Parliamentary and Health Service Ombudsman

PARLIAMENTARY AND HEALTH SERVICE OMBUDSMAN

Information Asset Register

Version 2.0 Document Control

Title: Policy and Guidance - Information Asset Register Original Author(s): Head of Information and Records Management Owner: Deputy Chief Executive Reviewed by: Information and Records Manager Quality Assured by: Head of Information and Records Management 1.07 APPROVED STRATEGIES, POLICY AND GUIDANCE / Meridio Location: Business Policy and Guidance Approval Body: EB Approval Date: TBA

Change History Version Date Status Update by Comment 1.0 Approved Suzanne Wright 2.0 15/06/12 Review Katharine Addition of Meridio rules relating to Stevenson disposal Addition of retention reasons Addition of new information assets

of 153 Information Asset Register v2.0 2 1. Introduction

1.1 The PHSO Information Asset Register identifies and organises the information assets within the Office – that is, the information that is required to run or support the organisation. It provides an overview of what information is owned, available and maintained.

1.2 PHSO’s register lists the types of information held and follows the corporate file plan. It describes the type of asset, identifies the asset owner and the retention period for the asset and the reason for its retention. The retention periods apply to both paper and electronic assets.

1.3 The Information and Records Management function will be responsible for maintaining the register, assigning relevant retention periods for all information assets which will enable disposal activity to be carried out in a consistent and controlled manner. It will be available on Ombudsnet for all staff to view and will be issued to asset owners so they are aware of the assets they own and the retention periods applied to them.

1.4 The retention periods set out in the register have been set according to business need, as agreed by the Executive Board and records owners, and meet legislative and regulatory requirements.

1.5 The Information and Records Manager will make amendments and additions whenever legislation or business needs change. Once approved, changes will be made when there is agreement between the Head of Information and Records Management and the relevant Information Asset Owner. These changes will be reported to the Deputy Chief Executive in his role as SIRO.

2. Responsibilities of the information asset owners

2.1 The information asset owner is a senior member of PHSO, who is the nominated owner for one or more identified information assets of the organisation. The owner is responsible for ensuring that specific information assets are handled and managed appropriately. This means making sure that information assets are properly protected and that their value to the organisation is fully exploited.

2.2 Their role is to:  Lead and foster a culture that values, protects and uses information for the success of the organisation and benefit of its customers and stakeholders  Know what information the asset holds, how it is being managed and approve the disposal of the asset when no longer needed  Protect and assess the risk to the confidentiality, integrity and availability of the asset(s) they are responsible for  Know who has access and why and ensures the use of the asset is monitored and compliant with policy (by IRM function)

of 153 Information Asset Register v2.0 3  Understands and assesses risks to the information assets they ‘own’, provide assurance to the Head of Information and Records Management and manages and mitigates these risks, and ensures any data loss incidents are appropriately managed  Ensure that information and records management and Data Protection policies and procedures are followed  Inform the IRM function if there are changes to the information asset register for the assets they ‘own’

2.3 The Head of Information and Records Management and the Information and Records Manager will:  Ensure that information asset register is accurate, maintained and up to date  Define and implement appropriate safeguards to ensure the confidentiality, integrity and availability of the information asset  Manage the access controls to the information assets  Authorise access to those who have a business need for the information  Ensure access is removed from those who no longer have a business need for the information  Manage the disposal processes of the assets  Assess and monitor safeguards to ensure their compliance and report situations of non-compliance  Produce regular audit reports on access to the assets for asset owners and identify any risks to the assets  As part of the wider Records Management assurance and compliance procedures, provide an annual written risk assessment to the Executive Board for all assets owned and provide assurance to the Board on the security and use of these assets

3. Information risks to manage

3.1 The Head of Information and Records Management, working with the Information Asset Owners and the Security Manager, will need to assure against:  Inappropriate access to, or disclosure of, protectively marked or personal data by staff, contractors and outsiders, whether accidental or deliberate  Internal threat – staff acting in error or deliberately, or external parties, getting PHSO’s information illegally and exposing it/ acting maliciously to defraud PHSO or its customers  Information loss – particularly during transfer or movement of information, or as a result of business change  Loss of digital continuity – i.e. losing the ability to use PHSO information in the way required when required. By use, we mean being able to find, open, work with, understand and trust PHSO’s information

of 153 Information Asset Register v2.0 4 3.2 An assessment of the risk level for each section of the file plan has been made and is listed in this register. It should be noted that individual documents/ records within a section may have a higher risk than the section overall and will need to be managed accordingly.

4. Structure of the Information Asset Register

4.1 The Information Asset Register contains the following fields:

Field Explanation Description of Assets Brief description of what the asset is More detail on what the components of the asset are What part of the business does the asset support? Information Risk What are the risks to the asset? What are the risks to the business from the asset? Information Asset The type of records included in the asset (arranged according to the classes in the Meridio fileplan) Information Asset Who is the Information Asset Owner? Owner Retention Period and How long the information asset should be kept. The Reason reason why the information is being retained (i.e. business use, legislation, regulation etc) Meridio Action and Guidance for LIRAs on when to close folders (where Review instruction applicable) to trigger the retention period. Guidance to Information Asset Owners on what to do with the information once it has reached the end of its retention period (Review).

4.2 The register is structured around the corporate file plan. The sections referred to in the register are the sections of the file plan. As the purpose of the register is to group types of assets, rather than list individual ones, the register lists asset types at the third level of the file plan and does not go down to folder level unless required for specific retention and disposal reasons.

of 153 Information Asset Register v2.0 5 Section 1:

Governance and Strategic Management

of 153 Information Asset Register v2.0 6 Description of assets:

The governance and strategic management section contains assets relating to governance, corporate meetings, management meetings, strategic and business planning, corporate performance and risk and audit. This includes the annual report, minutes, papers and agendas for the Advisory Board, Audit Committee, Executive Board and Pay Committee, divisional meetings, strategic, corporate and divisional business plans, internal audit and approved business, casework, corporate, financial and HR strategies, policies and guidance.

The assets set out how PHSO is governed, its relationship with other organisations and the annual review of performance and resources. Some of the assets are available on PHSO’s website (final annual report, press releases and other promotion in relation to the annual report, EB expenses, governance statement, redacted papers and minutes from corporate meetings, statement of responsibilities and final resource accounts). Other assets, such as corporate performance data, internal audit or fraud investigations, are for internal use only.

Some of the assets in this section contain personal data such as Pay Committee papers, Corporate Performance Data or Fraud Investigations. Other assets will contain sensitive corporate information such as Executive Board papers or management meeting records. Many of the assets are published on PHSO’s website such as the annual report, resource accounts, statement of responsibilities and EB expenses.

Information risks:

Given the variety of assets contained within this section and that some are published on PHSO’s website, the overall level of information risk for the assets is considered to be medium. As some of the records do contain personal or sensitive data, there is a possibility of inappropriate access or internal threat to the information, although such assets do have restricted access to them and therefore the risk is mitigated.

Some of the records are transferred externally for production prior to publication. There is, potentially, a risk of information loss during transfer but as this information will be published at some point, the risks associated with this are limited.

of 153 Information Asset Register v2.0 7 1.01 GOVERNANCE / ANNUAL REPORT (Annual Classes)

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: On publication of the Annual Retention Period: Destroy 6 years after Report move the final version of Annual Report to Annual report - content Director of publication of Annual Report. Section 1.08 FINAL PUBLISHED CORPORATE and data Communications REPORTS. Then close the folder. Reason: Business Use Review Instruction: Delete folder Retention Period: Destroy 6 years after Meridio Action: Close folder on publication of Director of publication of Annual Report. Annual Report. Annual report - promotion Communications Reason: Business Use Review Instruction: Delete folder

1.01 GOVERNANCE / EB EXPENSES

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction

Retention Period: Destroy 6 years after Meridio Action: Close folder at end of financial Director of Finance, end of financial year. year. EB Expenses Planning & Performance Reason: Taxes Management Act, 1970 Review Instruction: Delete folder 1.1 GOVERNANCE / STATEMENTS AND MEMORANDA

