China is recognized for having one of the most intricate and strictly regulated record keeping environments worldwide. Leveraging Zasio’s comprehensive jurisdictional research, organizations are provided with clear and defensible guidance on how archival, privacy, cybersecurity, and data governance requirements interact within the People’s Republic of China (PRC).

Why China Requires Specialized Record Keeping Insight

China’s legal and regulatory landscape is defined by centralized enforcement, extensive administrative controls, and a heightened focus on state supervision and data sovereignty. Record keeping obligations are not isolated; they are deeply integrated with national security concerns, privacy protections, and sector-specific regulatory oversight.

Key jurisdictional characteristics include:

• • Civil law system with robust administrative regulation and centralized enforcement
  • Mandarin Chinese as the main language for legal and governmental matters
  • Strict archival and retention requirements established by national and sector-specific regulators

Zasio’s China Research at a Glance

Zasio’s research on China is tailored for organizations seeking defensibility, precise compliance, and practical application across global operations.

Research scope and depth:

• • • 1,836 China-specific record keeping citations captured
    • Coverage anchored in authoritative, subscription-based legal research sources
    • Direct analysis of national laws such as the Archives Law, Personal Information Protection Law (PIPL), Data Security Law, and Cybersecurity Law
    • Review of State Council regulations, Cyberspace Administration of China (CAC) rules, and sector-specific administrative guidance

This research delves beyond basic summaries, identifying enforceable requirements that affect retention periods, data storage locations, and protection measures.

Core Record Keeping Obligations in China

Zasio’s research provides clear, citation-backed requirements for retention across essential record categories.

Accounting and financial records:

• • • General accounting records are typically retained for 10 years or 30 years
    • Key financial reports and select high-value records require permanent retention under the Administrative Measures on Accounting Records

Personnel and employment records:

Employers must retain personnel records for at least two years after termination in accordance with the PRC Labor Contract Law.

Archival classifications:

Official archival rules often mandate retention for 10 years, 30 years, or permanently, depending on the record type and its archival significance.

Industries Most Impacted

China’s record keeping and information governance rules are widely applicable, but they are particularly stringent in highly regulated sectors.

Industries most affected include:

• • • Life sciences and pharmaceuticals
    • Technology and internet platforms
    • Financial services
    • Manufacturing and telecommunications

Multinational organizations in these industries often encounter additional complexity due to data localization and cross-border data transfer requirements.

What Makes China Uniquely Challenging

China distinguishes itself globally by requiring organizations to balance multiple, occasionally conflicting regulatory objectives.

Notable complexities include:

• • • Legal mandates for long-term or permanent archival retention alongside privacy minimization and deletion requirements
    • Overlapping and sometimes competing obligations across archival, privacy, cybersecurity, and sector-specific regimes
    • Rigid data localization demands that significantly impact multinational business models

China’s evolving governance of artificial intelligence, algorithms, and automated decision-making adds further complexity. These new regulations increasingly link record retention and auditability to AI oversight and compliance.

Business Relevance for Global Organizations

China’s regulatory influence extends far beyond its borders. Organizations may be subject to Chinese regulations even when processing data outside the country, provided the data pertains to individuals or activities within China.

Organizations most affected include:

• • • Multinational enterprises
    • Pharmaceutical and life sciences companies
    • Technology, SaaS, and AI-driven platforms
    • Companies with cross-border data flows involving China

How Zasio’s Research Supports Defensible Compliance

Zasio’s jurisdictional research assists organizations in developing information governance strategies that withstand regulatory scrutiny.

Clients use this research to:

• • • Holistically map retention, privacy, data security, and archival obligations
    • Lower regulatory and enforcement risk through clear, citation-backed requirements
    • Synchronize records retention schedules with privacy and cybersecurity controls
    • Enable defensible technology configurations and data lifecycle decisions across global operations

China Record Keeping in One Sentence

China is one of the most complex record keeping jurisdictions globally. Zasio’s research captures over 1,800 enforceable requirements to help organizations confidently navigate overlapping archiving, privacy, data security, and AI governance obligations.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. Any references to legal or regulatory recordkeeping requirements are provided for general guidance purposes and may not reflect all obligations applicable to your organization. Additional or alternative requirements may apply based on your organization’s industry, jurisdiction, risk profile, and specific business activities. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Record Keeping and Information Governance in China: Jurisdiction Overview appeared first on Zasio.

As organizations grapple with exploding data volumes, evolving privacy laws, and increasingly complex systems, one thing is clear. Old methods can’t keep up. Process‑driven retention offers a path forward.

What is Process-Driven Retention?

