Essential Laws & Policies Every Records Manager Should Know

Compliance with records management laws and policies is crucial for businesses and records managers in preventing data breaches. Unauthorized access to a company’s consumer data can cause reputational damage and decreased revenue.

To encourage compliance, relevant government authorities impose strict penalties for noncompliance, including hefty fines, civil lawsuits, and in some cases, criminal charges.

This article explores more than 20 essential data laws and policies that every records manager should understand, relevant international data laws and the best practices for records management compliance.

General Data Protection & Privacy Laws

These laws regulate the collection, management, and storage of personal data. Some are specific to particular industries or geographical locations.

General Data Protection Regulation (GDPR) 

One of the strongest data protection laws worldwide, the GDPR regulates how companies collect and process online consumer information belonging to residents of the European Union. The law applies to anyone within and outside of the EU who targets EU consumers, whether through products and services or monitoring of online behavior.

Examples of GDPR policies include notifying visitors that their data is being collected, asking for consent, and alerting data subjects in case of a breach. Penalties for violating these regulations are based on a company’s revenue and may also include compensation in case of damages.

California Consumer Privacy Act (CCPA)

The CCPA provides various data rights to people who live in California, including the rights to know how their information is used and to request for deletion of their personal data from company databases. These laws apply to for-profit businesses that operate in the state or collect information from one or more California residents. Companies that violate CCPA regulations could face a fine of up to $2,663 for accidental violations and $7,988 for intentional violations.

Health Insurance Portability and Accountability Act (HIPAA)

Highly sensitive medical records can be used to harm the owner if they fall into the wrong hands. HIPAA upholds the privacy of a patient’s protected health information, such as name, Social Security number, health history, and biometrics through various provisions.

The privacy rule prohibits covered entities from disclosing an individual’s medical records, while the security rule ensures the protection of electronic health data. The enforcement rule sets the guidelines for investigating violations, conducting hearings, and setting penalties.

Family Educational Rights and Privacy Act (FERPA) 

Enacted in 1974 as federal law, FERPA protects student education records by mandating access and restricting disclosure of personally identifiable information without proper consent. All education institutions that receive government funding must grant parents or eligible students free access to their records and allow hearings to challenge and amend misleading or inaccurate data.

Records Retention & Management Laws 

Records retention and management laws establish recordkeeping, storage, and disposal practices for companies.

Sarbanes-Oxley Act (SOX)

Passed in 2002 after a series of high-profile financial scandals, the SOX Act protects investors from fraud by establishing reporting and recordkeeping practices, ensuring transparent audits, and enforcing criminal penalties for violations. Key provisions in this law include requiring senior officers to sign off quarterly financial reports, establishing internal controls to ensure accurate reporting, and setting criminal penalties of up to 25 years in prison for violating securities laws.

Gramm-Leach-Bliley Act (GLBA)

The GLBA is a federal law that governs how financial institutions gather, store, and share their customers’ nonpublic personal information, such as name, date of birth, and biometrics. Under the Privacy Rule of the GLBA, institutions must offer written notices to customers explaining their privacy policy practices, including an opt-out option if they don’t want their information shared with third parties. Furthermore, the Safeguards Rule requires regular evaluation and address of risks to customer records.

Freedom of Information Act (FOIA)

In line with transparency and democracy, the FOIA grants the right to request access to nearly all federal agency records, except a few categories of protected information. FOIA also requires agencies to publish certain types of information and frequently asked questions online.

US Federal Records Act (FRA)

The FRA is a document retention law that outlines the management of government records in their life cycle from creation to disposal. Among other things, it requires federal agencies to create standards and procedures for effective and efficient records management. It also champions the preservation of important legal, historical, and financial federal records, which people can request access to through the FOIA.

Industry-Specific Records Management Laws & Regulations

Certain record management laws apply to record managers working in specific industries.

Payment Card Industry Data Security Standard (PCI DSS)

The PCI Standards Security Council created PCI DSS regulations in 2006 to ensure the secure processing of cardholders’ data and to prevent card fraud. Any business that stores, transmits, or processes card payments must be PCI compliant to prevent data breaches and avoid hefty fines. PCI DSS is based on six major requirements that revolve around data protection, the establishment of secure payment networks, and the creation of security policies.

Bank Secrecy Act (BSA) & Anti-Money Laundering (AML) Laws

To fight financial crimes such as money laundering and tax evasion, the BSA & AML laws require financial institutions to keep a paper trail of transactions and identifiable information of the persons involved. Key requirements for financial institutions include retaining records for transactions, declaring cash transactions exceeding a daily aggregate amount of $10,000 to the Internal Revenue Services, and reporting other suspicious financial activity.

ISO 15489

ISO 15489 is a global standard created by the International Organization of Standardization (ISO) in 2001 to establish the principles and concepts of records management. It recognizes records as an integral informational asset and evidence for supporting business activity.

The standard also outlines the characteristics of a good record, which are usability, authenticity, integrity, and reliability. Record managers, regardless of their industry or location, must be knowledgeable about ISO 15489 requirements to ensure effective records management across departments.

National Archives and Records Administration Guidelines

NARA is the United States’ official records manager for federal records. NARA’s code of guidelines supports federal agencies in documenting essential transactions, procedures, and policies as part of their records. The guidelines also outline standards for federal records retention schedules and disposal of temporary records.

Employment & HR Recordkeeping Compliance 

Employment and human resource records management laws protect employee well-being at the workplace regarding issues such as wages, hiring practices, and safety.

