-term, potentially down the line for beneficiaries. The employee themselves as a beneficiary could be 20, 30, 40 years down the line that it might be helpful to keep.

So quite a large potential disparity in how long a singular data object might be needed for different business purposes. And so there are ways to kind of manage it, whether it's more aligning that manually: you can track that within your records retention schedule fields. If you have an electronic solution to manage your schedule, there's fields that that mapping can kind of be traced. You can use that then also to kind of create classification rules built off the retention schedules for the individual data objects, depending on what the content is for those, the sensitivity, what the regulatory requirements, how they align to the retention schedule, what the retention period should be. If you're lucky, you might have AI and machine learning capabilities that can kind of help you do some of this automatically, depending on what systems you're using.

And thankfully, then we have the automation capabilities. The retention period may flow into the HRIS or similar type of system to apply that retention period. It might inherently have those retention capabilities. They most often do as well, where you can also just set that retention period within the system itself as an option as well. But that's really great, because we now kind of have this accountability. Everything is mapped, we know what the retention periods are, and it also reduces that manual effort if you have the system solution as well to help manage it.

So a lot of things that can help track this. And then if there is an audit trail, there should be, at least within the systems, it can help you track when things are deleted and the why and all of those different things as well. And always recommend documenting the justification for why a certain data object or retention period is set for a broader set of records, just for compliance purposes. And so having that trail from the data object level or very granular level up can help you justify those bigger bucket retention periods and why they are set the way they are set. So, a little bit of, I think, just wanted to make sure we talked about this, because this is again how things are evolving.

And it is kind of a new thing, newer thing, I guess, that we have to reconcile with our records retention schedule and address. And I think it also kind of flows into a bigger conversation, too, about how to design retention schedules to address this new reality, which is that retention periods are being set at a more granular level. We're seeing laws and regulations that regulate personal data on a more granular level, and we are accountable to justify retention periods for records in certain subclasses of personal data on a more granular level as well. So all this kind of comes together to help us manage the information more efficiently, effectively, and also be able to kind of reproduce and track all of that information that would be necessary for compliance purposes as well. And so with that, kind of transition over here to Brandon. We're going to get into the weeds a little bit more on these categories of records and how they are being addressed in the retention schedule with some of these new factors in mind.

[Slide: Bridging the Gap – Recruitment Records. Addressing obstacles: how do we handle non-hired vs. hired; how does this differ for global operations? Recruitment records, non-hired: global retention period range 6 months – 2 years; retention considerations: recordkeeping requirements (express retention requirements limited: United States, California → Colorado; Canada, Ontario; maximum compelled requirements more common in EU); discrimination claims. Recruitment records, hired: global retention period range DOE + 5-7 years (personnel file).]

Brandon Tuley: Thank you, Jen. So, yeah, we'll zoom in on our first specific HR records category, that being recruitment records. More specifically, we want to discuss how these retention strategies and schedule structure will differ for hired versus non-hired candidates, as well as the impact that global operations will have on how you work through these retention periods for these groupings. So first, with the retention schedule structure, we'll commonly see a separate bucket, two separate buckets, I should say: one bucket for non-hired individuals and a bucket for hired individual recruitment records that will become part of the personnel file. We will get to that in a later slide. But with this method, this structure of two separate buckets allows for those retention periods to be tailored to the purpose for which that information is collected, and also to work through some of these express retention requirements that we're starting to see more and more pop up around the world.

We will commonly see that the non-hire recruitment records will have a much shorter retention period. They often lose that retention value once the individual's no longer a candidate in the running for that position. So, out of those two, focusing on those individuals that aren't so lucky to be offered employment with the organization, or maybe very fortunate, depending on where you're at: for those non-hire records, we'll typically see a global retention period ranging between six months and two years. Common retention triggers for that being creation or employment decision allows that to be a little more privacy-tailored approach, aligning with that purpose of the information, again, for which it's collected. With that, two common considerations that are driving that six-month to two-year common global retention period: the first being recordkeeping requirements, second being discrimination claims. For recordkeeping requirements, as Jen had touched on, those in the U.S. are longer than what we typically see for countries outside the U.S.