Process-driven retention is a strategic information governance framework that determines data lifecycles based on business processes and data dependencies rather than static, document-centric records.

Why Traditional Retention No Longer Works

For decades, retention programs were built around one deceptively simple question: Can I destroy this record? It was a world of self‑contained documents, straightforward classifications, and predictable lifecycles.

But that world is gone.

Modern organizations operate in an environment where:

• Data is no longer self‑contained.
• Information is generated continuously across systems.
• Records are often reconstructed, not stored as static objects.
• Retention schedules rarely cover all the data an organization touches.

This disconnect has opened a gap between what retention schedules say and what actual business processes require.

The Data Explosion Changed the Rules

Data today is not merely an output, it’s the raw material that organizations process, refine, and reuse. The line between “data,” “information,” and “record” is now fluid:

• Data: raw, unstructured bits.
• Information: data given meaning.
• Records: documented evidence of activities.

Traditional schedules were built to manage records, not the sprawling ecosystems of structured and unstructured data that now feed them. So, organizations are increasingly forced to ask: What do we keep? What counts as a record?

These questions aren’t academic. They shape compliance, risk, and efficiency.

Then Privacy Changed the Rules Again

As privacy mandates gained strength, they introduced obligations that frequently conflict with retention requirements. Among the new challenges:

• Right to be forgotten obligations
• Mandatory deletion maximums
• Conflicts with statutory retention minimums
• Data dependencies across systems
• Requirements not covered by most retention schedules

In other words: it’s no longer enough to know when you can delete something. You have to know when you must.

Enter Process‑Driven Retention

Process‑driven retention reframes the conversation around context. Rather than evaluating a piece of information as a standalone object, it looks at how that information flows, transforms, and supports business operations.

It asks not just what the data is, but:

• Who generates it
• Who processes it
• Where it is stored
• What activities rely on it
• What privacy, security, and legal obligations affect it
• What upstream and downstream dependencies bind it

This approach breaks down silos and reveals the true lifecycle of data—not just the record‑keeping lifecycle.

What Makes This Approach Different

Process‑driven retention is:

• Purpose‑driven rather than content‑driven
• Holistic and fabric-oriented, not siloed
• Metadata aware, using context as an asset
• Structured around dependencies, not isolated artifacts
• Supportive of both privacy and operational requirements

It connects the dots across teams such as legal, IT, records management, operations, privacy and creating shared visibility into the data landscape.

Real‑World Examples in Action

The webinar walked through scenarios that highlight the value of process‑driven thinking:

1. Energy Consumption Data in Utilities

Hourly energy logs feed billing, outage reports, efficiency analyses, and forecasting. They also intersect with marketing, customer success, and project management processes. Deleting logs isn’t just a retention question, it’s an operational one.

2. Time Clock Logs in HR

Clock‑in/out data drives timesheets, pay slips, benefits eligibility, PTO management, and performance reviews. The decision to delete this data has far‑reaching implications.

Implementing Process‑Driven Retention

Transitioning to this modern model requires organizational commitment. The webinar outlined key steps:

• Form a cross‑functional steering committee
• Conduct risk and dependency analyses
• Revisit policies and retention schedules
• Map systems and data flows
• Aggregate data where possible
• Align onboarding and offboarding processes across systems

It’s a foundational shift, but one with significant payoffs. Greater compliance clarity, reduced risk, and more resilient information governance overall.

Looking Ahead

As data complexity grows, retention programs must evolve to match. Process‑driven retention equips organizations to manage information with nuance, context, and foresight. It’s not simply a new technique. It’s a modern mindset for a modern data world.

If you’d like guidance on adopting a process‑driven approach, our team is here to help.

Disclaimer: The purpose of this post is to provide general education on information governance consulting. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Beyond Records: Why the Future of Retention Is Process Driven appeared first on Zasio.

From AI-driven automation to the growing demand for defensible disposition and digital preservation, the coming year promises big shifts in how businesses manage information.

In this blog, Zasio’s experts share their predictions for 2026.

Jennifer Chadband — Senior Consultant, CRM, IGP, CIPP/E, Licensed Attorney

Records and information software will continue to build momentum towards simpler, more connected ways of working. Evolving technology and tools that automate filing and disposal will make it easier than ever to manage information, freeing teams to focus on higher‑value work. A growing sense of urgency will also accelerate a big shift already underway: viewing records not merely as compliance requirements, but as resources to organize and use to improve decision‑making.

In 2026, this familiar goal will be more vital than ever: build programs that are easy to follow, reduce wasted effort, and maximize the value of the information organizations already possess.

