You should ensure you have procedures and guidelines in place for referencing, naming, and indexing new records.

You should also implement a security classification scheme where possible so that new records can be classified or marked according to their sensitivity. This will help you control access to these records and allow for efficient management, retrieval, and disposal.

While emails are often perceived differently than other records, they still contain information that has a broader business purpose, as well as personal data, so they must be managed consistently.

To ensure personal data is managed effectively and securely, you need to know what information you hold and how it is stored. You should perform an information audit or records survey to identify the records and datasets you hold. This will help you catalogue the data you process and how it is acquired, externally disclosed, or processed in your business.

The activity in the previous point will also help you determine which business functions create certain records, which are critical to your business, where you store them, how long you keep them, and who needs to use them now and in the future.

In order to gather the necessary information as part of the information audit, questionnaires can be distributed to key personnel across all areas or roles of your business.

You should document the results, for example in an information asset register.

These results can enable you to develop retention and disposal plans, improve security practices, and aid the development of disaster recovery processes.

You should ensure that you take reasonable steps to safeguard the accuracy of collected personal data and deal with challenges to its accuracy from the data subjects whose information you have recorded. What you consider to fall into these categories will change over time and as your business needs change.

You should have procedures in place to ensure the regular removal of personal data that is inaccurate or out of date from your records. This will allow you to amend, remove, or clarify the personal data you hold as appropriate.

Data collected, stored, and processed should be adequate, relevant, and limited to what is necessary. If you don't make decisions about what personal data you should keep for your business purposes, then you risk collecting excessive data and breaching a data subject's privacy, or you may hold too little to make effective decisions about those data subjects. Again, what is adequate, relevant, and not excessive will change with the needs of your business.

Under the GDPR, data subjects have the right to rectify or complete inaccurate or incomplete personal data. You should have adequate systems in place to handle requests from data subjects to correct or complete information, or to allow them to provide further clarification.

You need procedures to allow you to restrict personal data if necessary. You should use restriction methods appropriate to the type of processing you are carrying out.

The GDPR suggests a number of different methods you can use to restrict data, such as:

• temporarily moving the data to another processing system.
• making the data unavailable to users.
• temporarily removing published data from a website.

It is particularly important to consider how personal data is stored that no longer needs to be processed but which the data subject has requested be restricted, essentially requesting that it not be deleted.

If using an automated filing system, technical measures must be used to ensure that no further processing or alteration of the data can be performed while the restriction is in place. You should also note on your system that processing of this data is restricted.

Your employees may need to take paper documents off-site to work remotely, for example, to visit service users or attend court hearings. You may also want to store paper documents off-site due to limited space available in the office.

You should have procedures in place to ensure you know which records are off-site and who possesses them so you can retrieve them if needed or destroy them when they reach the end of their retention period.

When transferring data off-site you must minimize it, use an appropriate form of transport, e.g. a secure courier for sensitive personal data, log the start and end of the transfer where appropriate, and put controls in place to ensure the data is received. Security measures you can use include lockable containers, tamper-proof packaging, and removal from public sight and access.

Effective tracking of paper records will also help you quickly locate and retrieve information should you receive a subject access request.

You can transfer personal data off-site using electronic means such as email or removable media, e.g. USB drives or DVDs. CDs, DVDs, USB drives, smartphones, and tablets are vulnerable to theft or loss.

If you must transfer personal data via email or removable media, you should try to minimize the amount of information transferred and send it via encrypted mail or use secure devices that have been encrypted to protect against unauthorized access to the stored data.

You should use an appropriate means of transport, for example a secure courier for sensitive personal data. You must log the start and end of the transfer where appropriate and verify that the data is received.

Security measures you can use include tamper-evident packaging, encrypted devices, encrypted emails, and secure file sharing or transfer software.

You should use lockable offices, cabinets, and drawers to store records, with higher security levels for those containing special categories of personal data. Keys must also be kept securely and locks engaged when staff are away for extended periods, for example overnight.

Employees must lock their screens when they are away from their desks to prevent unauthorized and untraceable access, theft, destruction, or alteration of data.

Environmental controls for records storage areas might include waterproofing and drainage to protect against flood risk, fire protection such as the use of fire-resistant or fire-retardant materials, and fire control and heating systems to protect against damp.

There is a growing number of services offering cloud storage where documents and other files can be uploaded. You need to verify that the security and availability of the service are suitable for you. Think carefully about who can access your records and the location of the servers where your data is stored, check the storage provider's terms and conditions and privacy policy, and try to encrypt your data before putting it in the cloud.

To reduce the risk of unauthorized access, you should consider who needs access to what personal data to perform their function. For example, it is likely that only specific members of staff need access to HR records. In such cases, access must be restricted with keys, swipe cards, PIN codes, or other security measures.

Management should authorize access to systems holding personal data and ensure that permissions are restricted to the absolute minimum, known as least privilege. Each user must be assigned their own username and password to ensure accountability.

You should periodically review access permissions to ensure that privileges granted continue to be based on business needs and have been correctly authorized. The frequency of the review will depend on the level of privilege granted to the user.

A "brute force" password attack, where an attacker's computer tries every possible combination of characters to guess a password, is a common threat, so complex passwords should be enforced and a limit set on unsuccessful login attempts before an account is locked.

You should also monitor user activity to detect any unusual use. Passwords must not be shared and must be promptly disabled when a user changes service or leaves the organisation.

You should create a plan on how to deal with a major disruption to your business.

You will hold data without which your business cannot function. You should therefore assess the data you hold and identify how critical it is to the operation of your business.

You should perform regular backups so you can restore electronically stored personal data in the event of a disaster or hardware failure. The extent and frequency of backups should reflect the sensitivity, confidentiality of personal data, and how crucial they are to the proper functioning of your business. Preferably you should store backups off-site.

You should store personal data in a format that allows data subjects to be identified for no longer than is necessary for the purposes for which it is processed. You need to identify what types of records or datasets you hold, what types of information are stored, and then destroy, delete, or anonymize the personal data in the records you hold as soon as it is no longer needed.

After completing a records review, retention periods can be assigned to records and datasets. They can then be destroyed once the end of this retention period is reached.

You can destroy paper records in a number of ways, including cross-cut shredding or incineration. Your destruction method should be consistent with the sensitivity of the personal data being destroyed, and you should carry out checks to ensure staff are adhering to procedures. You should also delete digital records from systems, however if this is not technically possible, you should physically decommission them.

Where confidential waste collected daily is awaiting disposal, it must be stored securely, for example in lockable confidential waste bins. Larger storage areas may be required for the disposal of large amounts of personal data.

Furthermore, under the GDPR, data subjects have the right to request the deletion of their personal data, more commonly known as the right to be forgotten. A data subject can request the deletion of their personal data and prevent processing in specific circumstances:

• where the personal data is no longer necessary in relation to the purpose for which it was originally collected or processed.
• when the data subject withdraws consent.
• when the data subject objects to the processing and there is no overriding legitimate interest for continuing the processing.
• the personal data was unlawfully processed, i.e. in breach of the GDPR.
• the personal data must be erased to comply with a legal obligation.
• the personal data is processed in relation to the offer of information society services to a child. Such requests may not fall under the normal destruction schedule. You must therefore have procedures in place to allow you to fulfil any individual request.