Specifically, California previously was the driver for U.S. operations, a four-year retention requirement. But recently, Colorado passed a five-year, just driving that longer retention even further there, an extra additional year compared to California. Something that I always find interesting is when these laws start to pop up, you'll see neighboring jurisdictions start to pass the same sort of laws. It's very much a follow-the-leader sort of thing, I like to think. Ontario passed a recent requirement, three-year retention for those non-hire records as well, a first express retention requirement from Canada for this grouping of non-hire records.

So I believe that we'll continue to just see that increase; those express retention requirements for non-hire records are just going to continue to grow as these other jurisdictions just follow suit. Now outside of the— Go ahead.

Jennifer Chadband: I was going to say, Brandon, I think just to kind of touch on that point, talking about the recordkeeping requirements, they certainly are huge drivers for the retention schedule, especially for privacy. It is interesting, though, outside of the U.S., there are just a few jurisdictions that actually have defined recordkeeping requirements saying specifically you have to keep recruitment records for this period of time. And so that kind of leaves us with not a whole lot to work off of, either. Like you noted here, is there a legal obligation, like a potential discrimination claim? Maybe there's a statute of limitations there that would support like a one-year retention; legal might weigh in on that.

And then outside of that, it just forces us to kind of defer to, well, privacy laws generally say retain no longer than needed. That could conclude once an employment decision has been made: well, now we've decided not to hire this person, or hire this person, maybe a longer retention period. But anyways, I do just think it's interesting that there's just such a wide range of retention periods and non-retention periods that you kind of have to also reconcile when you're trying to figure out the right approach for your retention schedule.

Rick Surber: And to add to that, I think that a lot of this really depends on what's going into those records. We talked about discrimination being a reason to maybe extend this a little bit. But if you can support those processes using summary information that doesn't include the personal information, great. I do still have clients, though, that, especially in California, are going pretty long term for even these recruitment records, just knowing that these suits are common, they have to defend against them often, and having more information helps them to do that. And so it is kind of a company-by-company risk analysis, where if you're facing suits for discrimination and these types of records, including potentially even the personal information, are responsive to those types of suits, maybe it justifies a longer retention.

Brandon Tuley: Yep, absolutely. And with that, global operations, how that can differ for each organization. And as Jen touched on, we'll see such different express retention requirements. Outside of the U.S., maximum compelled retention requirements, or I should say maximum compelled deletion requirements, are far more common. And by that, I mean laws and regulations that will specify that specific types of information must be deleted after a set period of time, for example, four weeks, six months. It doesn't line up with those general limitation principles of no longer than necessary.

It is a set rule that specifies how long that is. France, for example, two years, then delete; Germany, six months, then delete; and then Netherlands, four weeks after finishing the application procedure of all applicants. And so even just within the EU there, you can see those differences between jurisdictions and those compelled privacy requirements that we see. And then for hired recruitment records, for those individuals that do become part of the organization, we'll often see that become part of the personnel file, and we will touch on that further in the upcoming slides.

Then closely tied to recruitment records are background checks. So we'll look at how organizations manage these records and those similar sort of nuances between hired and non-hired individuals. Specifically, how do we handle that hired versus non-hired situation in the structure of our retention schedule, and what records do we keep? Like recruitment records, it's common to see two buckets, one for non-hired and one bucket for hired. So then, focusing on the non-hire records, typically a global retention period between employment decision to one year is what we'll see for that grouping.

