## Business Requirements For Managing Digital Information And Records

 © Crown copyright 2013 You may re-use this information (excluding logos) free of charge in any format or medium, under the terms of the Open Government Licence. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence or email psi@nationalarchives.gsi.gov.uk. Where we have identified any third-party copyright information, you will need to obtain permission from the copyright holders concerned. This publication is available for download at nationalarchives.gov.uk. 

## 

Contents 
Introduction .................................................................................................................................... 
3 
The benefits of managing information 
............................................................................................ 
4 
1. User focus ............................................................................................................................... 
5 
2. Governance, ownership and accountability 
............................................................................. 
6 
3. Proportionate use of resources ............................................................................................... 
7 
4. Applications perform consistently ............................................................................................ 
8 
5. Digital continuity ...................................................................................................................... 
9 
6. Disposal ................................................................................................................................ 
10 
7. Transfer 
................................................................................................................................. 
11 
8. Audit and compliance ............................................................................................................ 
12 
Annex A: 
Mapping of business requirements to key information legislation compliance 
requirements 
................................................................................................................................ 
13 
 

## Introduction

This guidance describes eight common outcomes that if delivered will ensure the value of digital information, and the benefits of managing it, are realised. Business requirements describe at the highest level what the business should achieve and why. The ways in which they are met through applications and process - the how - are detailed within functional or operational specifications. The business requirements are: 

1. user focus. 
2. governance, ownership and accountability 3. proportionate use of resources 4. applications perform consistently 5. digital continuity 6. disposal 7. transfer 8. audit and compliance 
Individual organisations may have additional requirements which are out of the scope of this guidance.  
The National Archives has worked with a number of government departments to develop this common set of outcomes. They support the realisation of the benefits of managing digital information (and records) without adding complex sets of rules or applications that users do not need or cannot apply within their individual context. They support the need for ensuring governance, compliance and standards within an organisation's strategy to build its digital information management capability. They are flexible and user-focused, promoting the department's management of risk and the understanding and utilisation of existing tools. The requirements align with the second of the Information principles: 'information must be managed', and are themselves further supported by the Section 46 Code of practice and other guidance provided by The National Archives. 

 

## The Benefits Of Managing Information

The successful management of information is an enabler for:  

 the efficient and effective delivery of services to government and to the citizen  the exploitation, sharing, use and re-use of an organisation's information assets  the potential rationalisation of an organisation's technology infrastructure 
 the efficient and effective use of the technology infrastructure  transparency, accountability, citizen participation and legislative compliance  the mitigation of the risk of loss of information within line of business systems and 
applications 
Achieving these outcomes requires a balance between enabling the users' need for information availability (the business need) and the performance of the available systems and applications which may not always match exactly. Therefore any successful information management strategy requires: 
 a strategic vision that covers the needs for current, future and legacy information  time and resources to support: 

o raining and implementation o technology, process and business analysis o ongoing management activity 

## 1. User Focus Policies, Processes And Supporting Technology Must Be User Focused To Eliminate Barriers To Use. 

 Adopting any application or development of an information management policy or process that presents barriers between users and the way they need to access information creates a risk that alternative ways of working will be sought. This can lead to: 

o wasted costs of procurement and implementation o individual information repositories outside of a central corporate control or governance o information not being properly understood because it cannot be related to information 
within separate repositories 
o an inability to comply with information legislation and / or unable to meet official 
scrutiny 
o short term 'quick-fixes' being implemented that don't resolve long term issues o an inability to deliver services or reduction in the quality of services delivered o information being used or released that is misleading or incorrect leading to further 
misinformation, financial or reputational damage 
o users' time and resources wasted with potential cost implications 
Conflicting requirements may exist between different user groups: 

o internal (staff needs) o internal (business needs) o external organisations and their staff (other departments and government officials, 
wider public sector organisations and private sector organisations) 
o citizens (through services, transparency requests or citizen participation) o  there are also current and future needs across all user groups 

## 2. Governance, Ownership And Accountability Information Assets, The Technology That Supports Them, And The Business Requirements, Policies, And Processes That Govern Them, Must Have Defined And Accountable Owners. 

 If information assets are not owned and understood their value cannot be effectively released. 

Ownership of information should include: 

o defined ownership with appropriate oversight and accountability for the information 
assets' management 
o an accessible governance framework for asset owners that defines the relevant 
legislation, policy, standards and good practice to ensure effective management of the asset 
o the collaboration and co-ordination of a multi-disciplinary team to oversee the 
ownership of information assets that includes: 
o information managers o ICT managers o information assurance and security o business change teams 
o business owners, and potentially legal, audit and communications teams in 
delivering each requirement 
 Equally all users need to understand they are accountable for their own actions. They should be aware of the legislative requirements they need to fulfil and their responsibilities in ensuring the business requirements are met.  

