PURPOSE
The purpose of this policy is to outline the principles and processes for information and record management at Global Leadership Institute (GLI).

PRINCIPLES

• All GLI information and records are appropriately created, managed, maintained, and disposed of in accordance with legislative requirements, policy, and recognised standards of best practice.
• Record and information keeping practices are set up to support all activities of the Institute and are consistent and at a suitable standard across the Institute.
• Levels of responsibility are established regarding record and information keeping pertaining to all functions, processes, activities, and transactions of the Institute.
• GLI provides appropriate security and access over records.
• GLI ensures that historical documents are captured and preserved.
• GLI acknowledges that records and information are to be created to document or facilitate the transactions of all business activities. Business rules and procedures are to be put in place to ensure that requirements to make records and information are documented and that systems are in place to facilitate the creation of records. All staff are to be made aware of their responsibilities to make records.
• Records and information are to be created at the time or as soon as practicable after the event to which they relate. All records and information created by GLI are to provide a correct reflection of what was done, communicated, or decided.
• Records and information created or received by GLI are to be routinely captured into an approved record and or information keeping system and appropriate metadata created and captured, or otherwise associated with records or information.
• Record and information keeping systems and storage facilities are designed and implemented to protect records and information from unauthorised access, alteration, deletion, or loss. Unauthorised access, alteration or destruction of records or information is forbidden by GLI policies and procedures. Migration of records and information from one system to another is to be controlled, documented and compliant with best practice.
• Records and information are to be linked to their business context, which includes records and information relating to the same business activity or transaction. The location and use of records and information is to be recorded and tracked. Records and information are to be accessible for as long as they are required and disposed of in accordance with the approved procedures.
• Records and information must be disposed of in accordance with legislative requirements, policy, and recognised standards of best practice.

DEFINITIONS
Appraisal: evaluation of business activities to determine which records and information should be retained and the period of retention to meet legislative requirements, business needs and organisational accountability.

Archive: non-current records or information, for permanent retention.
Classification Scheme: grouping records and information according to their functionality.

Disposal: range of activities involved in retention, deletion, or destruction of records.

Disposal Schedule: list of various records or information and the period of time the record must be retained. It may also indicate the time at which records or information should be transferred to secondary storage.

Disposal trigger: event such as, action completed or superseded, from which the disposal date is calculated.

Destruction: destroying a record or information, either the physical destruction or permanent deletion of a record or information.

Document: information treated as a unit of information.

ICT: Information Communication Technology, including associated resources, which relate to the capture, storage, retrieval, transfer, communication, or dissemination of information through electronic media. This includes hardware, software, networks, recording equipment, web-based systems, databases, files, software licenses, computing-related contracts, network bandwidth, usernames, passwords, documentation, and electronic mail.

Other Entities – External organisations which may provide cloud solutions (e.g. Microsoft, Amazon Web Services) and host services such as Turnitin.

Record: information created or received by GLI which provides evidence of relevant activities, irrespective of the technology or medium used to generate, capture, manage, preserve, and access information.

Record Management System: information system used to capture and provide access to records.

Retention: period a record or information should be retained by the institution before final disposal. It may also indicate when records or information should be transferred to secondary storage or archived.

Sentence: identifying and classifying a record or information according to the Disposal Schedule.

User: all staff, students, contractors, visitors, alumni, and all other people who legitimately access and use computing resources, information technologies and networks owned or managed by GLI.

ROLES AND RESPONSIBILITIES
Registrar is responsible for ensuring that all record management legislative requirements are met.
Records Officer is responsible for records management at the operational level, ensuring the implementation of this policy.
Section Managers are delegated record management responsibility:

Record Area	Section Manager Responsible
Student Records	Registrar
Financial Records	Finance Manager
Staff & Payroll Records	HR Manager
Curriculum Records	Program Director
Legal & Contracts	President
Library	Librarian

 

All staff are responsible for creating appropriate and accurate records of the business activities and affairs of GLI.