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Automatic Part closure at end of Retention Period: Archive 6 years after Business Year. Governance Statement approved. Accounting Officer Ombudsman’s Policy Appointment Manager Review Instruction: Archive final version of Reason: Business Use / Historical Accounting Officer Appointment letter. Delete Interest Part after review complete. Meridio Action: Automatic Part closure at end of Retention Period: Archive 6 years after Business Year. Governance Statement approved. Governance statement Deputy Chief Executive Review Instruction: Archive final version of Reason: Business Use / Historical Governance Statement. Delete Part after review Interest complete. Meridio Action: Automatic Part closure at end of Retention Period: Archive 6 years after Business Year. Governance Statement approved. Memoranda of Ombudsman’s Policy Understanding Manager Review Instruction: Archive final version of Reason: Business Use / Historical Governance Statement. Delete Part after review Interest complete. Meridio Action: Automatic Part closure at end of Retention Period: Archive 6 years after Business Year. Resource Accounts approved. Director of Finance, Resource accounts (final) Planning & Performance Review Instruction: Archive final version of Reason: Business Use / Historical Resource Account. Delete Part after review Interest complete.

of 153 Information Asset Register v2.0 9 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Automatic Part closure at end of Retention Period: Archive 6 years after Business Year. Statement of Responsibilities approved. Statement of Ombudsman’s Policy Responsibilities Manager Review Instruction: Archive final version of Reason: Business Use / Historical Governance Statement. Delete Part after review Interest complete. Meridio Action: Automatic Part closure at end of Retention Period: Archive 6 years after Business Year. Statement of Internal Control approved. Statement of Internal Deputy Chief Executive Control Review Instruction: Archive final version of Reason: Business Use / Historical Governance Statement. Delete Part after review Interest complete.

1.02 CORPORATE MEETINGS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Close folder at end of Business Retention Period: Archive 6 years after Year. end of business year. Advisory Board Ombudsman’s Business Manager Review Instruction: Archive whole folder under Reason: Business Use / Historical ARC 3.02 CORPORATE MEETINGS /ADVISORY Interest BOARD. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Approved for Publication Ombudsman’s Business end of business year. Year. Corporate Meeting Minutes Manager Reason: Business Use Review Instruction: Delete folder. Audit Committee Head of Governance Retention Period: Archive 6 years after Meridio Action: Close folder at end of Business end of business year. Year.

of 153 Information Asset Register v2.0 10 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Review Instruction: Archive whole folder under Reason: Business Use / Historical ARC 3.02 CORPORATE MEETINGS /AUDIT Interest COMMITTEE. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Corporate Meetings Ombudsman’s Business end of business year. Year. Governance Manager Reason: Business Use Review Instruction: Delete folder. Meridio Action: Close folder at end of Business Retention Period: Archive 6 years after Year. end of business year. Executive Board Ombudsman’s Business (annual folders) Manager Review Instruction: Archive whole folder under Reason: Business Use / Historical ARC 3.02 CORPORATE MEETINGS /EXECUTIVE Interest BOARD. Meridio Action: Close folder at end of Business Retention Period: Archive 6 years after Year. end of business year. Pay Committee Ombudsman’s Business Manager Review Instruction: Archive whole folder under Reason: Business Use / Historical ARC 3.02 CORPORATE MEETINGS /PAY Interest COMMITTEE. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Programme Programme Boards Ombudsman’s Business end of programme board. Board. Manager Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Published Corporate Ombudsman’s Business end of business year. Year. Meeting Papers Manager Reason: Business Use Review Instruction: Delete folder. Restricted Meeting Papers Ombudsman’s Business Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Manager end of business year. Year.

of 153 Information Asset Register v2.0 11 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction

Reason: Business Use Review Instruction: Delete folder.

1.3 MANAGEMENT MEETINGS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Business Communications' Director of end of business year. Year. Management Meetings Communications Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Business Corporate Resources' end of business year. Year. Management Team Deputy Chief Executive Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Business Corporate Resources' end of business year. Year. Managers Deputy Chief Executive Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Business Extended Management end of business year. Year. Group Director of POD Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Business Operations Directors' end of business year. Year. Meeting – Restricted Deputy Ombudsman Reason: Business Use Review Instruction: Delete folder. Operations Directors' Deputy Ombudsman Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Business Meeting – Unrestricted end of business year. Year.

Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Business Operations Managers' end of business year. Year. Forum Deputy Ombudsman Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Business Senior Management Team end of business year. Year. Director of POD Reason: Business Use Review Instruction: Delete folder.

1.4 STRATEGIC AND BUSINESS PLANNING / CORPORATE BUSINESS PLANS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Move final version of Corporate Retention Period: Destroy 3 years after Business Plan to section 1.08 and close folder at Corporate Business Plans Director of Finance, end of business year. end of Business Year. Planning and Performance Reason: Business Use Review Instruction: Delete folder.

of 153 Information Asset Register v2.0 13 1. 04 STRATEGIC AND BUSINESS PLANNING / DIRECTORATE PLANS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Close folder at end of Business Retention Period: Destroy 3 years after Year. Directorate Plans Director of Finance, end of business year. Planning and Performance Review Instruction: Delete folder. Reason: Business Use

1.4 STRATEGIC AND BUSINESS PLANNING / DIVISIONAL PLANS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Move final version of Corporate Retention Period: Destroy 3 years after Business Plan to section 1.08 and close folder at Divisional Plans Director of Finance, end of business year. end of Business Year. Planning and Performance Reason: Business Use Review Instruction: Delete folder.

1.4 STRATEGIC AND BUSINESS PLANNING / STRATEGIC AND BUSINESS PLAN ADMINISTRATION

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Close folder at end of Business Retention Period: Destroy 3 years after Strategic and Business Plan Year. Director of Finance, end of business year. Administration Planning and Performance Review Instruction: Delete folder. Reason: Business Use

of 153 Information Asset Register v2.0 14 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Automatic Part closure at end of Retention Period: Review 3 years after Business Year. Strategic and Business Plan Director of Finance, end of business year. Administration / Strategic Planning and Performance Review Instruction: Move final version of Plan Production Reason: Business Use Strategic Plan Production to the Archive. Delete Part.

1.05 CORPORATE PERFORMANCE MANAGEMENT / ADMINISTRATION

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end of Director of Finance, required for business use 6 years after Business Year. Corporate Performance Planning and end of Business Year. Administration Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

1.05 CORPORATE PERFORMANCE MANAGEMENT / DATA

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Corporate Performance Director of Finance, end of business year. Year. Data Planning and Performance Reason: Business Use Review Instruction: Delete Folder

of 153 Information Asset Register v2.0 15 1.05 CORPORATE PERFORMANCE MANAGEMENT / DATA REQUESTS

Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Data Requests – Body end of business year. Year. Planning and Performance Reason: Business Use Review Instruction: Delete Folder Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Data Requests – Case end of business year. Year. Planning and Performance Reason: Business Use Review Instruction: Delete Folder Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Data Requests – General end of business year. Year. Planning and Performance Reason: Business Use Review Instruction: Delete Folder

1.05 CORPORATE PERFORMANCE MANAGEMENT / CORPORATE PERFORMANCE PLANNING

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Corporate Performance Director of Finance, end of business year. Year. Target Setting Planning and Performance Reason: Business Use Review Instruction: Delete Folder Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder at end of end of consultation. Consultation. Performance Consultations Planning and Performance Reason: Business Use Review Instruction: Delete Folder Performance Management Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Forecasts Planning and end of business year. Year.