## 3. Proportionate Use Of Resources The Time, Resource And Effort Expended On Managing Information Must Be Proportionate To Its Value. 

 Managing information requires an investment of time, money and people to create appropriate policies and processes and implement suitable systems, security and storage. Information value will differ between users and the business. To avoid disproportionate management of ephemeral information  identify the value of information assets and record it in an information asset register 
 The value of an information asset can be said to equate to: 

o the content of the asset, especially if sensitive in any way o the effort required to keep the asset available, complete and usable o the length of time, including any legal requirement, an asset needs to be held by the 
business 
o the consequences of the asset not being available or being accessed inappropriately 
 Where actions and activities are not commensurate with the value of information, the 
organisation can be exposed to unnecessary cost and create additional burdens on users and the IT infrastructure 
 The value of information may change over time, especially aspects of sensitivity. To avoid ongoing over-management, periodically review and re-value assessts accordingly 
 Placing information value at the heart of the decision making process establishes a 
framework for good governance, risk management and efficient decision making led by business need 
 Making value-led decisions enables pragmatic approaches to information security and 
appropriate use of applications and storage for information assets. It also supports cost savings by identifying information assets and technology no longer required  
 The business value of information may not be commensurate with the cost of maintaining it 

## 4. Applications Perform Consistently Applications Used To Store And Manage Information Assets Should Operate In A Predictable And Consistent Way.  

 Information management applications should operate predictably to ensure users understand how information assets can be accessed, used and managed. Applications should ensure two key attributes are properly maintained 

o the information asset is maintained in a common format that all relevant users can 
access easily with the available software 
o key information management activities are performed in a reliable and predictable way 
 The application should perform these tasks consistently to support: 

o increased efficiencies across an organisation through a common understanding of the 
outputs of each system or application (for example all disposal criteria across each system and application use the same metadata schema) 
o improved information flows within and outside of the department o improved compatibility and interoperability across the IT infrastructure o the unified management of different types of asset within across applications 
 Consistency is equally supported by the use of: 

o common standards; especially important when these are shared by multiple 
organisations hoping to share or re-use the asset 
o a common approach to risk mitigation, especially to managing loss of information 
within the application 

## 5. Digital Continuity

The value of information can only be fully realised if each asset has the attributes of availability, completeness and usability (collectively referred to as digital continuity). 

##  Information Is:

o available when it can be found in a timely manner and opened in a readable form o complete when it has context and an assured quality o usable when it can be manipulated as required with the user's available technology 
 The absence of any one of these three attributes can render the information either effectively lost within the system or not fit for purpose meaning: 

o tasks cannot be carried out and services cannot be delivered o information is unavailable for sharing, re-use, publication, transfer or to meet calls for 
scrutiny 
 Understanding the requirements for managing completeness, availability and usability enables a department to: 

o deliver appropriate, cost-effective technology in support of its information assets 
o assess risks to the long term suitability of its technology environment to manage critical 
information assets 
o make decisions about the release of information for exploitation, re-use or to fulfil 
obligations for transparency 
o highlight user requirements that the department is not aware of or not planning for and 
therefore unable to meet 
o understanding and manage technology compatibility issues between the department 
and external recipients 

## 6. Disposal Information Must Be Disposed Of When No Longer Required By The Business In Line With Legislative Requirements. 

 There are legislative requirements for (some) information to be disposed of after a certain length of time (Public Records Act, Data Protection Act) 
 Information held for longer than required carries unnecessary risk and cost: 

o excessive costs in terms of software licences, storage, IT support and back-ups o excessive storage adding burden to servers, creating inefficiencies o increased search times owing to volume of information, potentially causing compliance 
issues with information legislation 
 If information is held and it should have been disposed of to meet legislative requirements, the department may be found to be non-compliant or negligent. In these circumstances the department may face: 

o action from a regulatory body (for example, the Information Commissioner's Office) or 
official scrutiny (such as a Parliamentary Accounts Committee) 
 Where the department is found to be non-compliant or negligent it can incur further actions or penalties, particularly in relation to loss or misuse of personal data 
 

## 7. Transfer Applications Used To Store And Manage Information Assets Must Enable The Transfer Of The Content, Context, Value And Ownership Must Be Transferable. 

 Applications should support the transfer of information assets between: 

o internal systems - version upgrades or migration to new platforms o external organisations -either for collaboration or where ownership of the asset is 
transferred 
o other organisations or platforms - to facilitate the release or publishing of that 
information   
 This should include transfer of the descriptive, structural and management metadata to provide the context and value of the asset to the receiving organisation. Where this is not transferred: 

o the context of the asset may not be able to be fully understood o the asset may be rendered unavailable, incomplete or unusable o the recipient cannot ascribe an appropriate value to the asset relative to its own 
information assets and any others transferred 
If holding information on behalf of another organisation for any length of time it is equally important to retain this contextual understanding until it is returned to the original owner. 