This will be driven by those privacy considerations, but also potential discrimination claims. Now, the part that makes this a little more privacy-focused is the lack of express retention requirements for this grouping. They're very limited. And so with that, oftentimes it is then that privacy principle that's driving that much shorter retention of these records, keeping that information no longer than is necessary for the purpose it was collected. In the instance of background checks for non-hired individuals, that purpose is often to make an employment decision, to make a hiring determination. Once that decision's been made and that individual is no longer in consideration for a position, those records will then lose that retention value, and often that justification for that much shorter retention period that we will see for this grouping. On the flip side, for—

Jennifer Chadband: Adding to that, Brandon, these can contain some pretty sensitive and embarrassing stuff, especially if they're completely unrestricted. And so this is a theme that I'm going to bring, I think, to a lot of these. There are some, again, data minimization approaches here. If your industry permits it, for example, maybe you only pull five to 10 years of information, or even, best case, don't even collect details. There are background check providers that can run a pass/fail approach, that you provide the conditions of the pass/fail, they give you the pass/fail, and maybe they only give you the personal information if there's a potential fail for you to consider.

Now, that's not always going to be helpful or possible with highly regulated industries like nuclear energy, for example, but for most, I think that there's a compromise to be found in minimizing the information that is initially collected.

Brandon Tuley: Yep, certainly. And those minimization principles can certainly assist in alleviating some of that risk, making sure that you're mindful of those privacy considerations, and really is addressed then at that process level outside of the retention schedule, but still actively building on those privacy practices that we want to make sure we're mindful of. Yeah.

[Slide: Bridging the Gap – Personnel Files. Addressing obstacles: what records make up the personnel file; all wrapped up in one file? Defining the personnel file: different for each jurisdiction; importance from a privacy perspective; separate files for sensitive information (medical, performance reviews, grievances). Global retention period range: DOE + 5-7 years; retention considerations: recordkeeping requirements, statutes of limitations, legal liabilities.]

So once an employee is onboarded, we will see a lot of these records that we've been discussing become part of the personnel file. But what exactly goes into that file, and how should that file be managed? What records are contained within, and do we manage all of these bundled together? So for making that determination of what makes up the personnel file, it's critical to define what the personnel file is within your organization. That makeup of the personnel file is going to be different for each jurisdiction and defined by local policy.

It's going to be various factors for how you define that personnel file: express retention requirements, operational needs, risk considerations. And there are instances where some jurisdictions won't have express retention requirements for a personnel file. And so with that, it's critical to set that up from a privacy perspective, but even just a compliance perspective, so that you're not under-retaining or over-retaining certain types of information. You want those parameters in place so that you can be mindful of those retention periods, and those records can go to their correct bucket, or you can make adjustments to your retention schedule as you need. But in addition, another consideration with that, not just from a retention period standpoint, but understanding the information that goes within that personnel file so that you can be aware of the protections that need to be put in place for some of that more sensitive information.

This isn't— the personnel file, it's not a file plan. It's important to communicate that with stakeholders, make sure that they're aware of that. Ultimately, it's going to reduce a lot of those questions that you get, spinning your tires there. So I think that's something—

Speaker: It's not just stakeholders that have that misconception, Brandon. Even records managers sometimes mistake the difference between what a records retention schedule is and what a file plan is. So that's a good point.

Brandon Tuley: Yep. And just because it's part of the personnel file from a retention schedule standpoint, yes, that retention period of all that information is the same, but it doesn't mean they're all bundled together. There are certain types of files, employee grievances, employee investigations, medical records, that we would expect to be maintained separate from the personnel file, given that sensitive information that's bundled within, but still maintained separately. So, yeah, that distinction between setting those retention periods and managing that personnel file and the contents within is something very critical for privacy and your organization. So if you stuck with us through defining that personnel file, I'll dive into the retention period. Commonly, the global retention period for the personnel file being duration of employment plus five to seven years.

Previously, early on as I'd start at Zasio, I'd see DOE plus 10, but that has certainly shifted as these privacy requirements are just gaining more and more traction, and individuals are becoming more aware and, I'd say, just actively engaging in those better practices. The global retention period often will be based on recordkeeping requirements, express retention requirements if they do exist, statutes of limitations, also considering legal liabilities. It is common that stakeholders, local legal counsel, I should say, they'll often request a much longer retention period, even if those express retention requirements do exist that say how long the personnel file should be maintained. And so we'll even see that differ between subject matter experts within the same jurisdiction. And so that is something, I think, to account for when you're going through that review process. It can take some time, but getting everybody on board and understanding and determining that proper retention period, it's going to be a much smoother process and get that buy-in from everyone across the organization.