Performance Reason: Business Use Review Instruction: Delete Folder Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Performance Management Director of Finance, end of business year. Year. Quarterly Reviews Planning and Performance Reason: Business Use Review Instruction: Delete Folder

1.05 CORPORATE PERFORMANCE MANAGEMENT / REFERENCE AND TOOLS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end of Director of Finance, required for business use 6 years after Business Year. Corporate Performance Planning and end of Business Year. Tools Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end of Director of Finance, required for business use 6 years after Business Year. Performance Management Planning and end of Business Year. Definitions Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end of Director of Finance, required for business use 6 years after Business Year. Performance Management Planning and end of Business Year. Reference Material Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

1.05 CORPORATE PERFORMANCE MANAGEMENT / REPORTS

Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Annual Report Data end of business year. Year. Planning and Performance Reason: Business Use Review Instruction: Delete Folder Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Annual Review of Director of Finance, end of business year. Year. Corporate Performance Planning and Performance Reason: Business Use Review Instruction: Delete Folder Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Health Report Data end of business year. Year. Planning and Performance Reason: Business Use Review Instruction: Delete Folder Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Individual Performance Director of Finance, end of business year. Year. Data Reports (Restricted) Planning and Performance Reason: Business Use Review Instruction: Delete Folder Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Key Performance Indicator Director of Finance, end of business year. Year. (KPI) Reports Planning and Performance Reason: Business Use Review Instruction: Delete Folder Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Parliamentary Report Data end of business year. Year. Planning and Performance Reason: Business Use Review Instruction: Delete Folder Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Performance Data reports Director of Finance, end of business year. Year. (Restricted) Planning and Performance Reason: Business Use Review Instruction: Delete Folder

of 153 Information Asset Register v2.0 18 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Performance Indicator (PI) Director of Finance, end of business year. Year. Reports Planning and Performance Reason: Business Use Review Instruction: Delete Folder Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Performance Management Director of Finance, end of business year. Year. Body Reports Planning and Performance Reason: Business Use Review Instruction: Delete Folder Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Performance Management Director of Finance, end of business year. Year. Monthly Reports Planning and Performance Reason: Business Use Review Instruction: Delete Folder Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Performance Management Director of Finance, end of business year. Year. Post Reviews Planning and Performance Reason: Business Use Review Instruction: Delete Folder Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Performance Management Director of Finance, end of business year. Year. Quarterly Reports Planning and Performance Reason: Business Use Review Instruction: Delete Folder

of 153 Information Asset Register v2.0 19 1.06 RISK AND AUDIT / FRAUD

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end of required for business use 6 years after Business Year. Fraud Deputy Chief Executive end of Business Year. Review Instruction: Move any documents still Reason: Limitations Act, 1980 being used to new Part. Delete Part.

1.06 RISK AND AUDIT / INTERNAL AUDIT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Archive 6 years after Meridio Action: Close folder when Internal Audit completion of Internal Audit Report. Internal Audit Report complete. Head of Governance Reason: Limitations Act 1980 / Review Instruction: Archive Folder Historical Interest

1.06 RISK AND AUDIT / RISK MANAGEMENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end of required for business use 6 years after Business Year. Risk Management Deputy Chief Executive end of Business Year. Administration Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Risk Management Deputy Chief Executive Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Operations Risk Register end of business year. Year

Reason: Business Use Review Instruction: Delete Folder Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Risk Management end of business year. Year Quarterly Reports Deputy Chief Executive Reason: Business Use Review Instruction: Delete Folder

1.07 APPROVED STRATEGIES, POLICY AND GUIDANCE

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Archive policy or guidance when superseded or obsolete. Meridio Action: None Business Policy and Deputy Chief Executive Guidance Reason: Business Use / Health and Review Instruction: Relocate superseded or Safety at Work Act 1974 / Historical obsolete policies and guidance to the Archive. Interest Retention Period: Archive policy or Meridio Action: None Casework Policy and guidance when superseded or obsolete. Deputy Ombudsman Review Instruction: Relocate superseded or Guidance Reason: Business Use / Historical obsolete policies and guidance to the Archive. Interest Retention Period: Archive strategy Meridio Action: None when superseded or obsolete. Corporate Strategies Head of Governance Review Instruction: Relocate superseded or Reason: Business Use / Historical obsolete policies and guidance to the Archive. Interest Financial Policy and Director of Finance, Retention Period: Archive policy or Meridio Action: None Guidance Planning and guidance when superseded or obsolete.

Review Instruction: Relocate superseded or Performance Reason: Business Use / Historical obsolete policies and guidance to the Archive. Interest Retention Period: Archive guidance Meridio Action: None when superseded or obsolete. HR Guidance Head of HR Operations Review Instruction: Relocate superseded or Reason: Business Use / Historical obsolete policies and guidance to the Archive. Interest Retention Period: Archive policy when Meridio Action: None superseded or obsolete. HR Policy Head of HR Operations Review Instruction: Relocate superseded or Reason: Business Use / Historical obsolete policies and guidance to the Archive. Interest Retention Period: Archive register Meridio Action: None PHSO Register of when superseded or obsolete. Head of Governance Review Instruction: Relocate superseded or Policies Reason: Business Use / Historical obsolete policies and guidance to the Archive. Interest

1.08 FINAL PUBLISHED CORPORATE REPORTS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Archive published Final Published reports 6 years after end of Business Meridio Action: Close folder at end of Business Year. Year Corporate Reports Deputy Chief Executive Reason: Business Use / Historical Review Instruction: Archive folder. Interest

Resource Management Description of assets:

Resource management contains assets relating to accounting, the capital investment strategy development, the management of capital resources financial strategy, policy and guidance development, non-current assets, procurement, resource accounts, tax, national insurance and VST and parliamentary funding settlements.

The assets set out how PHSO manages its financial and capital resources. It includes records relating to all accounting activities such as cash management and banking, budget reviews and financial monitoring as well as to individual procurement activities completed to procure goods and services for PHSO.

Some of the assets in this section contain sensitive corporate information such as costs of procurements or spending within PHSO as well as personal data as there will be records relating to the tax, national insurance and VAT for associate caseworkers and some employees.

Information risks:

Given the sensitivity of data contained within these records, the level of information risk for resource management is considered high. There is potential for internal threat or inappropriate access to the records and much of the information contained within these records would be used for digital continuity. Therefore any loss of records could have an impact on PHSO’s ability to continue in the event of an adverse event.

The risks are mitigated by appropriate and restricted access controls in Meridio and the use of an electronic battlebox as part of the business continuity framework. 2.01 ACCOUNTING

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folders at end of Financial Accounts Payable Director of Finance, end of Financial Year. Year Planning and Performance Reason: Taxes Management Act, 1970 Review Instruction: Delete folders. Retention Period: Destroy 6 years after Meridio Action: Close folders at end of Financial Accounts Receivable Director of Finance, end of Financial Year. Year Planning and Performance Reason: Taxes Management Act, 1970 Review Instruction: Delete folders. Retention Period: Destroy 6 years after Meridio Action: Close folders at end of Financial Banking Director of Finance, end of Financial Year. Year Planning and Performance Reason: Taxes Management Act, 1970 Review Instruction: Delete folders. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 6 years after of Business Year. Banking / Training Director of Finance, end of Business Year. Material Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy 6 years after Meridio Action: Close folders at end of Financial end of Financial Year. Cash Management Director of Finance, Year Planning and Performance Reason: Taxes Management Act, 1970 Review Instruction: Delete folders. Retention Period: Destroy 6 years after Meridio Action: Close folders at end of Financial Financial Accounting Director of Finance, end of Financial Year. Year Planning and Performance Reason: Taxes Management Act, 1970 Review Instruction: Delete folders. 2.02 CAPITAL INVESTMENT STRATEGY DEVELOPMENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folder at end of covering completion of Capital Investment Capital Investment 2007- Director of Finance, period for the Capital Investment Strategy. Strategy. 2010 Development Planning and Performance Review Instruction: Delete folders. Reason: Business Use Retention Period: Destroy 6 years after Meridio Action: Close folder at end of covering completion of Capital Investment Capital Investment 2011- Director of Finance, period for the Capital Investment Strategy. Strategy. 2015 Development Planning and Performance Review Instruction: Delete folders. Reason: Business Use

2.03 FINANCIAL BUDGETING AND REPORTING

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folders at end of Financial 6 Month Budget Review Director of Finance, end of Financial Year. Year Planning and Performance Reason: Business Use Review Instruction: Delete folders. Retention Period: Destroy 6 years after Meridio Action: Close folders at end of Financial 9 Month Budget Review Director of Finance, end of Financial Year. Year Planning and Performance Reason: Business Use Review Instruction: Delete folders.

of 153 Information Asset Register v2.0 26 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folders at end of Financial Financial Comparisons Director of Finance, end of Financial Year. Year Planning and Performance Reason: Business Use Review Instruction: Delete folders. Retention Period: Destroy 6 years after Meridio Action: Close folders at end of Financial Financial Forecasting Director of Finance, end of Financial Year. Year Planning and Performance Reason: Business Use Review Instruction: Delete folders. Retention Period: Destroy 6 years after Meridio Action: Close folders at end of Financial Financial Monitoring – Director of Finance, end of Financial Year. Year Monthly Planning and Performance Reason: Business Use Review Instruction: Delete folders. Retention Period: Destroy 6 years after Meridio Action: Close folders at end of Financial Financial Monitoring – Director of Finance, end of Financial Year. Year Quarterly Planning and Performance Reason: Business Use Review Instruction: Delete folders. Retention Period: Destroy 6 years after Meridio Action: Close folders at end of Financial Budget Setting Director of Finance, end of Financial Year. Year Planning and Performance Reason: Business Use Review Instruction: Delete folders.