PRIVACY
GLI adheres to the principles and requirements in the Privacy Amendment (Private Sector) Act 2000, Privacy and Personal Information Protection Act 1998 (PPIPA), Health Records and Information Privacy Act 2002 (HRIPA), and Privacy Amendment (Notifiable Data Breaches) Act 2017.  Where relevant GLI will also meet its compliance obligations with the EU General Data Protection Regulation 2016/679 (GDPR).

Users are responsible for maintaining appropriate access restrictions for their files, as well as protecting their passwords. Users who knowingly allows another person to use their username or password may be found responsible for any inappropriate use on the part of that person. Distribution of name lists, e-mail addresses, home addresses, or other means of contact will not be provided without the express permission of the persons involved. Neither shall the security codes or passwords of GLI users be divulged to others.

Invasion of the privacy of any person using GLI’s ICT is prohibited. GLI reserves the right to supervise the entire network to preserve the security of GLI and all users. GLI respects the privacy of users and does not routinely inspect or monitor use of ICT resources. However, GLI does not guarantee the security and privacy of data created, stored, or transmitted upon its ICT systems, including any user’s electronic mail and/or electronic files. Information reports will be available to GLI which can subsequently be used for matters such as system performance and availability, capacity planning, cost re-distribution and the identification of areas for personal development.

Authorised GLI staff may access information in the following situations:

• legal request for public disclosure of public records;
• GLI record retention requirements;
• routine system maintenance;
• investigations of misconduct, consistent with all legal requirements and with the approval of the delegated supervisor. This provision applies to monitoring of employee accounts when the monitoring is done because of suspected illegal activity or policy violations;
• monitoring of GLI accounts.

Security Information
GLI may record visits to GLI websites and log information for statistical and business purposes. This includes a user’s address, user’s domain name, IP address, date and time of visit, pages accessed, and previous site visited. Identification of the user may also be requested and logged. If the person is not a GLI student or staff member, the email address of sent messages will be recorded.

GLI websites have security measures in place against the loss, misuse, and alteration of information. Generally, a login and password are required to visit secure areas. This is to ensure that information is displayed only to the intended person. Individuals are responsible to always keep their password secure.

Some GLI courses and/or units require the use of forums, on-line teaching environments, message boards and/or news groups. Any information that is disclosed in these areas becomes public information and it is the responsibility of the user to exercise caution when deciding to disclose personal information.

STUDENT RECORDS
GLI maintains accurate and up-to-date student records of enrolments, progression, completions, and award of qualifications. Official academic records of the grades achieved by a student in a course are stored permanently by GLI in a secure central system. The Registrar is responsible for ensuring the safety, accuracy, privacy, and order of all student records. Electronic storage is password protected and hard copy information is filed securely in a locked facility. The Information Technology Manager is responsible for protecting against the loss of electronic student records by ensuring appropriate backup of data.

Student files are kept in a secure location and can only be accessed by authorised GLI personnel. Students can access their personal information by making this request to the Records Officer who reports to the Registrar. Students may request to have incorrect personal information corrected by contacting the Records Officer and providing documentation to support the change.

Students are provided with accurate information about the use and disclosure of their student records, which includes the disclosure of information to external parties, such as the Commonwealth, tuition assurance scheme operators and accreditation bodies.

RESEARCH RECORDS
In accordance with the Australian Code for the Responsible Conduct of Research, GLI implements risk-based protections for research data (progressive or final data/information gathered for research by GLI academic staff and students) to guard from accidental or malicious manipulation or loss. This includes regular testing of retrieval and retention for at least five years.

Training
All staff will receive record management training as part of their orientation.

Auditing
Regular auditing of record management activities takes place. This ensures that records are being created and maintained correctly and an accurate record of GLI’s business activities and affairs is being captured in the record management system.

Creation of Records

• Records are added to the recordkeeping system at the time of creation or receipt of a document.
• Wherever possible records are held in electronic format.
• All records are classified according to the appropriate record keeping naming conventions. The record classification scheme is used to classify all GLI’s records.
• Where possible, records are sentenced at the time of creation in accordance with the appropriate disposal schedule.

