Outlook and Shared Drives Alan Carter Information Governance Office

Unstructured Data Data which is not in formal filing systems or databases Often not searchable No useful metadata Often no coherent filing system- data is buried No way of applying the retention schedule No way of meeting legal obligations Data is lost if the person who knows where it is goes Compliance & Risk

Unstructured data 2 Identified as major risk by GDPR Project Will hamper the move to O365 Biggest repositories are the shared drives and Outlook. Also SharePoint, paper filing systems etc Starting campaign! Put aside 5 minutes a day to sort out today’s work Compliance & Risk

Emails Main communication method Much formal University business is conducted by email Form parts of audit trails Much email ephemeral But also can contain personal, sensitive and confidential data Over half of data incidents involve email Compliance & Risk

Emails Emails are the property of the University Emails are subject to the Data Protection Act Emails are subject to the Freedom of Information Act Emails can be used as evidence in legal and disciplinary proceedings Email is not a storage system Email is not backed up for very long centrally Compliance & Risk

Email best practice (briefly) Avoid unnecessary use of email – use the telephone! Limit emails to just one subject Limit recipients and ccs to those who actually need to know Assume that anything you write could be released Be careful what you say about individuals- opinion is subject to DP disclosure rules

Organise your mailbox Set up folders relating to particular tasks Align your folder structure with your filing system Set up rules to divert particular emails to the right folders Get rid of ephemeral messages as soon as possible Make sure that the responsibility for managing shared mailboxes is assigned Remove records from the email system and store them somewhere else

Identifying records Only a small proportion of emails will qualify as a formal business record Formal business records need to be kept in an appropriate filing system Formal business records need to be managed in line with the appropriate retention, security and access rules

Records: An email constitutes a record if any of the following apply: It provides evidence of a business transaction or activity It needs to be retained for legal purposes It needs to be retained for financial purposes It provides evidence of a decision It authorises an action It approves a policy It provides useful data for a future decision It sets an important precedent It provides details of liabilities or responsibilities It provides information to protect rights or assets It contains information of historical value

Examples of records Policy papers and recommendations Meeting minutes Material received from external sources that is used for University business Supporting material- raw data Correspondence! Attachments Compliance & Risk

Emails which are not records Copies! CCs Out of Offices etc JISC mail Social communications Meeting arrangements These emails should be deleted as soon as possible and in any case not later than the retention schedule would allow

Responsibilities Often the sender should keep the record, particularly if the recipient is external Recipients of external emails Owners of processes should keep the audit trail- not often clear How important are you?

Practicalities? Save as .msg files Set aside an appropriate period of time every day to deal with email management Be familiar with the retention requirements for your area of work We still hold items in your deleted folder Use tools available: flags, duplicate finding, rules

How to Manage Shared Drives

Shared drives Shared drives (and SharePoint) are the appropriate places to store University records University records should be managed in accordance with the retention schedule University records should be accessible and easy to locate and use University records should be secure

Use of shared drives Should be the default storage location for documents Documents should be shared with links rather than as attachments to reduce proliferation Used to promote a culture of sharing information and collaboration Backed up and recoverable Compliance & Risk

Roles and responsibilities Ownership of shared drives should be clear Responsibilities should be clear among those staff who have access There should be a clear transition of roles and responsibilities when staff move Staff who should no longer have access to a drive should be removed Staff who set up “informal” folders will need to be responsible for their management

University records Same criteria as for emails Drives can store a mixture of ephemera, copies, versions, reference material and records, but the records should be stored in a distinct filing system Records should be managed, other material should be deleted when no longer needed

Structure of shared drives Shared drives should have an agreed consistent structure Files and folders should be subject to naming conventions High level folder structure should reflect local classification schemes, retention schedules and structure Folder names should be concise to avoid lengthy filepaths

Structure of shared drives 2 Lower level folders should be structured in a way which aids management Versions kept separate from finished documents Dates in a standard format Chronological folders to aid disposal Naming conventions with standard document types and version numbering Close folders when appropriate- e.g. at end of financial year etc.

Standard naming conventions Clear and meaningful names: not “misc” or “Fred’s files” Two or three digit numbers to make them easier to order, ie [0]01-[9]99 Surnames before initials! Reverse hierarchical order when describing structure: IGO/ Compliance and Risk Hierarchical order when describing content: Finance/ Invoices/ 2013-14

Records Identified records stored in formal structures Read only where possible Documents which are not records should be disposed of when they are no longer needed, but certainly should not be kept for longer than the retention period if they were a record

Records Management Advantages of managing records within shared drives properly: Improves ease of location of records To distinguish documents from each other To enable the sorting of documents To enable the confident deletion of documents To enable easier migration to new systems

Version control Version numbers should be included in the name of a document if various members of staff are working on it at the same time Version control numbering should be standard Typical: 0.1 for first draft, 0.2, 0.3 etc Completed document is 1.0 Minor changes then 1.1, 1.2 Major changes 2.0, 3.0 etc