2.04 FINANCIAL POLICY AND GUIDANCE DEVELOPMENT

Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Automatic Part closure at end Dear Accounting Officer end of Financial Year. of Financial Year. Planning and Letters (DAO) Performance Reason: Taxes Management Act, 1970 Review Instruction: Delete part.

Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Automatic Part closure at end Dear Finance Director end of Financial Year. of Financial Year. Planning and Letters (MSFD) Performance Reason: Business Use Review Instruction: Delete part. Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Automatic Part closure at end end of Financial Year. of Financial Year. Finance Code Planning and Performance Reason: Business Use Review Instruction: Delete part. Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Automatic Part closure at end Public Expenditure end of Financial Year. of Financial Year. Planning and Survey (PES) Performance Reason: Business Use Review Instruction: Delete part. Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Automatic Part closure at end Travel and Subsistence end of Financial Year. of Financial Year. Planning and Code Performance Reason: Business Use Review Instruction: Delete part.

2.05 FINANCIAL STRATEGY DEVELOPMENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folders when Financial Financial Strategy 2007- Director of Finance, end of Financial Strategy. Strategy period complete 2010 Development Planning and Performance Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folders when Financial Financial Strategy 2011- Director of Finance, end of Financial Strategy. Strategy period complete 2015 Development Planning and Performance Reason: Business Use Review Instruction: Delete folder.

of 153 Information Asset Register v2.0 28 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folders at end of financial Financial Strategy and Director of Finance, end of Financial Year. year. Implementation Group Planning and Performance Reason: Business Use Review Instruction: Delete folder. 2.06 NON-CURRENT ASSETS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folders at end of financial end of Financial Year. Asset Acquisitions Director of Finance, year. Planning and Performance Reason: Taxes Management Act 1970, Review Instruction: Delete folder. Limitations Act 1980 Retention Period: Destroy 6 years after Meridio Action: Close folders at end of financial end of Financial Year. Asset Depreciation Director of Finance, year. Planning and Performance Reason: Taxes Management Act 1970, Review Instruction: Delete folder. Limitations Act 1980 Retention Period: Destroy 6 years after Meridio Action: Close folders at end of financial end of Financial Year. Asset Disposals Director of Finance, year. Planning and Performance Reason: Taxes Management Act 1970, Review Instruction: Delete folder. Limitations Act 1980 Retention Period: Destroy 6 years after Meridio Action: Close folders at end of financial end of Financial Year. Assets under Construction Director of Finance, year. Planning and Performance Reason: Taxes Management Act 1970, Review Instruction: Delete folder. Limitations Act 1980 Physical Verification Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folders at end of financial Planning and Performance end of Financial Year. year.

Reason: Taxes Management Act 1970, Review Instruction: Delete folder. Limitations Act 1980 Retention Period: Destroy 6 years after Meridio Action: Close folders at end of financial end of Financial Year. Relife and Revaluation Director of Finance, year. Planning and Performance Reason: Taxes Management Act 1970, Review Instruction: Delete folder. Limitations Act 1980

2.07 PROCUREMENT MANAGEMENT / CONTRACT MANAGEMENT – FACILITIES

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Automatic Part closure at end Retention Period: Destroy if no longer of Financial Year. required for business use 7 years after Director of Service Business Rates end of Financial Year. Delivery Review Instruction: Move any documents still required as part of the contract to new Part. Reason: Limitations Act, 1980 Delete Part. Meridio Action: Automatic Part closure at end Retention Period: Destroy if no longer of Financial Year. required for business use 7 years after Director of Service Evacuation Chairs end of Financial Year. Delivery Review Instruction: Move any documents still required as part of the contract to new Part. Reason: Limitations Act, 1980 Delete Part. Landlord Director of Service Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Delivery required for business use 7 years after of Financial Year. end of Financial Year. Review Instruction: Move any documents still

of 153 Information Asset Register v2.0 30 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction required as part of the contract to new Part. Reason: Limitations Act, 1980 Delete Part. Meridio Action: Automatic Part closure at end Retention Period: Destroy if no longer of Financial Year. required for business use 7 years after Director of Service Manchester Milk end of Financial Year. Delivery Review Instruction: Move any documents still required as part of the contract to new Part. Reason: Limitations Act, 1980 Delete Part. Meridio Action: Automatic Part closure at end Retention Period: Destroy if no longer of Financial Year. required for business use 7 years after Director of Service Optyma end of Financial Year. Delivery Review Instruction: Move any documents still required as part of the contract to new Part. Reason: Limitations Act, 1980 Delete Part. Meridio Action: Automatic Part closure at end Retention Period: Destroy if no longer of Financial Year. required for business use 7 years after Director of Service PRS Licence end of Financial Year. Delivery Review Instruction: Move any documents still required as part of the contract to new Part. Reason: Limitations Act, 1980 Delete Part. Meridio Action: Automatic Part closure at end Retention Period: Destroy if no longer of Financial Year. required for business use 7 years after Director of Service PVS Licenece end of Financial Year. Delivery Review Instruction: Move any documents still required as part of the contract to new Part. Reason: Limitations Act, 1980 Delete Part. Royal Mail Director of Service Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Delivery required for business use 7 years after of Financial Year. end of Financial Year. Review Instruction: Move any documents still

of 153 Information Asset Register v2.0 31 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction required as part of the contract to new Part. Reason: Limitations Act, 1980 Delete Part. Meridio Action: Automatic Part closure at end Retention Period: Destroy if no longer of Financial Year. required for business use 7 years after Director of Service Trident Niven end of Financial Year. Delivery Review Instruction: Move any documents still required as part of the contract to new Part. Reason: Limitations Act, 1980 Delete Part. Meridio Action: Automatic Part closure at end Retention Period: Destroy if no longer of Financial Year. required for business use 7 years after Director of Service TV Licence end of Financial Year. Delivery Review Instruction: Move any documents still required as part of the contract to new Part. Reason: Limitations Act, 1980 Delete Part.

2.07 PROCUREMENT MANAGEMENT / GPC MANAGEMENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Automatic Part closure at end Retention Period: Destroy if no longer of Financial Year. required for business use 7 years after Director of Finance, Card Agreements end of Financial Year. Planning and Performance Review Instruction: Move any documents still required as part of the contract to new Part. Reason: Limitations Act, 1980 Delete Part. GPC Contract Management Director of Finance, Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Planning and Performance required for business use 7 years after of Financial Year. end of Financial Year. Review Instruction: Move any documents still

Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, GPC Cycle Management end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, GPC Procedures end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, GPC Receipts 2011 end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Taxes Management Act, 1970 being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, GPC Receipts 2012 end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Taxes Management Act, 1970 being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, GPC Statements end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Taxes Management Act, 1970 being used to new Part. Delete Part.

2.07 PROCUREMENT MANAGEMENT / LEARNING AND RESOURCE PROCUREMENT MANAGEMENT

of 153 Information Asset Register v2.0 33 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Delete 7 years after Meridio Action: Close folders at end of financial LRC Subscriptions and end of Financial Year. year. Director of POD Purchases (Annual Folders) Reason: Limitations Act, 1980 Review Instruction: Delete folder.