Record Maintenance

• All records are stored for their period of retention.
• All records are accessible.
• All records (electronic and hard copy) are maintained in good condition.

Records will be retained in a useable and accessible form for at least the minimum retention period contained within the applicable Retention & Disposal Schedule as approved by the Queensland State Archivist (https://www.qld.gov.au/recreation/arts/heritage/archives). Electronic records will be sentenced in accordance with an approved Retention and Disposal Schedule and appraised prior to their transition to inactive storage, permanent retention, or their disposal. Only delegated record management officers are authorised for record removals.

Retention and Disposal of Records

• All records should be disposed of according to the appropriate disposal schedule.
• All records must to be sentenced according to the appropriate disposal schedule.
• The disposal date must set according to the disposal trigger.
• No records can be destroyed of without the permission of the Records Manager.
• All records that are destroyed must be recorded in a register of “Destroyed Records”.
• The destruction process must be secure to ensure confidentiality.

GLI will ensure that high-risk, high-value and permanent records will be kept in an approved record keeping system to ensure the record is discoverable, accessible, and managed throughout their lifecycle.

Records retention requirements vary to support accountability, and for legal, knowledge and historical reasons. Management of records within a business context and/or system, and the resources needed for their retention, needs to be prioritised based on risks to GLI if the record was unable to be located or authenticated as accurate.

Before any record is stored with an external storage provider, the Records Officer must be provided with a catalogue of the records to be stored with the provider. GLI is responsible for any costs associated with records storage with external storage providers.

Disposal authority adheres to the GLI Delegations Schedule.

Archiving Records
Inactive records should be archived with the approval of the Records Officer.
The archive will include records that must be held indefinitely and inactive records during their retention period.

Record Security

• Records must not be altered and all care must be taken not to damage records.
• Access to records will be limited by a password hierarchy.
• All records will be kept in a secure environment.
• GLI’s Critical Incident Policy is in place to minimise the potential loss of records.

Records handling

• Section procedures may only be prepared and used with the approval of the Records Officer.
• Current Section Procedures:
• Student Records Management Procedure
• Finance Management Procedure

NOTIFYING AND HANDLING OF BREACHES
Users are responsible for reporting possible breaches of this policy to the IT Manager. The IT Manager is responsible for handling potential breaches for users in accordance with the Code of Conduct Policy. Penalties for misuse of ICT resources may range from loss of access to accounts, to formal disciplinary action up to and including dismissal, or in some more serious instances criminal or civil proceedings.

RECORDS TO KEEP
Common records kept and managed by GLI include, but are not limited to:

• Academic programs: development, approvals, management, and review
• Assets: infrastructure and equipment controls, registers, maintenance, warranties, security
• Audits: process, internal due diligence, or as required
• Disaster management and business continuity – plans, manuals, debriefs
• Facilities: buildings, infrastructure; library, maintenance
• Financial: data, audits, fraud prevention
• Governance records: agendas, attachments, minutes, delegations, polices
• Grants and scholarships: case files and arrangements
• Insurance: materials
• Learning and Teaching: content, exams, assessment
• Marketing: campaigns and materials
• Research: ethical clearance, data/information, patents
• Staff: CVs, scholarship, induction, training, misconduct issues
• Student records: enrolments, orientation, progression, completions, award of qualifications, academic transcripts, academic integrity matters, student support, safety, and security
• Vital Records: essential for the ongoing business of GLI. These include, but are not limited to, contracts, deeds, memoranda of understanding, licences, evidence of ownership of physical and intellectual property, and other records documenting legal authority.
• Work health and safety: administration, training, incidents, reporting, wellbeing

DISASTER MANAGEMENT PLAN
Risk prevention, response, and recovery strategies for protecting and recovering GLI records in the event of a disaster are implemented through a Disaster Management Plan. The plan ensures that vital records receive the highest salvage priority.

Scope

Whole Institute

Key Stakeholder

All Staff