Record-Holders Face Many Hurdles

Companies must define programs to maintain, manage global data

By Mark Bentley and Theodore Ling 

Over the past decade, an enhanced regulatory environment has emerged, which fundamentally impacts how global organizations handle enterprise data. Laws and regulations now mandate that companies manage their electronic and physical records more carefully. Additionally, businesses with global operations are now obligated to develop a standard for corporate compliance that reconciles domestic e-discovery and retention rules with foreign privacy-law requirements.

Technology advances have enabled companies to transition paper records to digital form, and have spread information across multiple locations. Further complicating matters, many organizations have pre-existing records management foundations, which need updating to reflect increased regulation, pervasive technology and expanded business operations. These business realities raise the level of risk faced by a company.

Creating a process for managing records geographically as well as organizationally allows companies to share information that is often stored in multiple formats, while complying with competing legal requirements.

Current Challenges: Risk, Cost and Complexity
Companies face several challenges when developing and implementing global records management programs. Chief among these challenges is risk exposure, cost containment and project complexity.

The costs associated with global records management vary depending on the size and scope of the business and its information. A key cost that an organization confronts is associated with time spent researching the various laws and regulations of the countries where the company operates.

Companies must continually account for complexities associated with the processing and retention of information, and these challenges include data privacy, cross-border data transport, security standards, and restrictions on certain media storage formats. This complexity, combined with litigation risk and cost, are the main challenges encountered with global records and information management.

Path to Success: Implementing a Global Program
Companies must outline a path to success that will help decision makers determine how to build a global records management program best suited for their company’s business needs.

The first step requires a company to define the outcomes that it hopes to achieve from a records management program. Because the results can vary significantly, a company should take the time to define specific goals based on its organization.

Subsequently, it is critical to win support and commitment from senior management, who should become the driving force behind program implementation and maintenance. With management bought-in, companies are in a position to evaluate their resources and address logistics before developing a game plan.

Next, a company must identify and prioritize its legal and business risks.  Records-retention policies prioritize risks based on market/business size and business functions to help companies determine their overall risk and the type of records-management program needed.
A company should also assess risks in relation to litigation intensity, regulatory compliance requirements, and legal/regulatory penalties. Companies should assess the risks related to their core business functions as well as the risks related to standard corporate functions.
The final step is considering local law constraints. It is imperative that companies account for their local law requirements when enumerating risks and developing their program.

Optimizing records retention implementation requires assessing alternative methods of presenting both record classes and retention policies, and selecting the approaches that best match the company’s organizational structure and operations.

When a company has completed these steps and is ready to move forward with implementing their records management program, they should draft a schedule for each phase of the implementation process.

Because companies face the challenges of risk, cost and complexity when developing and implementing global records and information management programs, it is important to define a path to success that will minimize these challenges. Critical to this path to success is defining a records retention development process that can aid organizations in determining their overall risks. After a company takes the time to assess the steps outlined above, it is then ready to begin working toward a successful implementation and operation of an end-to-end global records management program.

Mark Bentley is Vice President, Strategic Services, of Iron Mountain’s Consulting Services division,  where he focuses on electronic records management, international retention program development, and online records management training development. Theodore Ling, Partner, Baker & McKenzie, is a leading member of Baker & McKenzie’s International Commercial and Information Technology/Communications Practice Groups, focusing on international commercial and regulatory matters and computer and technology law.