2.07 PROCUREMENT MANAGEMENT / PPBM ADVICE

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, Comms end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, DCE end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, Finance end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. General Purchasing Director of Finance, Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Planning and Performance required for business use 7 years after of Financial Year. end of Financial Year.

of 153 Information Asset Register v2.0 34 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, HR Ops end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, end of Financial Year. ICT Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, Interpretation Services end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, L&D end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, Legal end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. LGO Director of Finance, Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Planning and Performance required for business use 7 years after of Financial Year.

of 153 Information Asset Register v2.0 35 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Financial Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, Private Office end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, Prompt Payment Advice end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, Service Delivery end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, Transparency Agenda end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

2.07 PROCUREMENT MANAGEMENT / PPBM BUSINESS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Consultancy Director of Finance, Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Planning and Performance required for business use 7 years after of Financial Year.

of 153 Information Asset Register v2.0 36 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Financial Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, Contracts with Individuals end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Director of Finance, Freedom of Information end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Procurement Director of Finance, end of Financial Year. Administration Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Procurement Planning and Director of Finance, end of Financial Year. Savings Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Financial Year. Procurement Returns and Director of Finance, end of Financial Year. PPNs Planning and Performance Review Instruction: Move any documents still Reason: Taxes Management Act, 1970 being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 37 2.07 PROCUREMENT MANAGEMENT / PROCUREMENTS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 7 years after Meridio Action: Close folder(s) when contract end of contract. Procurements Director of Finance, expires. Planning and Performance Reason: Limitations Act, 1980 Review Instruction: Delete folder(s).

2.07 PROCUREMENT MANAGEMENT / PURCHASING

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folder at end of financial Director’s Taxable end of financial year Director of Finance, year. Benefits Planning and Performance (annual folders) Reason: Taxes Management Act, 1970 Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of financial end of financial year Electronic Invoices Director of Finance, year. (annual folders) Planning and Performance Reason: Taxes Management Act 1970, Review Instruction: Delete folder. Limitations Act 1980 Retention Period: Destroy 6 years after Meridio Action: Close folder at end of financial Finance Code and Director of Finance, end of financial year year. Mandates Planning and Performance (annual folders) Reason: Business Use Review Instruction: Delete folder. Interim Staff Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder at end of financial (annual folders) Planning and Performance end of financial year year.

Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of financial Prompt Payment Director of Finance, end of financial year year. (annual folders) Planning and Performance Reason: Taxes Management Act 1970 Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of financial end of financial year Purchase Orders Director of Finance, year. (annual folders) Planning and Performance Reason: Taxes Management Act 1970, Review Instruction: Delete folder. Limitations Act 1980 Retention Period: Destroy 6 years after Meridio Action: Close folder at end of financial end of financial year Purchase Requisitions Director of Finance, year. (annual folders) Planning and Performance Reason: Taxes Management Act 1970, Review Instruction: Delete folder. Limitations Act 1980 Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 6 years after of Financial Year. Director of Finance, Purchasing Administration end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

2.07 PROCUREMENT MANAGEMENT / STATIONERY

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Business cards Director of Finance, Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Planning and Performance required for business use 6 years after of Financial Year. end of Financial Year. Review Instruction: Move any documents still

of 153 Information Asset Register v2.0 39 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 6 years after of Financial Year. Director of Finance, end of Financial Year. File Covers Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 6 years after of Financial Year. Director of Finance, Print Artwork end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 6 years after of Financial Year. Director of Finance, Stationery Database end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 6 years after of Financial Year. Director of Finance, Stationery Expenditure end of Financial Year. Planning and Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

2.07 PROCUREMENT MANAGEMENT / TRAVEL

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Air Travel Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder at end of financial Planning and Performance end of Financial Year. year.

Reason: Taxes Management Act, 1980 Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of financial Car Travel Director of Finance, end of Financial Year. year. Planning and Performance Reason: Taxes Management Act, 1980 Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of financial Redfern Rail Travel Director of Finance, end of Financial Year. year. Planning and Performance Reason: Taxes Management Act, 1980 Review Instruction: Delete folder.

2.08 RESOURCE ACCOUNTS

Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder at end of financial end of Resource Account year. year. Resource Accounts Planning and Performance Reason: Taxes Management Act 1970 Review Instruction: Delete folder.

2.09 TAX, NATIONAL INSURANCE AND VAT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Associate Caseworkers Director of Finance, Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Planning and required for business use 6 years after of Financial Year. Performance end of Financial Year.

of 153 Information Asset Register v2.0 41 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Review Instruction: Move any documents still Reason: Taxes Management Act, 1970 being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Finance, required for business use 6 years after of Financial Year. Employees Planning and end of Financial Year. Performance Review Instruction: Move any documents still Reason: Taxes Management Act, 1970 being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 6 years after Director of Finance, of Financial Year. end of Financial Year. HMRC Inspection Planning and Review Instruction: Move any documents still Performance Reason: Taxes Management Act, 1970; being used to new Part. Delete Part. Value Added Tax Act, 1994 Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Finance, required for business use 6 years after of Financial Year. Internal Correspondence Planning and end of Financial Year. Performance Review Instruction: Move any documents still Reason: Taxes Management Act, 1970 being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Finance, required for business use 6 years after of Financial Year. PAYE Settlement Planning and end of Financial Year. Performance Review Instruction: Move any documents still Reason: Taxes Management Act, 1970 being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 6 years after Director of Finance, of Financial Year. end of Financial Year. Tax Management Planning and Review Instruction: Move any documents still Performance Reason: Taxes Management Act, 1970; being used to new Part. Delete Part. Value Added Tax Act, 1994

of 153 Information Asset Register v2.0 42 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Finance, required for business use 6 years after of Financial Year. VAT Return Planning and end of Financial Year. Performance Review Instruction: Move any documents still Reason: Value Added Tax Act, 1994 being used to new Part. Delete Part. 2.10 TRANSACTIONS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Automatic Part closure at end Director of Finance, end of Financial Year. General Ledger of Financial Year. Planning and Download Reason: Taxes Management Act, 1970 Performance Review Instruction: Delete Part.

2.11 PARLIAMENTARY FUNDING SETTLEMENTS

Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder when financial end of Financial Settlement period. settlement period complete. Settlements Planning and Performance Reason: Business Use Review Instruction: Delete Folder.

2.12 PARLIAMENTARY ESTIMATES

Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder when Annual Parliamentary end of Parliamentary Estimate period. Parliamentary Estimate period complete. Planning and Estimates Performance Reason: Business Use Review Instruction: Delete Folder. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Finance, Parliamentary Estimates required for business use 6 years after of Financial Year. Planning and end of Financial Year. Guidance Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

Estate Management and Business Security Description of assets:

The estate management and business security section contains assets relating to accommodation and facilities, health and safety, business security and business continuity.

The assets set out how PHSO manages its premises and facilities, the physical risks to staff whilst at work, the risks to PHSO business premises, facilities and protectively marked documents and records and the management of risks to PHSO’s continued operation in the event of a disaster.

Some of the assets in this section contain personal data such as security incidents, risk assessments or security vetting. Other assets will contain sensitive corporate information such as those in relation to the business continuity alert system or electronic battlebox.

Information risks:

The overall level of information risk for the assets is considered to be low- medium. Many of the assets are not sensitive and therefore the risks of internal threat or inappropriate use are low.

In addition, none of these records are likely to be transferred outside of PHSO and therefore the risk of information loss during transfer is minimal.

However, as mentioned above, there are some records which contain personal or sensitive corporate data which increases the level of risk. Where appropriate, to manage the risk of internal threat or inappropriate access, access controls have been restricted to specific groups within PHSO.

of 153 Information Asset Register v2.0 46 3.01 Accommodation and Facilities

Management of PHSO’s premises and facilities

3.01 ACCOMMODATION AND FACILITIES / ACCOMMODATION STRATEGY DEVELOPMENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Delete 7 years after Meridio Action: Close folder(s) when Accommodation end of Accommodation Strategy period Director of Service Accommodation Strategy period complete. Strategy Development complete. Delivery (annual folders) Review Instruction: Delete Folder. Reason: Business Use Retention Period: Delete 7 years after Accommodation Meridio Action: Close folder(s) when end of Accommodation Strategy period Strategy Marketing Director of Service Accommodation Strategy period complete. complete. Reports Delivery Review Instruction: Delete Folder. (annual folders) Reason: Business Use Retention Period: Delete 7 years after Meridio Action: Close folder(s) when Accommodation end of Accommodation Strategy period Director of Service Accommodation Strategy period complete. Strategy Plan complete. Delivery (annual folders) Review Instruction: Delete Folder. Reason: Business Use

3.01 ACCOMMODATION AND FACILITIES / ENVIRONMENTAL ISSUES Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. Energy end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Environmental Issues Director of Service required for business use 7 years after of Business Year. Policy and Guidance end of Financial Year. Delivery Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Green Initiatives end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Recycling end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Sustainability end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