Will Fletcher, General Counsel, CIPP/US/E, IGP

RIM and IG professionals will intensify their focus on capturing and retaining “records of compliance” across the increasingly complex landscape of data privacy and AI regulations.

For data privacy, critical records of compliance include transfer impact assessments, data protection impact assessments, and evidence of DSAR compliance. For AI, they include AI impact assessments, AI architecture documentation, retention and deletion logs for AI inputs and outputs, and the policies and standards that comprise an organization’s responsible AI governance program.

Organizations relying on digital systems and automation must also ensure these systems can produce record outputs on demand, and preserve them for as long as necessary, whether for regulatory investigations or legal defense.

Warren Bean — VP Technology & Product Development, CRM, CISM

• AI agents will require management similar to human users to control identity and access management. This includes which agents can access specific data repositories, what actions they can perform, and how to verify their authenticity.
• Governance frameworks will expand to include human oversight of AI systems and validation of LLMs and inference outcomes.
• Archivists will have to rethink the concept of ‘provenance’—the history of records and information, including their movements and transformations–-in light of AI deepfakes.

Rick Surber, Senior Consultant, CRM, IGP, Licensed Attorney

As AI growth accelerates in 2026, phishing and other information security intrusions will become more convincing and successful. This will cause data breaches to become more common as attackers use AI to automate social engineering and scale their efforts. In response, solid information governance will matter more than ever.

Clear retention rules, continuity planning, strong information security practices, and well-defined response processes will be essential—not to prevent every incident, but to limit impact, speed recovery, and prevent disruptions from escalating into expensive, long-lasting problems.

Stephanie Martin, Vice President of Product Management & Support

Privacy, security, cost, and accuracy concerns will continue to slow adoption of new AI agents, especially for smaller organizations. Large infrastructure costs and regulatory demands without parallel profits will likely accelerate the price of AI services. However, the benefits of AI will be limited if records lack quality, consistent metadata, or proper organization, making data hygiene a prerequisite for success. Accordingly, successful records management will still depend on record quality.

Navigating the Future of Records & Information Management in 2026

Preparing for 2026 requires a strategic alignment of policy, security, and high-quality metadata. Zasio’s enterprise-grade records management software is specifically designed to handle these complexities, offering the automation and defensible disposition tools necessary to stay ahead of the curve.

Contact Zasio today to learn how our experts and technology can help you audit and optimize your RIM program for the future.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post What’s Next for RIM and IG? Zasio Experts Share 2026 Trends & Predictions appeared first on Zasio.

One has become rooted in organizational culture. Well-vetted and highly operationalized, it is enthusiastically supported at all levels. The other barely exists beyond its dust-covered charter. Its policies and procedures are scattered among the ROT (redundant, obsolete, trivial) data in which they lie. Some question whether these policies were even formally approved. And the mere thought of an audit causes program owners to cringe.

Why do some IG initiatives succeed while others fail? Perhaps the reason lies in how well their founders understand stakeholder management.

Why Information Governance Stakeholder Management Matters

IT, legal, risk, compliance, privacy, security, impacted business units, and information asset vendors form the essential lineup of stakeholders in any IG initiative. The IG professional is the coach who must ensure this diverse team performs well together on heavy issues like how to simultaneously respect each other’s often divergent interests while ensuring information assets are put to their highest and best use. There’s also the essential task of managing for risk and compliance.

It’s a weighty undertaking, and stakeholder coordination and collaboration can easily consume the IG professional. But get stakeholder management right, and your IG program stands a much better chance of reaching enduring success.

The IG professional must correctly identify each stakeholder and their interest relevant to their IG program. To do this, whether for the first time or when updating your stakeholder inventory, it can be helpful to think of each stakeholder as belonging to one of four categories:

• Approval: Those whose formal endorsement is required for all or any portion of your initiative.
• Support: Those who control the resources you’ll need.
• Consult: Those whose advice or expertise will shape your approach, whether immediately or in the long term.
• Inform: Those who should be kept in the loop, even if they’re not directly involved.

 Approve, Support, Consult, Inform: ASCI, for short.

Categorizing stakeholders under this approach can lead to a more comprehensive and intentional IG strategy. It helps IG professionals avoid common pitfalls like overlooking key voices and reducing risks related to program resistance or conflicting expectations.

Let’s break down each category:

Those from Whom You Need Approval

These are your decision-makers, such as the executives or governing bodies whose formal backing is essential to move your initiative forward.

Examples:

• The C-suite (especially the CIO, CISO, and legal department)
• Governance committees
• Budget and finance officers

Strategy: When approaching “approval stakeholders,” be sure to present a compelling business case that lines up IG goals with organizational priorities like risk reduction, compliance, and operational efficiency. Use metrics and communicate in a language they’ll understand, such as describing things in terms of ROI, quantifying risk reduction, and specifically identifying cost savings.

