Is data a record? Traditionally, experts have answered no. Organizations originally designed records retention schedules for documents—official records—not raw data. However, as privacy laws expand and data volumes skyrocket, the traditional boundaries between data, information, and records have blurred.
Zasio’s recent webinar, “When Data Becomes a Record: Master Data Retention Dilemma,” explored this evolving challenge in depth.
During this session, Warren Bean, Zasio Vice President of Technology and Product Development, and Rick Surber, Senior Consultant, tackled these pressing RIM challenges: how to manage, retain, and defensibly dispose of data in a world where data can become a record.
Understanding the Spectrum: From Data to Records
In the webinar, Warren and Rick discussed a key conceptual model:
- Data refers to raw, unprocessed elements—like individual sales transactions or sensor readings.
- Information is processed or summarized data, such as reports or dashboards — data that informs or provides context.
- Records are documented information that organizations retain as evidence of business activities, decisions, or compliance obligations.
These three elements build upon each other, forming a funnel from broad to narrow. Nevertheless, when data drives decisions, triggers business actions, or falls under regulatory scrutiny (especially privacy laws), organizations may need to treat it like a record.
Why Traditional Retention Schedules Fall Short
In the past, organizations applied retention schedules only to records. They often excluded data, information, and ROT (redundant, obsolete, trivial content) like duplicates or working drafts, categorizing them as non-records. As a result, many teams lacked guidance for managing and disposing of non-record content, which led to over-retention and increased legal exposure.
That approach no longer works. Today, privacy regulations like GDPR, CCPA, and CPRA directly affect how organizations handle both information and data. These laws require organizations to:
- Retain personal data only as long as necessary for its original purpose.
- Document the justification for each data retention period.
- Delete data on demand (e.g., in response to “right to be forgotten” requests).
This shift has upended traditional RIM logic, demanding a more comprehensive, risk-aware approach.
The Case for Including Data in Retention Strategies
One of the webinar’s most compelling takeaways emphasized that data deserves a place in retention strategies. Privacy laws and litigation risks make it essential to define how long even raw or intermediate data should remain in systems.
Some organizations have started including non-record categories in their retention schedules. However, many still avoid this step. That hesitation often leads to confusion, inconsistent deletion practices, and missed opportunities for cross-departmental collaboration.
Warren and Rick explained that RIM professionals are uniquely positioned to lead this change. Their expertise in appraisal, classification, and defensible disposition enables them to bridge gaps between legal, IT, privacy, compliance, and business teams.
Enter Process-Driven Retention Management
To address growing complexity, the webinar introduced a process-driven approach to retention management. This method connects data elements and system repositories to business processes and their record outputs—even when a process doesn’t generate a direct record.
To manage data disposition based on process, begin by identifying all systems and repositories where data resides. Assess each system’s capability to support deletion, understanding exactly how this can be executed. Next, map the data to the business processes it supports and align these processes with the appropriate record categories in the retention schedule. Use the retention schedule alignment to assign retention periods based on legal, business, and risk considerations, prioritizing high-risk data, especially where it contains personal information. Finally, collaborate closely with legal, privacy, and technology teams to ensure the approach is both feasible and compliant.
If a process produces multiple record outputs, default to the longest retention period—unless privacy laws require otherwise.
Privacy, Risk, and the Role of Technology
PII-containing data creates unique retention challenges. Privacy laws require organizations to limit retention to the original purpose for which they collected the data. As a result, RIM and privacy teams must work together to determine appropriate durations and deletion triggers.
The webinar emphasized that while technology may limit current capabilities, it shouldn’t justify inaction. Organizations should:
- Evaluate current system capabilities.
- Document any limitations.
- Set goals and timelines for improving disposition features.
- Avoid defaulting to permanent retention.
Modern RIM software can help automate retention, support metadata-based disposition, and generate audit trails and certificates of destruction.
Special Considerations for AI and Analytics
Warren and Rick also discussed artificial intelligence. As organizations build internal AI models using customer, employee, or third-party data, they must account for how that data is indexed, stored, and used. If PII enters AI models, organizations must either anonymize the data or schedule it for deletion—ideally before ingestion.
To support this, organizations should:
- Maintain audit trails showing what data was used and when.
- Refresh vector databases periodically to remove outdated or sensitive content.
- Use risk-based retention schedules to guide analytics projects and support defensible data practices.
A Method for Moving Forward
Warren and Rick outlined a structured method for implementing process-driven retention:
- Inventory systems and data repositories.
- Understand each system’s deletion capabilities.
- Assign priority levels based on risk.
- Map data to business processes and record outputs.
- Align data retention to those priorities.
- Validate and approve through legal, privacy, and business teams.
- Implement retention rules with technology support.
Final Takeaway: It’s Time to Evolve RIM
To summarize, ignoring data in your retention program creates liability. From data lakes to analytics platforms, the sources of risk—and opportunity—are expanding. Privacy regulations are reshaping the landscape, and RIM professionals must broaden their focus to include both structured and unstructured data.
Ultimately, records and information management is no longer just about managing records. It’s about managing everything that contributes to a business decision, transaction, or legal obligation—including raw data.
___
Frequently Asked Questions (FAQ)
Can raw data be considered a record?
Answer: Traditionally, raw data was not treated as a record. However, as privacy laws evolve and data becomes more integral to business decisions and compliance, raw data can indeed become a record. If data triggers actions, supports decisions, or falls under regulatory scrutiny, it may need to be managed like a record.
Why are traditional records retention schedules no longer sufficient?
Answer: Traditional schedules focused only on official records, excluding raw data and non-record content. This approach leads to over-retention and legal risks. Modern privacy laws like GDPR and CCPA require organizations to manage all personal data—including raw data—with defined retention periods and deletion protocols.
What is process-driven retention management?
Answer: Process-driven retention management links data and system repositories to business processes and their record outputs. It involves identifying where data resides, mapping it to business functions, assigning retention periods based on risk and legal requirements, and collaborating across departments to ensure compliance.
How should organizations handle data used in AI and analytics?
Answer: Organizations must manage data used in AI models carefully, especially if it includes personal information. This includes anonymizing data before ingestion, maintaining audit trails, refreshing databases to remove outdated content, and applying risk-based retention schedules to support defensible data practices.
What role do RIM professionals play in modern data retention?
Answer: RIM (Records and Information Management) professionals are key to bridging gaps between legal, IT, privacy, and business teams. Their expertise in classification, appraisal, and defensible disposition positions them to lead the shift toward inclusive, process-driven retention strategies that account for both records and raw data.
Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.