These guidelines are intended to:
- Provide guidance on the responsible management of University digital records that support the institution’s operations and activities.
- Help administrative and faculty staff meet the University’s legal obligations and ensure the protection and accessibility of digital records
- Provide practical advice on management and storage of digital records.
About Digital Records
- Digital documents make up an important part of the University’s institutional memory. As such, these documents must be properly handled to ensure their preservation and retrieval by the individuals who need to use them.
- McGill unit heads and employees have a duty to ensure the security and management of digital records according to institutional policies and procedures (Standard on Enterprise Data Governance, Cloud Directive, Policy on the Responsible Use of McGill Information Technology Resources).
- Digital records must also follow the retention period as stated in McGill Records Retention Schedule (MURRS) and be organized according to the classification plan.
- Management and Storing of digital records must also be completed according to the following provincial framework:
- Act respecting Access to documents held by public bodies and the Protection of personal information - A public body must classify its document in a way that allows then to be located
- Act to establish a legal framework for information technology -To ensure the integrity of a document
- Archives Act - Governs the creation, maintenance and preservation of historical archives (paper and digital)
Organizing your Digital Records
Create a directory structure and name your folders so that you can find your documents easily but also to facilitate disposition:
- At creation of a folder, determine if it needs to be kept indefinitely or destroyed according to the MURRS or classification guide.
- Avoid naming folders after individuals. Instead, use the University’s main activities and the appropriate classification code to create a clear, meaningful title. For example:
- 03-03 Accounting
- 03-03-01 Accounts Payable
- Invoices_Travel-Expenses_2018
- Invoices_Travel_Expenses_2019
- Invoices_Travel-Expenses_2020
- 03-03-01 Accounts Payable
- 03-03 Accounting
Storing Digital Records
In order to choose the right tool for transferring and storing digital documents, it is important to determine the classification level of “Enterprise Data”.
Definition of Enterprise Data:
As per McGill’s Policy on Enterprise Data Governance: “Any data or records created or received by McGill University employees or other constituents in the performance or transaction of University business that are shared by Authorized Users across departments. Enterprise Data include, but are not limited to, machine-readable data, data in electronic communication systems, data in print, and backup and archived data on all media”
The proper management of Enterprise Data facilitates its access to those with academic or administrative responsibilities with the University. Everyone has the responsibility to classify, use, protect and manage that data properly.
MUA refers to this type of data as the University’s corporate records. These terms are used interchangeably by MUA.
Enterprise Data Classification
Determine the level of confidentiality of digital records (Source: McGill Standard on Enterprise Data Classification):
| Classification Level | Description | Examples of Records |
|---|---|---|
| Level 1 - Public | Applies to data that are readily available to the public. | •Press releases •Public access website pages •Published brochure •Published annual report •Academic calendars •Campus maps •University-wide policies •Course descriptions •Employee business contact information |
| Level 2 - Protected | Applies to data that are intended for use within the University. Unauthorized external disclosure or inappropriate use, alteration or destruction of information would reasonably be expected to cause moderate to serious harm, (operational, reputational, financial) to the University, individuals, businesses, other third parties. | •Administrative procedures •Research grant application and agreement records •Research compliance protocols •Documents containing proprietary information |
| Level 3 - Protected | Applies to data that must be kept private under law or regulation. Pertains to information, including personal information that is sensitive both externally and internally. The inappropriate use, release, alteration or destruction of information would reasonably be expected to cause severe harm, (operational, reputational, financial) to the University, individuals, businesses, or other third parties. | •Emergency security response plans •Passwords PINs and system credentials |
Choosing the Right Digital Workspace
Which platform should I use to store draft and final versions of a record?
Keypoints to Remember
- The University’s Records Retention Schedules (MURRS) must be applied to all University records, regardless of where they are maintained. Premature or unauthorized destruction of records can compromise University operations, impede decision-making, and expose the institution to legal, regulatory, or operational risks.
- University corporate records should not be stored in OneDrive or on local hard drives. For security reasons and to ensure business continuity, records should be stored in secure, collaborative platforms such as SharePoint or D2 Documentum.
- University corporate records and information must be managed regardless of where they are stored. Do not allow any system or repository to become a dumping ground for files.
- When using Office 365 tools, access must be actively managed and reviewed on an ongoing basis.
- Updating access permissions when staffing changes occur is critical. Set an annual calendar reminder to review and update permissions..
- Develop a folder structure and hierarchy based on the University’s classification plan to facilitate the identification, access, and centralized management of administrative documents, and to ensure that complete files are maintained.