1. Outlook and Shared Drives
Alan Carter
Information Governance Office

2. Unstructured Data
Data which is not in formal filing systems or databases
Often not searchable
No useful metadata
Often no coherent filing system- data is buried
No way of applying the retention schedule
No way of meeting legal obligations
Data is lost if the person who knows where it is goes
Compliance & Risk

3. Unstructured data 2 Identified as major risk by GDPR Project
Will hamper the move to O365
Biggest repositories are the shared drives and Outlook. Also SharePoint, paper filing systems etc
Starting campaign!
Put aside 5 minutes a day to sort out today’s work
Compliance & Risk

4. Emails Main communication method
Much formal University business is conducted by
Form parts of audit trails
Much ephemeral
But also can contain personal, sensitive and confidential data
Over half of data incidents involve
Compliance & Risk

5. s
s are the property of the University s are subject to the Data Protection Act s are subject to the Freedom of Information Act s can be used as evidence in legal and disciplinary proceedings is not a storage system is not backed up for very long centrally
Compliance & Risk

6. Email best practice (briefly)
Avoid unnecessary use of – use the telephone!
Limit s to just one subject
Limit recipients and ccs to those who actually need to know
Assume that anything you write could be released
Be careful what you say about individuals- opinion is subject to DP disclosure rules

7. Organise your mailbox Set up folders relating to particular tasks
Align your folder structure with your filing system
Set up rules to divert particular s to the right folders
Get rid of ephemeral messages as soon as possible
Make sure that the responsibility for managing shared mailboxes is assigned
Remove records from the system and store them somewhere else

8. Identifying records
Only a small proportion of s will qualify as a formal business record
Formal business records need to be kept in an appropriate filing system
Formal business records need to be managed in line with the appropriate retention, security and access rules

9. Records: An email constitutes a record if any of the following apply:
It provides evidence of a business transaction or activity
It needs to be retained for legal purposes
It needs to be retained for financial purposes
It provides evidence of a decision
It authorises an action
It approves a policy
It provides useful data for a future decision
It sets an important precedent
It provides details of liabilities or responsibilities
It provides information to protect rights or assets
It contains information of historical value

10. Examples of records Policy papers and recommendations Meeting minutes
Material received from external sources that is used for University business
Supporting material- raw data
Correspondence!
Attachments
Compliance & Risk

11. Emails which are not records
Copies!
CCs
Out of Offices etc
JISC mail
Social communications
Meeting arrangements
These s should be deleted as soon as possible and in any case not later than the retention schedule would allow

12. Responsibilities
Often the sender should keep the record, particularly if the recipient is external
Recipients of external s
Owners of processes should keep the audit trail- not often clear
How important are you?

13. Practicalities? Save as .msg files
Set aside an appropriate period of time every day to deal with management
Be familiar with the retention requirements for your area of work
We still hold items in your deleted folder
Use tools available: flags, duplicate finding, rules

14. How to Manage Shared Drives

15. Shared drives
Shared drives (and SharePoint) are the appropriate places to store University records
University records should be managed in accordance with the retention schedule
University records should be accessible and easy to locate and use
University records should be secure

16. Use of shared drives
Should be the default storage location for documents
Documents should be shared with links rather than as attachments to reduce proliferation
Used to promote a culture of sharing information and collaboration
Backed up and recoverable
Compliance & Risk

17. Roles and responsibilities
Ownership of shared drives should be clear
Responsibilities should be clear among those staff who have access
There should be a clear transition of roles and responsibilities when staff move
Staff who should no longer have access to a drive should be removed
Staff who set up “informal” folders will need to be responsible for their management

18. University records Same criteria as for emails
Drives can store a mixture of ephemera, copies, versions, reference material and records, but the records should be stored in a distinct filing system
Records should be managed, other material should be deleted when no longer needed

19. Structure of shared drives
Shared drives should have an agreed consistent structure
Files and folders should be subject to naming conventions
High level folder structure should reflect local classification schemes, retention schedules and structure
Folder names should be concise to avoid lengthy filepaths

20. Structure of shared drives 2
Lower level folders should be structured in a way which aids management
Versions kept separate from finished documents
Dates in a standard format
Chronological folders to aid disposal
Naming conventions with standard document types and version numbering
Close folders when appropriate- e.g. at end of financial year etc.

21. Standard naming conventions
Clear and meaningful names: not “misc” or “Fred’s files”
Two or three digit numbers to make them easier to order, ie [0]01-[9]99
Surnames before initials!
Reverse hierarchical order when describing structure: IGO/ Compliance and Risk
Hierarchical order when describing content: Finance/ Invoices/

22. Records Identified records stored in formal structures
Read only where possible
Documents which are not records should be disposed of when they are no longer needed, but certainly should not be kept for longer than the retention period if they were a record

23. Records Management
Advantages of managing records within shared drives properly:
Improves ease of location of records
To distinguish documents from each other
To enable the sorting of documents
To enable the confident deletion of documents
To enable easier migration to new systems

24. Version control
Version numbers should be included in the name of a document if various members of staff are working on it at the same time
Version control numbering should be standard
Typical: 0.1 for first draft, 0.2, 0.3 etc
Completed document is 1.0
Minor changes then 1.1, 1.2
Major changes 2.0, 3.0 etc