• Fair Labor Standards Act (FLSA): To ensure minimum wage and overtime pay to eligible employees, the FLSA requires businesses to collect and keep certain records. Mandatory items in these records include employee’s personal information, the day and time their work week starts, hourly pay rates, daily and weekly number of hours worked, overtime earnings, total deductions, and amount of wages paid, among others.
• Equal Employment Opportunity Commission (EEOC) Regulations: The EEOC regulations state that employers must retain certain hiring and employment records of their employees for a set period of time. The retention period depends on the content of the records and the type of employer. For example, private employers must keep personnel and employment records for one year, while educational institutions must retain records for two years.
• Occupational Safety and Health Administration (OSHA) Recordkeeping: OSHA requires employers with more than 10 employees to report and keep records of serious workplace injuries that result in death, hospitalization, loss of consciousness, work transfer, or days away from work. The goals of these recordkeeping requirements are to evaluate workplace safety, understand work hazards, and implement protective measures.

Electronic Records & Digital Compliance

These rules govern the access, use, and legal validity of electronic records as online transactions become a norm.

• E-SIGN Act: The E-Sign Act confirms the legality of electronic signatures and records involving interstate or foreign commerce transactions. This reduces reliance on paper records and allows businesses to operate online safely. The law outlines five requirements an electronic signature must meet to qualify, including the parties’ intent to sign, proper signature attribution, association between the signing parties, signatures, and the document, and easy access to the documents by the signees.
• Uniform Electronic Transactions Act (UETA): The UETA law was a precursor to the E-Sign Act and validates electronic signatures and records for nearly any type of digital transaction. Electronic signatures must meet the requirements outlined within the E-Sign Act as well, including the retention of document copies in an easily accessible manner.
• Federal Rules of Civil Procedure (FRCP) E-Discovery Rules: FRCP data retention and disclosure rule sets out legal obligations for presenting electronically stored information during the eDiscovery process. The law requires electronic records to be easily and affordably accessible, which is a determinant of the strength of the evidence. Businesses or individuals should also develop appropriate procedures for preserving electronic records if they anticipate litigation.  

Data Retention & Secure Disposal Regulations

Data retention and disposal laws determine what data to keep and what to destroy while ensuring secure disposal methods that prevent unauthorized data access.

Fair and Accurate Credit Transactions Act (FACTA) Disposal Rule

The FACTA Disposal rule requires businesses and individuals who process personal information in consumer reports and records to find appropriate ways to dispose of the data. This typically means using disposal methods where the information isn’t exposed to unauthorized persons.

Some of the popular methods of destroying such information include shredding, incinerating records, and erasing or wiping out the data. Having proper disposal rules upholds customer trust and creates a strong brand image while enhancing operational efficiency.

Records managers can comply with the FACTA Disposal Rule by developing and implementing a disposal policy, training employees involved in the process, and using a certified electronic records disposal provider.

Health Information Technology for Economic and Clinical Health (HITECH) Act 

The HITECH Act is a federal law enacted as part of the 2009 American Recovery and Reinvestment Act. It encouraged the adoption of electronic health records (EHR) by providing monetary incentives to companies that demonstrated meaningful use of EHR. HITECH shares its goals with the US healthcare system’s regulations, which include patient engagement, upholding the security and privacy of health records, and increased care coordination.

The legislation also strengthened HIPAA’s security and privacy rules and introduced harsher penalties for HIPAA violations to encourage compliance.

State-Specific & International Records Management Compliance

Before the CCPA, California had enacted a data security breach reporting law that requires businesses to notify consumers in case of data access by unauthorized persons. Other states also have various records management and data privacy regulations to protect their information.

Arizona’s data breach law requires organizations to send a notification to affected customers or users within 45 days of the breach and to the attorney general if the incident impacts more than 100 individuals. Virginia was the second state after California to pass a data protection law, the Virginia Consumer Data Protection Act (VCDP), which safeguards sensitive data and imposes records management on the businesses managing the data.

Other countries have their versions of records management and data privacy laws within their geographical area. Examples include:

• Privacy and Other Legislation Amendment Bill (Australia): This law was originally enacted in 1988 to ensure the safety and privacy of personal data collected by businesses. It also allows victims of data security breaches to pursue a statutory tort for serious privacy violations.
• Swiss Revised Federal Act on Data Protection (Switzerland): The FADP law governs the collection, processing, storage, and use of personal data for Switzerland residents. The recent amendments further broadened items under sensitive personal data to include biometrics and genetics.

Best Practices for Records Compliance 

Record managers and business owners can implement the following strategies to ensure compliance with the data laws and policies they’re subject to:

• Conducting regular compliance audits: Regular compliance audits allow a records manager to identify points of non-compliance early on and address them before they become a bigger problem.
• Implementing a records retention policy: Various laws require businesses to keep certain customer or employee personal data for a certain period. A records retention policy simplifies this process and ensures legal compliance while enhancing organizational efficiency.
• Ensuring secure storage and disposal methods: Storage and disposal methods that are not secure put sensitive information in the wrong hands. Secure storage and disposal prevent unauthorized access while moving data from one life cycle to another.
• Training employees on legal compliance: Employees who understand compliance with relevant records management laws are likely to handle sensitive data more responsibly than those who don’t know the rules. Accurate knowledge also allows them to recognize the signs of a data breach and prevent them beforehand.

Learn More About Compliance for Records Managers

Records management laws fall under various categories depending on their implementation and data guidelines. Some establish standards for gathering and storing data, while others lay out proper retention and disposal methods.

Records managers must understand these laws to avoid penalties for violations. Be sure to always speak to professional legal help to ensure your business is compliant.