3.01 ACCOMMODATION AND FACILITIES / FACILITIES MANAGEMENT

of 153 Information Asset Register v2.0 48 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. CAD end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Car and Bike Parking end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. COSMO end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Desk Instructions and Director of Service required for business use 7 years after of Business Year. end of Financial Year. Guidance Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Facilities Gift Register end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Facilities Management Director of Service required for business use 7 years after of Business Year. end of Financial Year. Photos Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 49 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Facilities Management Director of Service required for business use 7 years after of Business Year. Policy and Guidance end of Financial Year. Delivery Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Inductions end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Keys end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Mailroom end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Meeting Rooms end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Multi-functional Devices end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 50 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end New Starters and Desk Director of Service required for business use 7 years after of Business Year. end of Financial Year. Moves Floor Plans Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Service Delivery Updates end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Service Desk end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Signage and Posters end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Special Works – Millbank Director of Service required for business use 7 years after of Business Year. end of Financial Year. Flood March 2011 Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Special Works – Works in Director of Service required for business use 7 years after of Business Year. end of Financial Year. Progress Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 51 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Storage end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Video Conferencing end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 7 years after of Business Year. Walk Arounds end of Financial Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

3.01 ACCOMMODATION AND FACILITIES / HOUSE COMMITTEE

Millbank Tower House Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Business Director of Service end of Business Year. Year. Committee Delivery (annual folders) Reason: Business Use Review Instruction: Delete Folder. The Exchange House Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Business Director of Service end of Business Year. Year. Committee Delivery (annual folders) Reason: Business Use Review Instruction: Delete Folder.

of 153 Information Asset Register v2.0 52 3.02 Health and Safety

3.02 HEALTH AND SAFETY / ANNUAL REPORTS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 5 years after end of Business Year. Meridio Action: Close folder at end of Business Director of Service Year. Accident Reports Delivery Reason: Reporting of Injuries, Diseases and Dangerous Occurrences Regulations Review Instruction: Delete Folder. 1995 (RIDDOR)

3.02 HEALTH AND SAFETY / FIRE WARDENS AND FIRST AID

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 5 years after of Business Year. Fire Safety and Director of Service end of Business Year. Procedures Delivery Review Instruction: Move any documents still Reason: Health and Safety at Work Act being used to new Part. Delete Part. 1974 Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 5 years after of Business Year. Fire Wardens end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. First Aid Director of Service Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Delivery required for business use 5 years after of Business Year. end of Business Year. Review Instruction: Move any documents still

Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 5 years after of Business Year. First Aiders end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

3.02 HEALTH AND SAFETY / HEALTH AND SAFETY AUDITS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 5 years after Meridio Action: Close folder on completion of Health and Safety Audits Director of Service completion of audit. audit. Delivery Reason: Business Use Review Instruction: Delete Folder.

3.02 HEALTH AND SAFETY / HEALTH AND SAFETY COMMITTEE

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Health and Safety Director of Service Retention Period: Destroy 6 years after Meridio Action: Close folder at end of Business Committee Delivery end of Business Year. Year.

Reason: Safety Representatives and Review Instruction: Delete Folder. Safety Committee Regulations 1977 /Health and Safety (Consultation with Employees)

Regulations 1996

3.02 HEALTH AND SAFETY / HEALTH AND SAFETY GENERAL

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 5 years after of Business Year. Health and Safety Director of Service end of Business Year. Inspections Delivery Review Instruction: Move any documents still Reason: Management of Health and being used to new Part. Delete Part. Safety at Work Regulations 1999 Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Health and Safety Director of Service required for business use 5 years after of Business Year. end of Business Year. Legislation Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Health and Safety Policy Director of Service required for business use 5 years after of Business Year. and Guidance end of Business Year. Delivery Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Health and Safety Director of Service required for business use 5 years after of Business Year. end of Business Year. Report Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 55 3.02 HEALTH AND SAFETY / RISK ASSESSMENTS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer required for business use 5 years after Meridio Action: Automatic Part closure at end Risk Assessments – Director of Service end of Business Year. of Business Year. Asbestos Delivery Reason: Control of Asbestos at Work Review Instruction: Move any documents still Regulations 2002 being used to new Part. Delete Part.

Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 5 years after of Business Year. Director of Service end of Business Year. Risk Assessments – Fire Delivery Review Instruction: Move any documents still Reason: Regulatory Reform (Fire Safety) being used to new Part. Delete Part. Order 2005 Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 5 years after of Business Year. Risk Assessments – First Director of Service end of Business Year. Aid Delivery Review Instruction: Move any documents still Reason: Management of Health and being used to new Part. Delete Part. Safety at Work Regulations 1999 Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 5 years after of Business Year. Risk Assessments – Home Director of Service end of Business Year. worker Delivery Review Instruction: Move any documents still Reason: Management of Health and being used to new Part. Delete Part. Safety at Work Regulations 1999 Risk Assessments – Director of Service Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Manual Handling Delivery required for business use 5 years after of Business Year. end of Business Year.

Review Instruction: Move any documents still Reason: Management of Health and being used to new Part. Delete Part. Safety at Work Regulations 1999 Retention Period: Destroy if no longer required for business use 5 years after Meridio Action: Automatic Part closure at end Risk Assessments – New Director of Service end of Business Year. of Business Year. and Expectant Mothers Delivery Reason: Management of Health and Review Instruction: Move any documents still Safety at Work Regulations 1999 / being used to new Part. Delete Part. Equality Act 2010 Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 5 years after of Business Year. Risk Assessments – Off Director of Service end of Business Year. Site Working Delivery Review Instruction: Move any documents still Reason: Management of Health and being used to new Part. Delete Part. Safety at Work Regulations 1999 Retention Period: Destroy if no longer required for business use 5 years after Meridio Action: Automatic Part closure at end Risk Assessments – Director of Service end of Business Year. of Business Year. Personal Emergency Delivery Evacuation Plan Reason: Management of Health and Review Instruction: Move any documents still Safety at Work Regulations 1999 / being used to new Part. Delete Part. Equality Act 2010 Retention Period: Destroy if no longer required for business use 5 years after Meridio Action: Automatic Part closure at end Risk Assessments – Director of Service end of Business Year. of Business Year. Toilet Provision Delivery Reason: Management of Health and Review Instruction: Move any documents still Safety at Work Regulations 1999 / being used to new Part. Delete Part. Equality Act 2010

of 153 Information Asset Register v2.0 57 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 5 years after of Business Year. Risk Assessments – Director of Service end of Business Year. Workstation Assessment Delivery Review Instruction: Move any documents still Reason: Management of Health and being used to new Part. Delete Part. Safety at Work Regulations 1999 Retention Period: Destroy if no longer required for business use 5 years after Meridio Action: Automatic Part closure at end Risk Assessments – Director of Service end of Business Year. of Business Year. Young Persons and Work Delivery Experience Reason: Management of Health and Review Instruction: Move any documents still Safety at Work Regulations 1999 / being used to new Part. Delete Part. Equality Act 2010

3.02 HEALTH AND SAFETY / TESTING

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer required for business use 5 years after Meridio Action: Automatic Part closure at end end of Business Year. Director of Service of Business Year. Air Quality Testing Reason: Management of Health and Delivery Review Instruction: Move any documents still Safety at Work Regulations 1999 / being used to new Part. Delete Part. Control of Substances Hazardous to Health Regulations 2002 Electrical Testing Director of Service Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Delivery required for business use 5 years after of Business Year. end of Business Year. Review Instruction: Move any documents still

of 153 Information Asset Register v2.0 58 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Reason: Management of Health and being used to new Part. Delete Part. Safety at Work Regulations 1999 Retention Period: Destroy if no longer required for business use 5 years after Meridio Action: Automatic Part closure at end end of Business Year. Director of Service of Business Year. Water Testing Reason: Management of Health and Delivery Review Instruction: Move any documents still Safety at Work Regulations 1999 / being used to new Part. Delete Part. Control of Substances Hazardous to Health Regulations 2002

3.03 BUSINESS SECURITY

3.02 BUSINESS SECURITY / BUSINESS SECURITY ALERTS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 5 years after Meridio Action: Close folder at end of Business Director of Service end of Business Year. Year. Business Security Alerts Delivery Reason: Business Use Review Instruction: Delete Folder.