Those from Whom You Need Support

“Support stakeholders” are your active bench of players; your operational decision makers. For example, if you’re adjusting a retention period, these are your authorizers. They may not have the authority to approve your initiative, but their active involvement and advocacy are crucial. They help implement and sustain the program.

Examples:

• Department heads from impacted business units
• IT, security, and privacy teams
• Records managers and data stewards
• Outside stakeholders like information asset vendors.

Strategy: Approach them early, listen to their concerns, and show how your IG initiative supports their goals. Empower them as agents of change. Also establish a streamlined process for policy and other IG updates. Their buy-in often determines whether the initiative gains traction or flounders.

Those You Should Consult

These individuals have valuable insights, experience, and technical knowledge that can shape your initiative’s success. While “consulting stakeholders” may not be directly involved in your initiative, their input can provide you with critical perceptions.

Examples:

• Frontline employees
• Legal and risk advisors
• External consultants

Strategy: Create structured feedback opportunities like interviews, workshops, and pilot programs. Make  their input visible. Consultation builds trust.

Those You Need to Keep Informed

These are stakeholders who don’t need to be involved in decision-making or implementation but still should be kept up to date of your IG initiative’s goings on. Keeping them informed helps ease frictions, avoid resistance, issue spot, and manage risk.

Examples:

• Some customers.
• Marketing and public relations.
• Anyone else not already involved as a stakeholder who might influence perception and adoption, or champion your initiative from the sidelines.

Strategy: Use clear, concise communication to explain what’s happening, why it matters, and how it will affect the organization. Transparency builds credibility and helps prevent confusion or misinformation.

Final Thoughts

No one factor determines the success or failure of an IG initiative. But using the ASCI method as part of your stakeholder management can help ensure you haven’t left anyone out and are engaging the right people in the right way. It is a simple step that can be critical to building IG program momentum and long-term sustainability.

Also, as your IG initiative grows, don’t forget the importance of maintaining stakeholder relationships across personnel and organizational disruptions. Organizations change, roles change, priorities shift, and people move on. Throughout this turbulence, the IG professional must ensure information governance stakeholder management engagement continuity. In an uneven landscape, the IG professional who maintains this flow across their stakeholder team helps ensure their IG program will endure.

Disclaimer: The purpose of this post is to provide general education on information governance software. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Winning Allies: How IG Professionals Can Use Stakeholder Management for Program Success appeared first on Zasio.

Why RIM Matters More Than Ever

A robust RIM program is no longer a back-office function. It’s a strategic asset. Here’s why:

• Legal & Regulatory Compliance: Stay ahead of evolving mandates like GDPR, HIPAA, and SOX.
• Risk Mitigation: Avoid non-compliance penalties and minimize expensive litigation discovery, and data breach risks.
• Operational Efficiency: Cut costs, reduce redundancy, and boost productivity.
• Data Protection: Safeguard sensitive and proprietary information.
• Business Continuity: Ensure recoverability in the face of disaster.
• Informed Decision-Making: Enable fast, accurate access to critical records.
• Digital Transformation: Align RIM with enterprise content and governance strategies.

Core Components of a Modern RIM Program

The foundation of a successful RIM initiative includes six key pillars:

1. Governance: Clear documentation, structure, and oversight.
2. RIM Practices: From identification to secure disposal.
3. Work Culture: Training and awareness to drive adoption.
4. Technology: Integrated, automated systems for digital records.
5. Risk & Security: Disaster recovery and data protection.
6. Compliance: Ongoing audit readiness and legal alignment.

Assessment: The First Step Toward Transformation

A comprehensive RIM assessment is essential to identify gaps and set priorities. The webinar outlined a structured approach:

Define Objectives & Scope

• Are you addressing risk, compliance, modernization or all of the above?
• Will the assessment cover the entire organization or specific areas?

Engage Stakeholders

• Involve legal, IT, privacy, and business units.
• Use surveys and interviews to gather insights and build buy-in.

Evaluate Existing Frameworks

• Review retention schedules, policies, and classification structures.
• Assess current practices for defensible deletion and secure storage.

Analyze Technology & Systems

• Examine electronic records management systems (ERMS), and integration.
• Identify automation opportunities and onboarding standards.

Consider Risk & Security

• Pinpoint vulnerabilities in access controls and disaster recovery.
• Ensure sensitive data (PII, PHI, financial) is adequately protected.