So, jumping in, we've gone through our first question. We'll jump into our next two here, really highlighting the complexity of personnel files. So this question: [audience question] "We're considering digitizing our HR records, which include a wide variety of documents such as background checks, address changes, annual performance reviews, and more. Each document type has its own retention requirements, which adds complexity to the process. What would be an effective strategy for applying the correct retention period to each document type within a personnel file?

Alternatively, would it be more practical to assign the longest applicable retention period to the entire file?" So, want to start with that last chunk here. We would not recommend that, I would not recommend that that longest applicable retention period is applied to the entire file. Defining that personnel file, as we just touched on, is something that, that process going through and determining for that jurisdiction what are the records that are contained within. But structuring, taking a step back and structuring the human resource records that you're managing, being aware of express retention requirements, operational needs, but also combining those life cycles of records, so that you can match those buckets, those records that make up the buckets, and line those up with all of those needs and those considerations.

Jennifer Chadband: So, just a quick question, Brandon, to clarify, then: if we have a personnel file, by local determination these five records will comprise our personnel file. And individually, if we were to kind of think about the retention periods, maybe the retention schedule says, well, recruitment records, this record only needs to be kept for one year, but this one needs to be kept for seven. Would that personnel file then follow the seven, since it requires all five of those record types to be maintained in the file?

Brandon Tuley: If that is then part of that personnel file, as determined in that process through express retention requirements, that legal counsel opinion, things of that nature, yeah, if that is part of the personnel file, then it would be grouped together.

Rick Surber: But we can't let the tail wag the dog here, right? We can't stick benefits and pensions in with personnel so that we get to permanent for everything. There's got to be some kind of logic to this grouping so that some records aren't over-retained unnecessarily. And yeah, so—

Jennifer Chadband: And based on data minimization, right, sometimes when you see the retention periods, it forces you to step back and think, do we really need to retain all of these records for this longest period of time, or would it make sense to granularize, or kind of break something out and have it for a retention period, because maybe it's highly sensitive, maybe we really don't need to keep it for this amount of time. So, yeah, that is a good point, Rick. Good question.

Speaker: Yeah, that's a great question.

Brandon Tuley: Absolutely. Next question that we had pertaining to personnel files. So: [audience question] "Given that employee documentation is often segmented into distinct record types, such as personnel files, learning and development records, benefits documentation, and performance management files, each governed by different legal and regulatory retention requirements, what is the recommended industry approach for managing these interdependencies while avoiding unnecessary over-retention? Specifically, is it advisable to apply the longest retention period, typically driven by benefits records like pension or life insurance, to all employee-related records for simplicity and risk mitigation? If so, how is this reconciled with increasingly stringent privacy regulations that emphasize data minimization and purpose limitation?

If not, what criteria or framework should guide decisions about what to retain versus what to securely dispose of?" So, as Rick had mentioned with the dog and the tail, or the tail and the dog, you want to make sure that those records are, you're parsing those out in your retention schedule, so that you're not taking that longest and that's driving that over-retention of all of that information. Now, it was mentioned, too, that risk mitigation is part of that over-retention. And I will say, on the flip side of the coin, it's also going to increase the risk from a privacy perspective, that over-retention of information, when you are keeping that for likely much longer than you need. And so, yes, depending on what's going on, any potential claims, it could be risk mitigation if you took that longest retention, but on the flip side, from a privacy perspective, that's likely going to be increasing risk there. And so matching those certain record types, those documents you have listed, based on those legal and regulatory retention requirements, life cycle of those records, finding those common buckets, that similar ground, so that you can have that structured retention schedule to your organization. I think a lot of these cookie-cutter schedules, they're not going to account for all those things. They're certainly not. And so it is important to really dive into that process and make sure that we have a document that reflects us, that is reflective of our operations, so that you can be mindful of all these things. One-size-fits-all isn't going to work for nearly all organizations. And so having that tailored to you and your needs, I think, is critical for these compliance purposes and mitigating some of those risks.