3.02 BUSINESS SECURITY / BUSINESS SECURITY AWARENESS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Business Security Director of Service Retention Period: Destroy 5 years after Meridio Action: Close folder at end of Business Awareness Delivery end of Business Year. Year.

Reason: Business Use Review Instruction: Delete Folder.

3.02 BUSINESS SECURITY / BUSINESS SECURITY INCIDENTS

Business Security Retention Period: Destroy 5 years after Meridio Action: Close folder at end of Business Director of Service end of Business Year. Year. Incidents Delivery Reason: Business Use Review Instruction: Delete Folder. Individual Business Retention Period: Destroy 5 years after Meridio Action: Close folder once security Director of Service security incident closed. incident completed. Security Incidents Delivery Reason: Business Use Review Instruction: Delete Folder. Retention Period: Destroy 5 years after Meridio Action: Close folder at end of Business Low-Level Business Director of Service end of Business Year. Year. Security Incidents Delivery Reason: Business Use Review Instruction: Delete Folder.

3.02 BUSINESS SECURITY / BUSINESS SECURITY POLICY AND GUIDANCE DEVELOPMENT

Business Security Policy Retention Period: Destroy 5 years after Meridio Action: Close folder at end of Business and Guidance Director of Service end of Business Year. Year. Development Delivery Reason: Business Use Review Instruction: Delete Folder.

of 153 Information Asset Register v2.0 60 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 5 years after Meridio Action: Close folder after Protective end of Protective Marking Scheme Protective Marking Director of Service Marking Scheme project complete. project complete. Scheme Delivery Review Instruction: Delete Folder. Reason: Business Use

3.02 BUSINESS SECURITY / NATIONAL SECURITY VETTING

National Security Retention Period: Destroy 5 years after Meridio Action: Close folder at end of Business Director of Service end of Business Year. Year. Vetting Delivery Reason: Business Use Review Instruction: Delete Folder.

3.02 BUSINESS SECURITY / SECURITY COMMITTEE

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 5 years after Meridio Action: Close folder at end of Business Security Committee Director of Service end of Business Year. Year. Delivery Reason: Business Use Review Instruction: Delete Folder.

of 153 Information Asset Register v2.0 61 3.02 BUSINESS SECURITY / SECURITY PASSES

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 5 years after Meridio Action: Close folder at end of Business Security Passes Director of Service end of Business Year. Year. Delivery Reason: Business Use Review Instruction: Delete Folder.

3.02 BUSINESS SECURITY / SECURITY REPORTS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 5 years after Meridio Action: Close folder at end of Business Security Reports Director of Service end of Business Year. Year. Delivery Reason: Business Use Review Instruction: Delete Folder.

3.02 BUSINESS SECURITY / SECURITY REVIEWS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 5 years after Meridio Action: Close folder at end of Business Security Reviews Director of Service end of Business Year. Year. Delivery Reason: Business Use Review Instruction: Delete Folder.

of 153 Information Asset Register v2.0 62 3.02 BUSINESS CONTINUITY / BUSINESS CONTINUITY MEETINGS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Business Continuity Emergency Co- Retention Period: Destroy 5 years after Meridio Action: Close folder at end of Business Director of Service end of Business Year. Year. ordination Deputies and Delivery Support Team Reason: Business Use Review Instruction: Delete Folder.

Business Continuity Retention Period: Destroy 5 years after Meridio Action: Close folder at end of Business Emergency Co- Director of Service end of Business Year. Year. ordination Team Delivery Reason: Business Use Review Instruction: Delete Folder.

3.02 BUSINESS CONTINUITY / BUSINESS CONTINUITY PLANNING AND PROCEDURES

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 5 years after of Business Year. BCM Exercises end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Business Continuity Alert Director of Service required for business use 5 years after of Business Year. end of Business Year. System Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Business Continuity Director of Service Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Bulletins Delivery required for business use 5 years after of Business Year.

of 153 Information Asset Register v2.0 63 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Business Continuity Director of Service required for business use 5 years after of Business Year. end of Business Year. Framework Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Business Continuity Director of Service required for business use 5 years after of Business Year. end of Business Year. Incidents Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Business Continuity Director of Service required for business use 5 years after of Business Year. Policy and Guidance end of Business Year. Delivery Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 5 years after of Business Year. Business Continuity Risks end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 64 3.02 BUSINESS CONTINUITY / BUSINESS CONTINUITY REVIEWS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 5 years after Meridio Action: Close folder on completion of Business Continuity completion of Business Continuity Director of Service Business Continuity Review. Reviews Review. Delivery (One folder per review) Review Instruction: Delete Folder. Reason: Business Use

3.02 BUSINESS CONTINUITY / DISASTER RECOVERY

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 5 years after of Business Year. Disaster Recovery – ICT end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Disaster Recovery – Director of Service required for business use 5 years after of Business Year. end of Business Year. Telephony Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 5 years after of Business Year. Electronic Battlebox end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

Casework Description of assets:

The casework section contains assets relating to legislation and jurisdiction, casework advice, learning, policy and guidance development, quality, litigation, ombudsman’s casework and panels. This section also contains all records relating to PHSO’s casework which are held, currently, within Visualfiles.

The assets set out how PHSO learns from its complaints, including capturing advice given across a range of themes and subjects, casework knowledge and information management, departmental briefings and quality reviews. They also contain information about PHSO’s jurisdiction and the review of legislation affecting this. The final set of assets in this section relates to legal actions arising from casework or where PHSO is an interested party.

As this section includes individual’s casework records, the majority of records in this section do contain a high level of personal data. The assets which will contain sensitive corporate and personal data relate to judicial reviews and casework litigation.

Information risks:

The information risks relating to the casework section of the corporate file plan are considered to be high overall. As indicated above, this is the main section to contain personal or corporately sensitive data and therefore is more likely to be subject to the risks of inappropriate access or internal threat. Tight access controls within Meridio and Visualfiles should help to mitigate these risks.

of 153 Information Asset Register v2.0 67 VISUALFILES AND HARDCOPY CASE FILES

Although electronic casework documents are stored in Meridio, the casework retention and disposal schedule is different to that for PHSO’s other corporate records as there are two review periods and different actions at each one. The reason for the difference is that there is a huge amount of personal data contained within casework which needs to be managed well in order to comply with the Data Protection Act.

Information Asset Owner: Deputy Ombudsman

Document type Media Supporting Information Up to 14 months: All case file documents Paper/ All casefile documents are retained for 14 months after the last substantive electronic action.

PHSO has defined last substantive action as being:  Issue of a Decision  Issue of an Investigation Report  Decision to close Compliance  Issue of a Review Decision  Issue of a Response to a Data Protection Act (DPA) and/or Freedom Of Information (FOI) request  Documents relating to a Judicial Review (all evidence)  Any signed letter from the Ombudsman/Deputy Ombudsman/Executive Board Member  Issue of a Discontinue letter or a Withdrawn letter

A hold can be placed on a casefile to postpone the first review for the Document type Media Supporting Information following reasons:  A Judicial Review  A FOI/DPA request  Request for a review of our decision  Returning complainant on a premature case  Joint working cases  Cases of specific interest or potential landmark cases  Published cases  A Select Committee Inquiry

All papers on cases of specific interest or potential landmark cases will be retained for 7 years after the last substantive action in their entirety. Such retention will be on the specific approval o the Ombudsman or Deputy Ombudsman who will determine whether a case falls into this category.

In all other cases, the hold will be placed on the file for 6 months, at which point it will be reviewed and released or retained for a further agreed period. All requests for a hold must be made to and approved by the Retention and Disposal Manager or the Information and Records Manager. The first review will take place 14 months after the hold is released.

First review: 14 months from the last substantive action All Visualfiles case data Electronic Retained for 7 years in Visualfiles

Final report or decision letter Paper Scanned and retained electronically for 7 years in Meridio archive. The paper version is destroyed. Documents of Historical Interest Paper Scanned and retained electronically for 7 years in Meridio archive. The paper

of 153 Information Asset Register v2.0 69 Document type Media Supporting Information or Wider Application (HIWA) version is destroyed.