Optimize Processes

• Look for inefficiencies, manual workarounds, and low adoption.
• Recommend streamlined workflows and cost-saving measures.

From Findings to Action: Reporting & Road Mapping

Once the assessment is complete, the next step is to translate insights into action:

• Report: Highlight risks, maturity levels, and improvement areas.
• Prioritize: Focus on high-impact, high-risk areas first.
• Roadmap: Develop a phased plan with clear milestones.

Sample Roadmap Timeline

 Final Thoughts: Start with Your ‘Why’

The most successful RIM transformations begin with a clear purpose. Whether your goal is compliance, efficiency, or modernization, aligning your assessment and roadmap with that “why” ensures relevance and impact.

If you missed the webinar or want to revisit the insights, reach out to our team. We’re here to help you build a smarter, safer, and more strategic RIM program.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Revamping Your RIM Program: A Roadmap to Resilience and Efficiency appeared first on Zasio.

Versatile 2025 includes all of Zasio’s industry-changing information governance solutions under a single umbrella suite, including physical records management, electronic records management and retention schedule management.

The new update introduces numerous key features, including Zasio’s new Advanced Records Management Module and a new artificial intelligence assistant, (Built with Llama), which makes it easier than ever to search for records retention regulations.

“We are proud to welcome the next major release of Versatile,” said Kevin Zasio, Founder and CEO of Zasio Enterprises. “Versatile 2025 is a testament to our commitment to technology, innovation and providing top-of-the-line information governance solutions.”

The update also provides users with direct access to our expert in-house Records Information Management (RIM) Consultants and a direct interface to our Customer Portal, where customers can communicate directly with our support team and easily access online training videos.

“It’s difficult to convey the scope of this project,” said Warren Bean, Zasio’s Vice President of Technology and Product Development. “We’re taking 37 years of development, with all its depth and complexity, and adapting it to a modern interface that works for cloud and on-prem deployments, while also ensuring existing users don’t have to re-learn an entirely new system.”

Visit us at ARMA InfoCon in Houston, Texas Oct. 13-16, where we will introduce Versatile 2025.

“I am proud of our team’s dedication and hard work providing this significant update for our customers,” Zasio said.

Building on the success of Versatile 2023, Versatile 2025 is Zasio’s next major update to the company’s industry-leading information and compliance platform.

Questions? Visit Zasio.com or email connect@zasio.com for details.

The post Zasio Announces Major Records Management Software Update: Versatile 2025 appeared first on Zasio.

The FTC raised the flag earlier this year after consumers complained about H&R Block’s seemingly free tax preparation plan and confusing process to downgrade purchased plans. The FTCs’ readiness toward legal action against companies over personal data collection and use shows an effective records and information management program is crucial to safeguarding corporate financial health and sustainability.  

Allegations of Data-Deletion Practices Against H&R Block

In late February 2024, the FTC filed an administrative complaint against the well-known tax filing company alleging two of its policies were unfair and violated antitrust laws. H&R Block advertised a free and simple tax plan to consumers, but according to the FTC, using the plan was anything but. 

According to the complaint, H&R Block provided multiple tax plans, including the free plan. The FTC alleges when consumers went to obtain the free plan, H&R Block coerced them into purchasing a plan with more options. The FTC alleges throughout the online registration process, H&R Block upsold consumers more expensive services and failed to provide a clear breakdown of costs. And while H&R Block allowed consumers to obtain and upgrade services online, downgrading was not as simple. Consumers who easily signed up for a more expensive service online needed to personally contact H&R Block’s customer service department to downgrade, which often resulted in a lengthy exchange with the company. 

The FTC has also alleged when consumers requested a downgrade, H&R Block gave them an unfair choice: pay for a more expensive plan they did not want, or downgrade and lose all their previously entered information. The FTC says these practices cost unwitting consumers time and money.  

The FTC’s Legal Basis Against Wrongful Deletion 

The Fair Information Practice Principles (“FIPPs”) are a collection of principles long used to evaluate information systems and activities that affect individual privacy. For many years, the FIPPs have informed data privacy laws around the globe on how governments and commercial actors alike should approach collecting and processing information about people.  

While the U.S. currently has no comprehensive data privacy law, the FTC has broad enforcement authority to regulate unfair and deceptive commercial practices under Section 5 of the FTC Act. The main purpose of the FTC Act is to protect consumers and foster a competitive and transparent business environment.1 

In the case against H&R Block—and in others—the FTC’s broad enforcement authority has allowed it to enforce the spirit of the Fair Information Practice Principles (“FIPPs”). For example, H&R Blocks’ alleged conduct, if proven, would violate two of the FIPPs: the Purpose specification and use limitation principles. Under these principles, anyone collecting personal information must provide notice of their specific purpose for collection, which should be provided no later than the time of collection. After that, the collected information may only be used for the purpose explained in the notice. Further, personal data collectors must ensure their use is compatible with the specified purpose, or that it is otherwise legally authorized.  