So as mentioned with the longer retention periods and pension and benefits documentation, we're going to jump into how to manage some of these benefits and pension records while staying conscious of privacy considerations. So where we have retention meets retirement, getting into some of these records, commonly organizations are grappling with this question of, do we need a skeleton record series?

[Slide: Bridging the Gap – Pension and Benefits. Addressing obstacles: do we need a skeleton record series? Enrollment, elections, contributions, etc.: global retention period range final payment + 5-11 years. Retention considerations: recordkeeping requirements (United States → ERISA: Estate of Barton v. ADT Security Services Pension Plan; Latin America → archival requirements: court opinions and case law); skeleton record series (limit information, record series connections, calculable retention period).]

But before we get to that, I want to talk about the typical structure of these sorts of records. So for those individual-specific records, we'll commonly see a global retention period of final payment plus five to 11 years. These retention considerations will often be based on recordkeeping requirements, but also risk considerations, specifically in the United States and ERISA. We had Estate of Barton v. ADT.

This has been something that keeps me up at night, certainly a lot of back and forth that we'll see with stakeholders, records managers. But what we had here, from the U.S. Ninth Circuit: Barton claimed that he worked for ADT from '67, 1967, to 1986. Fast forward all the way to 2010, and Barton claimed that he was entitled to all of these pension benefits from ADT. The plan administrator denied Barton's claim, saying that there was no records or evidence of his participation with the company. The ruling from the Ninth Circuit provided that when that claimant lacks access to key information that's controlled by a plan administrator, that burden of proof to produce the documents is shifted to the administrator. They're not going to make those beneficiaries, the individuals that are claimants, produce those records. That's on the administrator that's handling all of that for all these plan records.

So that ruling has, to say the least, triggered a conservative approach in many organizations for that much longer retention.

Jennifer Chadband: And that doesn't provide a retention period, though, does it, Brandon? Right? I mean, the language of the decision is something like the burden is to produce the records in relation to benefits paid or payable, right? It's the payable part that I think puts everybody on this really conservative stance, that we could be on the hook to have to produce these at any point in time, which could be a very long-term retention period, if I remember correctly, right?

Brandon Tuley: Certainly. Yep, absolutely. And with that, final payment is something that we've seen in that shift to try to account for that benefits payable that you mentioned, Jen. But there will still be that pushback from stakeholders often. So, yeah, trying to account for that, but that benefits payable language certainly causing a lot of issues for some, but also maybe getting some people some retirement benefits that they've earned. So—

Jennifer Chadband: Yeah, yeah. And I think with a lot of our clients that we've had over the years, certainly the ones that have like traditional kind of pension plans as part of their organization, we would see global retention periods of permanent. But this is kind of a U.S. thing, although there are some exceptions, right? There's some countries that similarly have long-term retention periods.

Brandon Tuley: Yeah. And, well, specifically for express retention requirements, Brazil comes to mind: 30 years for social security indemnity information after that record's been created. But even within Latin America as a whole, we commonly get a lot of requests for these very long retention periods as well. We'll have stakeholders cite to archival requirements, where the applicability of that archival requirement is a process of going through court opinions and case law. And so another portion, working with legal there and going through that process, because the requests that we get, it's just becoming more and more common from Latin America.

Rick Surber: Sure, sure. And I think we see some of these archives laws also, right, with Russia, their shelf life law, long-term; China, the Archives Order No. 10; and some of these Eastern European countries, too, that tend to have some of these longer term. It does kind of add up. There are quite a few, actually, that set defined long retention periods for pension benefits, but it's probably divided, from a large global retention schedule, probably half and half, and others don't; it's just a general retention period. So that makes it difficult to kind of reconcile that.