## 8. Audit And Compliance Information Assets Are Evidence Of A Department'S Actions, Decisions And Processes And May Be Subject To Requests For Access Or To Official Scrutiny. 

 Applications used to store and manage information must be able to provide reports on or audit trails of all activity associated with assets stored within or managed by it. This is to support information as being maintained as evidence, without which the integrity of the asset could be called into question 
 Where a department does not have visibility of the actions assets have been subject to there are significant risks that: 

o departments cannot track whether information has been released either under a 
Freedom of Information or Data Protection request or for transparency or reuse 
o departments cannot state categorically whether they hold an information asset, 
whether it has been disposed of whether it may have been disposed of or transferred to another organisation 
o information assets will be inappropriately accessed, deleted or shared o the true value of the information in relation to a user's need to access it cannot be 
determined 

## Annex A: Mapping Of Business Requirements To Key Information Legislation Compliance

requirements 
Legislation and 
Ref 
Requirement 
Relevant 
Related Codes of 
related codes of 
business 
practice 
practice 
requirement 
Public Records Act 
1, 2, 4, 5, 8 
S46 Code of practice 
s3(1) 
To make arrangements for the **selection** of those 
1958 
public records which ought to be permanently 
Good records management 
preserved and for their **safe-keeping** 
practice recommendations 
s3(4) 
Public records selected for permanent preservation 
5, 7, 4, 8 
under this section shall be **transferred** not later 
than 20 years after their creation either to The National Archives or to such other place of deposit appointed by the Lord Chancellor under this Act (to be amended to 20 under Constitutional Reform and Governance Act s 45 (1) (a)) 
s3(4) 
Records may be retained after the said period, if in 
 