As the H&R Block case demonstrates, collecting consumer data without express notice and for a purpose other than described may lead to legal consequences. Here, H&R Block’s services depended on consumers ability to enter their tax information. But under H&R Block’s alleged practices, there would be little point in receiving consumers’ personal information if not retained in their online database for later use. Therefore, deleting a person’s tax information when they chose to downgrade plans could be considered incompatible with the purpose for which it was collected. 

Consumers who were not informed their information would be deleted upon downgrading were therefore surprised by the forced step backward, rendering the initial collection of the information a waste of time and money at the consumer’s expense. The subsequent use of the information which H&R Block purported to need was then not properly utilized and the purpose of collection not fulfilled. Hence, the alleged coercion becomes a choice between purchasing the more expensive product that the consumer did not want, or downgrade and lose all the information that they have already typed in and would have reasonably expected to be retained.  

FIPP’s As the Law of the Land for Information Governance 

As of this writing, H&R Block has not indicated whether it intends to settle or litigate the FTC’s complaint. Regardless, FTC targeting conduct like that alleged against H&R Block has long been viewed as making U.S. company’s adherence to FIPPs the law of the land. This shows that even without a comprehensive data privacy law and dedicated privacy enforcement agency companies are not free to do whatever they would like with consumer personal information.  

The FTC’s action against H&R Block should be a lesson to the information management and information governance industry: carefully consider your treatment and retention—or non-retention—of consumer information. There may be consequences if you don’t. 

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post FTC Goes After H&R Block for Not Retaining Consumer Data appeared first on Zasio.

Create: Planting Seeds

Each seed has the potential to grow into something valuable. Records managers choose what information may be valuable to the company, much like a gardener carefully chooses which seeds to plant. After the records are chosen, they are “planted” in the company’s filing system and await germination.

Organize: Growth and Maintenance

Once planted, seeds must have the right conditions to sprout and grow into mature plants. Similarly, records must be properly organized and stored for easy access and retrieval. Having a well-designed filing and records management system is like having good soil—it allows your records to sprout and grow to maturity. At this stage, records may be indexed or classified so employees can easily access and retrieve them.

A gardener needs to water, fertilize, and prune their plants to help them thrive. As records grow, they require maintenance, an important part of the records life cycle. Maintenance helps preserve the integrity, accuracy, and relevance of the records management system. Just as a gardener tends to their beds, a records manager must constantly monitor, update, and protect the company’s records and information. A records manager needs to observe the company’s “weather” and adjust as business and technology needs evolve.

Use: Harvest

Harvest season is when you reap the benefits of your labor. The records that you’ve organized and stored are now ready for harvest and use. A well-maintained records management system makes retrieval and use of these records a breeze.

Retention: Storage and Compost

The records life cycle doesn’t end at harvest. Like your vegetables and fruits, records have different storage lengths. Company policies and procedures and laws and regulations all influence the lengths of your retention periods. Proper records storage ensures that they can be accessed when required.

David Stephens, one of the founders of Zasio’s RIM consulting division, compared a record’s life cycle to compost—if retained too long, it begins to rot. At the season’s end, gardeners may compost what’s left of their harvest. Similarly, when a record has reached its full potential and has met all the proper retention requirements, you must identify and pull those that are no longer needed. The disposition process may include deletion, disposal, or archiving depending on company policy or regulatory requirements.

Conclusion

The life cycle of a record resembles the growth of a garden beginning with a tiny seed to the harvest and storage of valuable information. A well-cultivated records management system may yield great rewards for those who tend it with care.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post From Seed to Harvest: Cultivating Your Records Life Cycle appeared first on Zasio.

From the CEO to the front desk assistant, most roles spend large parts of each day interacting in some way with the organization’s records and information. Altering how they collect, process, store, and dispose of this takes more than RIM subject matter expertise—it also takes project and people smarts.

This article discusses project and change management fundamentals that should be amply applied to any RIM initiative—whether you’re launching a new program or updating an existing one.

It All Starts With Planning

You’ve assembled your RIM coalition and have your executive sponsor. Now it’s time to create a consensus on what work will be done, how it will be done, and who will do it.

People often underestimate the amount of preparation an initiative requires—especially a RIM initiative. By some estimates, over 20 percent of all project work should simply consist of planning.