But the long-term need to defend against pension is still uniformly there, right? And so the potential for this skeleton category is, it's widely kind of appealing. I think we're running slim on time, but Jen, will you just quickly describe the skeleton category so that we can provide that context?

Jennifer Chadband: Yeah, yeah, sure. I guess to get to the meat of the matter. That was kind of funny. But anyways, this skeleton record series is supposed to be very bare bones, so it's really only essential information, and this is in alignment with the data minimization principle. But going to some of those data objects, thinking about it this way: what is really essential that we would have to potentially keep permanently, or preferably another defined long-term retention period? Let's stay away from permanent if we can. But what is the bare bones essential information that would need to be kept in order to ensure we can guarantee payment of benefits down the line for any employee or their beneficiary? So that's kind of the idea behind that, and creating a category that would only cater to those, so we don't result in a lot of over-retention for other categories throughout the retention schedule.

Speaker: Yeah. And some go permanent with that, but some go shorter intentionally to try to avoid the permanent retention period, especially in Europe. So 40 years at the low end, probably 85 to 90 for those that are trying to account for all of those kind of conceivable contingencies. But there's a range there based on risk as well, right?

Brandon Tuley: Yeah, yeah, absolutely. So, just touch on two specific areas: leaves of absence and collective bargaining. So for leaves of absence, there is associated with these records that sensitive health information: physician certificates, the medical records that come with it, requests, things of that nature. So we will typically see this grouping separate from the payroll record series, so that that retention period can be tailored and really minimized to account for that sensitive health information. Specifically, we'll see a range from creation plus two to seven years, with some exceptions as needed, as for all these global retention periods. Commonly, Australia, duration of employment plus seven; Ireland, creation plus 12 years. Just really slamming this global retention period down to be mindful of all these things that we've discussed. As it relates to collective bargaining, global retention period typically ranging from expiration plus seven to 15 years.

The retention requirements for this grouping are scarce. Because of this, we'll typically see that that global retention period is driven by dispute resolution, operational needs, which will differ greatly from jurisdiction to jurisdiction, and that backing as to why you'll see stakeholders, subject matter experts from these various jurisdictions, requesting very different retention periods for their jurisdiction.

[Slide: Bridging the Gap – Data Subject Requests (DSRs). Addressing obstacles: what records do we retain; what about copies of records we provide responding to the request? Retention considerations: global retention period range final resolution + 2-5 years; recordkeeping requirements for data subject requests limited but starting to increase; retain the request itself (copies = transitory; avoid creating more personal data); downstream dependency: logs.]

Another hot button item: data subject requests. So I want to discuss how to retain the right records and avoid retaining additional copies of personal data. So, starting with global retention period range: typically final resolution plus two to five years. This will be in line with express retention requirements; we're starting to just see that trend become more and more common, including in the United States. For the records themselves, what you should retain: we'll see the request itself that was made from the data subject, final resolution summary, and log information for how that was handled, access to certain types of information, things of that nature.

But then for the copies, it's important to treat those as transitory. With it being a copy and transitory, you avoid creating more and retaining more personal data, that can then be deleted with that separate policy, and allows for that to be disposed of in a much, much more streamlined fashion.

Speaker: And this is, I know we're kind of running short on time, but just to touch on this really quickly, the downstream dependencies. This is also, I think, where those systems come in handy. You can basically trace a data object or a piece of personal data throughout the organization, within those systems and through those systems, to ensure that if something has to be deleted, you can find every single instance across the organization and delete it, assuming people aren't making copies and saving them where they shouldn't be saved. But, yeah, going back to that compliance piece, why that really kind of fits in and is an important component for tracking all that information.

Brandon Tuley: And last question that we had, I'm going to punt this.

[Slide: Viewer Submitted Question (not read aloud): "A question came up recently about how we manage Certificates of Destruction (COD), especially when using automated purge processes. I'm curious how other organizations handle this, particularly when using a broad retention schedule, like a 'big bucket' approach for HR records. If our HR team sets up automated purges based on that schedule, how do we ensure there's a record of the destruction? And how do we make sure we've checked for any active litigation holds before the purge happens? Any best practices or insights on managing CODs in this kind of setup would be really helpful."]