the opinion of the person who is responsible for 
them 
| s3(6)                                           | Public records not required for permanent       | 6, 4, 8                |
|-------------------------------------------------|-------------------------------------------------|------------------------|
| preservation should be                          |                                                 |                        |
| destroyed                                       |                                                 |                        |
| (after 20 years)                                |                                                 |                        |
|                                                 | Records transferred closed to The National      | 7,8                    |
| Archives must be done so against an agreed      |                                                 |                        |
| exemption under the Freedom of Information Act  |                                                 |                        |
| 2000                                            |                                                 |                        |
| Data Protection Act                             | Schedule 1,                                     | 2, 4, 8                |
| processed fairly                                |                                                 |                        |
| and                                             |                                                 |                        |
| 1998                                            |                                                 | Part 1                 |
| lawfully                                        |                                                 |                        |
| and, in particular, shall not be processed      |                                                 |                        |
| Good records management                         |                                                 |                        |
| unless authorised/required by or under any      |                                                 |                        |
|                                                 | practice recommendations                        |                        |
| enactment, convention or instrument imposing an |                                                 |                        |
| international obligation on the United Kingdom  |                                                 |                        |
| Schedule 1,                                     | Personal data shall be obtained only for one or | 2, 8                   |
| Part 1                                          | more                                            |                        |
| specified and lawful purposes                   |                                                 |                        |
| , and shall not                                 |                                                 |                        |
| be further processed in any manner incompatible |                                                 |                        |
| with that purpose or those purposes             |                                                 |                        |
| Schedule 1,                                     | 2, 8                                            | Personal data shall be |
| adequate, relevant and not                      |                                                 |                        |
| Part 1                                          |                                                 |                        |
| excessive                                       |                                                 |                        |
| in relation to the purpose or purposes for      |                                                 |                        |
| which they are processed                        |                                                 |                        |
| Schedule 1,                                  | 4, 8                                              | Personal data shall be    |
|----------------------------------------------|---------------------------------------------------|---------------------------|
| accurate                                     |                                                   |                           |
| and, where                                   |                                                   |                           |
| Part 1                                       | necessary,                                        |                           |
| kept up to date                              |                                                   |                           |
|                                              |                                                   |                           |
| Schedule 1,                                  | Personal data processed for any purpose or        | 6, 8                      |
| Part 1                                       | purposes                                          |                           |
| shall not be kept for longer than is         |                                                   |                           |
| necessar                                     |                                                   |                           |
| y for that purpose or those purposes         |                                                   |                           |
| Schedule 1,                                  | 2, 8                                              | Personal data shall be    |
| processed in accordance                      |                                                   |                           |
| Part 1                                       |                                                   |                           |
| with the rights of data subjects             |                                                   |                           |
| under this Act                               |                                                   |                           |
| Schedule 1,                                  | Appropriate technical and organisational measures | 2, 4, 5, 8                |
| Part 1                                       | shall be taken against                            |                           |
| unauthorised or unlawful                     |                                                   |                           |
| processing                                   |                                                   |                           |
| of personal data and against                 |                                                   |                           |
| accidental loss                              |                                                   |                           |
| or                                           |                                                   |                           |
| destruction of                               |                                                   |                           |
| , or                                         |                                                   |                           |
| damage to                                    |                                                   |                           |
| ,                                            |                                                   |                           |
| personal data                                |                                                   |                           |
| Schedule 1,                                  | 2, 8                                              | Personal data             |
| shall not be transferred                     |                                                   |                           |
| to a country                                 |                                                   |                           |
| Part 1                                       | or territory                                      |                           |
| outside the European Economic Area           |                                                   |                           |
|                                              |                                                   |                           |
| unless that country or territory ensures an  |                                                   |                           |
| adequate level of protection                 |                                                   |                           |
| for the rights and                           |                                                   |                           |
| freedoms of data subjects in relation to the |                                                   |                           |
| processing of personal data                  |                                                   |                           |
| Freedom of Information                          | s19              |
|-------------------------------------------------|------------------|
| Publish                                         |                  |
| certain information proactively                 | 1, 2, 4, 5, 7, 8 |
| Act 2000                                        |                  |
| Recommendations for                             |                  |
| 1, 2, 4, 5, 7, 8                                | s1               |
| Respond                                         |                  |
| to requests for information. To know what       |                  |
| public authorities about                        |                  |
| you hold and to be able to provide access to it |                  |
| their handling of requests                      |                  |
| S46 Code of practice                            |                  |
| Good records management                         |                  |
| practice recommendations                        |                  |
| Environmental                                   | Part 2,          |
| information available                           |                  |
| Information                                     | regulation 4     |
| proactively                                     |                  |
| , using easily accessible electronic            |                  |
| Regulations                                     |                  |
| EIR                                             |                  |
| Part 2,                                         | 1, 2, 4, 5, 7, 8 |
| Respond                                         |                  |
| to requests for environmental information       |                  |
| regulation 5                                    |                  |
|                                                 |                  |
| Good practice                                   |                  |
|                                                 |                  |
| recommendations to follow                       |                  |
| in meeting obligations                          |                  |
|                                                 |                  |
| under the Regulations                           |                  |
|                                                 |                  |
|                                                 |                  |
|                                                 |                  |
| European Directive on                                 |     | Make accessible public sector information    |
|-------------------------------------------------------|-----|----------------------------------------------|
| available                                             |     |                                              |
| the Re-use of Public                                  |     |                                              |
| for re-use:                                           |     |                                              |
|                                                      |     |                                              |
| Sector Information                                    |     |                                              |
| under standard, open licences                         |     |                                              |
| 2003                                                  |     |                                              |
|                                                      |     |                                              |
| at marginal cost price                                |     |                                              |
| The Re-use of Public                                  |     |                                              |
|                                                      |     |                                              |
| Sector Information                                    |     |                                              |
| without discrimination                                |     |                                              |
|                                                      |     |                                              |
| Regulations 2005                                      |     |                                              |
| where possible by electronic means                    |     |                                              |
|                                                       |     |                                              |
| NOTE                                                  |     |                                              |
| new Directive                                         |     |                                              |
| will come into force at                               |     |                                              |
| the end of 2014 (see                                  |     |                                              |
| below)                                                |     |                                              |
| European Directive on                                 |     |                                              |
| the Re-use of Public                                  |     |                                              |
| Sector Information                                    |     |                                              |
| 2013                                                  |     |                                              |
| Legal Deposit Libraries                               | s1  | A copy of every                              |
| published work to be deposited                        |     |                                              |
| Act 2003                                              |     |                                              |
| with the British Library                              |     |                                              |
| within one month of                                   |     |                                              |
| publication and to other deposit libraries on request |     |                                              |
| 1, 2, 4, 5, 7, 8    |     |
|---------------------|-----|
| 4,7, 8              |     |
| The Legal Deposit                            | Part 3,                                          | 4, 7, 8                                               |
|----------------------------------------------|--------------------------------------------------|-------------------------------------------------------|
| copy of every offline work is required to be |                                                  |                                                       |
| Libraries (Non-Print                         | regulation                                       |                                                       |
| delivered                                    |                                                  |                                                       |
| to the British Library within one month of   |                                                  |                                                       |
| Works)  Regulations                          | 15                                               | publication and to other deposit libraries on request |
| 2013                                         |                                                  |                                                       |
| Part 3.                                      | 4, 7, 8                                          |                                                       |
| Web harvesting of online work                |                                                  |                                                       |
| by British Library                           |                                                  |                                                       |
| Regulation                                   | and deposit libraries or by alternative delivery |                                                       |
| 16                                           | method where agreed                              |                                                       |