Estimating project work is difficult. Meetings, emails, and collaborative chats will help start developing your project’s scope and constituent parts. But that hard work often leads to unrealized goals if your project is not clearly and abundantly memorialized in your program documents.

These documents go by various names, but what you call them isn’t as important as what they contain. Your project documents should answer the project’s six Ws (Who, What, Where, When, Why, and How). If your RIM team were replaced tomorrow, your project documents should allow your substitutes to immediately understand and seamlessly continue the work.

Here are a few key documents your program needs to carry momentum. Feel free to consolidate documents for simplicity with your individual project.

Your RIM Project Plan. The project plan is your master document, letting the world—or at least your organization—know what your RIM initiative is all about.

This plan will guide all project phases. Because of this, your plan needs to be comprehensive— it establishes the project’s benefits, costs, who will be impacted, and how to measure success. It should explain all aspects of the work, guide any questions, and critically, establish what organizational goals the project will support.

RIM is often considered the mother of all collaborative efforts. This is also true for your project plan. You can have a lead document drafter, but your entire RIM project team should be heavily involved in the creation. You’ll also want to involve your project’s key stakeholders—those who will carry out the work and those who will be impacted. This is essential for managing expectations and sustaining support once work begins.

Focus on making the project plan accessible. Plain language writing, a heavy reliance on graphics, and good document design principles are fundamental. Above all, avoid inconsistencies and unclear requirements. Think of your RIM project plan as the essential tool to convince any skeptical outsider that your initiative’s success is inevitable.

The Project Schedule. Keeping your RIM initiative on track is vital. A detailed, realistic, and well-thought-out project schedule  considers all project work and its dependencies is indispensable. A good schedule also makes changes, which are bound to occur, easier to navigate.

Your Milestone Chart. In addition to your schedule, you’ll need to define project milestones. To help sustain project momentum, build a concrete milestone early on in your work. Having a tangible result you can advertise as progress—a victory!—near the front of your RIM program implementation reminds your team and the organization that your project is worth their continued support.

Clearly Define Roles and Responsibilities. Spend considerable time defining what roles will support your RIM initiative and establishing the contours of their responsibilities. This clarity will help your team develop ownership over their duties and avoid conflict when team members share overlapping and often nebulous responsibilities.

Budget: This can be a constant struggle for RIM initiatives. What RIM stakeholders want must often be reduced based on budget constraints. Being clear-eyed and detailed about your costs, and ensuring they match the ingredients you’ve expressed in your project plan will help make sure your initiative is feasible.

Change Procedures. Change is an inevitable part of any project. Including a robust set of change criteria and procedures in your project documents is necessary. Good change procedures will ensure project alterations are managed efficiently and communicated broadly.

Let’s take your project plan, for example. You’ve made it as comprehensive as possible, and once work begins, you may find some details that aren’t feasible, or priorities may change. This is okay, and should be anticipated. The best approach is to remain flexible. By developing procedures for handling inevitable changes to your project’s scope and parameters, you’ll help your RIM initiative reach its destination.

Change Management: Communicate, Communicate, and I’ll Say it Again—Communicate!

With your project documents in order, it’s time to get to work. Effective communication is the bedrock of project and change management. You must communicate relentlessly with your executive sponsor—keeping them apprised of your project’s progress, hurdles, budgetary needs, and changes. Stay in constant contact with your team. Nothing saps morale like a team member feeling like they aren’t up to speed on what’s happening. And, just as important, you must communicate required program changes to the rest of the organization, including those whose daily interactions with the organization’s records and information will be most altered by your initiative.

For all communications, keep in mind the four Ps:

Purpose: Constantly reinforce the need for change. The old ways of doing business are familiar and comfortable so go back to your “why” frequently. Remember, RIM is about more than reducing risk, it’s about improving how people interact with information.

Picture: Put effort into describing what things will look like as your program is put in place. What you describe should be relatable and understandable, not abstract. Allowing people to envision what the future will look and feel like will reduce some anxiety inherent in any change.

Plan: Reference the steps in your project plan document. Reinforce how your initiative will unfold.

Part: This is crucial. During implementation, communicate what each person’s role is in affecting the change. Remind them often what they must do to sustain the changes.

Finally, as your RIM initiative gets underway, make every effort to communicate to all parts of the organization how the new ways are an improvement over the old. Give them the narrative you want to hear— you might not like the one they come up with on their own.