Speaker: Hey, Brandon, let's not read through this one. Why don't I just quickly answer this one and let's move to the next slide. So best practice for these logs, or for certificates of destruction, is for these types of systems to auto-generate logs showing what was deleted, when, by whom, what process, and under what retention rule. The processes should be integrated with local hold, with legal hold processes, to ensure that disposition for records under hold is suspended. The purge logs should be stored similarly to certificates of destruction. They should be audited periodically to ensure the process is working properly.

Also, the purge rules themselves should be reviewed and certified to ensure conformance with the records retention schedule. Likely that's going to be by lawyers and records managers. So you guys can read the question on your own. That's the answer.

Speaker: Yeah, that's a great question. Again, it's just funny how everything kind of fits in.

Brandon Tuley: Yep. Yeah, all related, keeps us up at night. So with that, all these great things must come to an end. There's one takeaway that I hope everyone that joined us today is able to walk away with: review, align, train, and monitor. And why, I think, that's because privacy isn't a project.

You need to think of it as a practice. You don't want these things to be focused on for one month, for one year, part of a phase. It's something to make sort of like a lifestyle. With that, big buckets are still the best practice, very much alive, but make sure to add that granularity in the retention schedule where it makes sense. You also want to be mindful of express retention requirements and those life cycles of records, so that you have those proper retention triggers in place.

Next, train teams on understanding that balance between retention and deletion. It is that balancing act that we work through every day. It can be really a great helper when you start to engage with some of these stakeholders in determining that proper retention period. And lastly, stay up to date with those global legal developments. We've seen that it's sort of been a follow-the-leader for some of these, and once one jurisdiction starts, we'll just start to see many more put something similar in place.

And so, yeah, being aware of those and staying up front, on top of those, certainly can avoid some headaches down the road.

Jennifer Chadband: Yeah, I like how you put that, Brandon. It's not a project, it's a process. Privacy by design, right? It's always a— [Brandon Tuley: Always something to be on top of.]

Brandon Tuley: Yep. Absolutely. So, yeah, thank you very much, everyone. I appreciate you taking the time to meet with us today.

[Slide: Presenting in Phoenix! ARMA InfoCon: Warren Bean, VP Technology & Product Dev; Rick Surber, Senior Consultant; Frank Fazzio, Senior Analyst.]

We do have some information here on upcoming ARMA, but, yeah, I will pass this back over. And, yeah, again, thank you very much.

Speaker: [inaudible], tell us about ARMA. Yeah, we're really excited. We're hoping to see a lot of folks down in Phoenix, Phoenix, Arizona, in October. Yeah, we're really excited to have Warren and Rick will be presenting, as well as Frank Fazzio. So we just wanted to get that out there, that we will be exhibiting and presenting.

So if you are planning to be at ARMA InfoCon, please stop by and attend the sessions. We'll be excited to see everybody down there. Monday, Tuesday, and [inaudible].

Rick Surber: A lot of that conversation we had about the HRIS and the downstream data, all of that, Warren and I are going to be kind of focusing solely on that topic and giving kind of a workflow for dealing with data, how to manage it, how to align it, all of that. So that's going to be fun. And then Frank's presentation is on different requirements for secure retention of different records. And so another cool kind of topic that touches on a lot of the handling and format and all of the different mandatory requirements that we see day-to-day on the legal research side. So it should be fun.

Speaker: Very exciting to have three Zasio presenters this year. We're all super excited and proud of all these guys. They should be really great presentations. We also have a Virtual Coffee coming up. Our next one is rounding out the year. I can't believe we're kind of getting there already, but it'll be early, early November.

So, yeah, keep your eyes peeled. In the meantime, reach out to us if there's any questions, follow-up questions. We're happy to circle back with you regarding the presentation, the topic today. We'd love to reconnect and answer any questions. So just let us know.

Speaker: Awesome. Thanks, everyone.