Proper Project and Change Management Helps Your RIM Initiative Succeed

RIM programs can fail for any number of logistical, budgetary, or structural reasons. But sometimes, they are just rushed and lack planning. Your RIM initiative may be decades overdue, so it’s tempting to push something into place just to say now you have one—and rationalize that you can always expand or fix it later. That would be a mistake. The risk is that even if your half-developed program is implemented, it’s like a tree with shallow roots—it won’t weather the winds and storms of organizational pressure. With proper project planning and good communication, however, you can help ensure your initiative will not only be completed but grow and bear fruit for many years.

Disclaimer: The purpose of this post is to provide general education on information governance solutions. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Successful RIM Initiatives Invest in Project and Change Management appeared first on Zasio.

• Selecting a potential executive sponsor
• Preparing an effective pitch

Now that you’ve identified your desired catch and cast your line, let’s discuss how you can reel them in and keep them invested—especially when a failure to implement your project could expose your organization to costly regulatory penalties.

Getting an executive sponsor committed can be a lot like fishing: after much preparation and a little luck, you’ll feel that first nibble on your line. But you’ve got to be ready to act! Any angler knows you’ll lose your catch if you’re too aggressive or not aggressive enough. Just like when fishing, finding balance is key—you’ll have the most success landing an executive sponsor if you act consistently, clearly, and concisely.

Be Consistent in All Interactions

Consistency at all stages is critical for a successful relationship with your executive sponsor. When you apply inconsistent pressure to your line, it’s likely to break and leave you empty-handed. While meeting project deadlines and providing accurate deliverables is part of consistency, having regular—not insistent—communication is also key. We all have that one friend who talks too much out on the lake and scares the fish away. Don’t be that person.

Consistency allows for flexibility in the details and execution through maintaining a clear objective with open communication. Regular, scheduled meetings, even if brief, provide a platform to keep your sponsor updated without being bothersome. This approach ensures your executive sponsor is always informed and involved, further fostering your partnership. Conversely, inconsistent contact with your sponsor is the quickest way to lose their trust—and future support.

Be Clear with Your Expectations

Your sponsor is staking their institutional reputation on your project and is expending professional capital to marshal support and resources. Accordingly, you must communicate clear goals and waypoints so they will see progress and share in the wins. You also should ensure your objective is aligned with your sponsor’s so you move in the same direction instead of fighting the line. Provide a broad, high-level goal that will allow your sponsor to clearly and succinctly communicate the project to other stakeholders.

To do this, provide your sponsor with an “elevator pitch” they can use to demonstrate the project’s focus on one or more of your organization’s goals, like cost minimization, while highlighting the risks of not proceeding with your RIM/IG project. Here’s an example to get you started:

Revising our records retention schedule will eliminate duplicative retention, which will cut our storage costs by 20 percent, and decrease the risk of over-retention of client personal data!

Including cost savings estimates or examples of recent enforcement actions—and accompanying fines—is especially useful. This may require collaboration with IT or finance departments to determine your program’s current state and estimate your project’s effects.

Having a clear focus does not mean you can’t adapt when needed. You should be willing to compromise and modify aspects of your project to achieve your objective. Don’t be afraid to take your sponsor’s feedback or make course corrections. Letting a bit of line out is good to keep overall progress moving forward. Compromise demonstrates to your sponsor that you want to get the project done right, not that you have to be right. And that gives you more credibility if you need to stand firm on a less-negotiable portion of the project.

Be Concise When Communicating

Your executive sponsor doesn’t have much time to spend hashing out every detail of your RIM/IG project. Providing a potential sponsor with a clear plan allows them the confidence to delegate the details to you without micromanaging the project. Demonstrate respect for their time, and they’ll likely see you as a self-starter who gets things done. If you’re unprepared and unfocused when talking with them, a palpable negative feeling emerges that can be fatal to sponsorship. Nothing ruins a fishing day like forgetting your tackle box, and nothing ruins a sponsorship like not being able to confidently provide a simple status update.

Again, having a ready summary of enforcement actions against similarly situated companies helps strengthen your project’s importance to the organization. Create a one- or two-sentence summary of the facts and outcome to make it easy for your sponsor to understand and communicate them to others. You will have less influence if you simply send them copies of the decisions or—worse yet—a link to the regulator’s website.

Conclusion

There’s no feeling like landing a prize fish after a long battle. Once your first RIM/IG project is successful, if you’ve been consistent, clear, and concise with your sponsor, you’ll have established a professional relationship that will pay dividends deep into the future. This is critical to developing a robust RIM/IG program. They might be willing to sponsor your next project or provide a vote of confidence in your abilities to other stakeholders. You might even develop a mentor who can guide you to your next career step! So, dream big, plan well, and cast your RIM/IG project into the world to see what you catch.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Developing RIM Program Executive Sponsorship Part 2: Landing an Executive Sponsor appeared first on Zasio.