PHSO has defined documents of historical interest or potential wider application as being:  Legal advice (including any Counsel’s opinion) received or obtained whether on jurisdiction or on the subject matter of the complaint  Any other significant professional advice taken into account where such advice has wider application than the case itself  Statements of general principle by the Ombudsman which have a wider significance than the case itself  Explanations by public bodies as to their interpretation of particular legislation, rules or principles, copies of their own internal standards and statements as to what they would expect to see in the administration of the subject matter of the case by way of general approach or specific process  Official information leaflets, internal guidance documents, court judgments, statutory rules or statutory instruments, ministerial directions or Hansard excepts which are central to our determination of the appropriate standard in the case and thus to our decision on the relevant complaint  Any significant correspondence or other final documents relevant to any subsequent review.

All non-case data stored on Electronic Destroyed at 1st review Visualfiles including history items All paper file correspondence Paper Destroyed at 1st review (following extraction and scanning of final report, decision letter or HIWA as above)

of 153 Information Asset Register v2.0 70 Document type Media Supporting Information Second review: 7 years from the last substantive action Basic case data Electronic Retained in perpetuity in Visualfiles.

Basic case data has been defined by PHSO as:  Case number  Name of complainant  Key words  Body complained about  Date opened  Date closed  Case outcome closure code  Complainant addresses and postcodes; and any aggrieved person/s All non-basic case data in Electronic Destroyed at 2nd review Visualfiles Decision letter Electronic Destroyed at 2nd review Final report Electronic Retained in perpetuity in Meridio archive HIWA Electronic Reviewed for decision on whether to retain in perpetuity or destroy Cases of specific interest/ Paper/ Reviewed for decision on whether to retain in perpetuity or destroy potential landmark cases Electronic

Cases are kept for a minimum of 14 months to cover the 12 month period that complainants can request a review of their case under the Human Rights Act, 1998.

of 153 Information Asset Register v2.0 71 4.01 – VISUALFILES CONTENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: When the Visualfiles deletion Retention Period: Destroy folder at 14 script is run it closes the Meridio folder Cases month review. immediately. This automatically schedules the Deputy Ombudsman (one folder per case) folder for deletion. Reason: Business Use Review Instruction: Delete folder.

4.02 LEGISLATION AND JURISDICTION

4.02 LEGISLATION AND JURISDICTION / ANNUAL JURISDICTION REVIEWS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Archive 6 years after Meridio Action: Close folder on completion of completion of Jurisdiction Review. Jurisdiction Review. Jurisdiction Reviews Legal Adviser Reason: Business Use / Historical Review Instruction: Archive whole folder. Interest

4.02 LEGISLATION AND JURISDICTION / PHSO AND ASSOCIATED LEGISLATION Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Notes on Clauses – both required for business use 6 years after of Business Year. Legal Adviser end of Business Year. PCA and HSCA Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Other Legislation required for business use 6 years after of Business Year. Legal Adviser end of Business Year. Affecting PHSO Remit Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 6 years after of Business Year. Updating HSCA Legal Adviser end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 6 years after of Business Year. Updating PCA Legal Adviser end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

4.03 CASEWORK ADVICE

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Clinical Advice Director of Clinical Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Advice required for business use 3 years after of Business Year. end of Business Year. Review Instruction: Move any documents still

Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Legal Advice on Cross- required for business use 6 years after of calendar year. Legal Adviser end of Calendar Year. Cutting Matters Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Legal Advice on HSC Act required for business use 6 years after of calendar year. Legal Adviser end of Calendar Year. Matters Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Legal Advice on PC Act required for business use 6 years after of calendar year. Legal Adviser end of Calendar Year. Matters Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Other Professional required for business use 6 years after of calendar year. Legal Adviser end of Calendar Year. Advice Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 74 4.04 Casework Learning

Information relating to knowledge gathered from cases handled

4.04 CASEWORK LEARNING / CAPTURING CASEWORK LEARNING

Capturing Casework Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Business Director of Outcomes end of Business Year. Year. Learning and Learning (annual folders) Reason: Business Use Review Instruction: Delete Folder. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Casework Keywords and Director of Outcomes required for business use 3 years after of business year. end of Business Year. Themes and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

4.04 CASEWORK LEARNING / CASEWORK CONFERENCE

Casework Conferences Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Director of Outcomes end of conference. conference. (One folder per and Learning confderence) Reason: Business Use Review Instruction: Delete Folder.

of 153 Information Asset Register v2.0 75 4.04 CASEWORK LEARNING / CASEWORK NEWS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Casework News Director of Outcomes required for business use 3 years after of business year. end of Business Year. Administration and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Casework News Current Director of Outcomes required for business use 3 years after of business year. end of Business Year. Editions and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Casework News Final Director of Outcomes required for business use 3 years after of business year. end of Business Year. Edition and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 76 4.05 CASEWORK POLICY AND GUIDANCE / CASEWORK GUIDANCE

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Casework Policy and Director of Outcomes required for business use 3 years after of calendar year. end of Calendar Year. Guidance Administration and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Casework Policy and Director of Outcomes required for business use 3 years after of calendar year. Guidance end of Calendar Year. and Learning Correspondence Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Outcomes required for business use 3 years after of calendar year. Delegation Scheme end of Calendar Year. and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Outcomes required for business use 3 years after of calendar year. Part 1 Introduction end of Calendar Year. and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Outcomes required for business use 3 years after of calendar year. Part 2 Assessment end of Calendar Year. and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Part 3 Investigation Director of Outcomes Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end and Learning required for business use 3 years after of calendar year. end of Calendar Year.

Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Part 4 Complaints About Director of Outcomes required for business use 3 years after of calendar year. end of Calendar Year. Us and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Outcomes required for business use 3 years after of calendar year. Part 5 General Guidance end of Calendar Year. and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

4.05 CASEWORK POLICY AND GUIDANCE / CASEWORK POLICY DEVELOPMENT

Casework Policy Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business Director of Outcomes end of business year. year. Development and Learning (annual folders) Reason: Business Use Review Instruction: Delete Folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business Other Issues Director of Outcomes end of business year. year. (annual folders) and Learning Reason: Business Use Review Instruction: Delete Folder.

of 153 Information Asset Register v2.0 78 4.06 Casework quality

Management of casework quality issues

4.06 CASEWORK QUALITY / CASEWORK COMPLIANCE AND MONITORING

Casework Compliance Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business Director of Outcomes end of business year. year. and Monitoring and Learning Reason: Business Use Review Instruction: Delete Folder.

4.06 CASEWORK QUALITY / CLINICAL ADVICE

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Clinical Advice External Director of Outcomes required for business use 3 years after of business year. end of Business Year. Quality Assurance and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Clinical Advice Quality Director of Outcomes required for business use 3 years after of business year. end of Business Year. Assurance – Restricted and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Clinical Advice Internal Director of Outcomes required for business use 3 years after of business year. end of Business Year. Quality Assurance and Learning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 79 4.06 CASEWORK QUALITY / CASEWORK COMPLIANCE AND MONITORING

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business Quality Framework Director of Outcomes end of business year. year. (annual folders) and Learning Reason: Business Use Review Instruction: Delete Folder.

4.07 CASEWORK LITIGATION

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Casework Litigation required for business use 3 years after of business year. Legal Adviser end of Business Year. Administration Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy 7 years after Meridio Action: Automatic Part closure at end Instructions to Lawyer end of business year. of business year. Legal Adviser or Counsel Reason: Business Use Review Instruction: Delete Part. Meridio Action: Automatic Part closure at end Retention Period: Review 7 years after of business year. end of Business Year. Judgements Legal Adviser Review Instruction: Move any records required Reason: Business Use for permanent preservation to the Archive. Delete Part. Judicial Reviews – Legal Adviser Retention Period: Review 7 years after Meridio Action: Close folder when Judicial Closed Cases end Judicial Review case closed. Review case closed. Archive historical records permanently.

Review Instruction: Move any records required Reason: Business Use/ Historical for permanent preservation to the Archive, Interest Delete the Folder. Retention Period: Review 7 years after Meridio Action: Relocate folder to ‘closed Judicial Reviews – end Judicial Review case closed. cases’ class when Judicial Review case interested party – Legal Adviser Archive historical records permanently. complete. current cases Reason: Business Use Retention Period: Review 7 years after Meridio Action: Relocate folder to ‘closed Judicial Reviews – PHSO end Judicial Review case closed. cases’ class when Judicial Review case Legal Adviser Archive historical records permanently. complete. Defendant - current Reason: Business Use Meridio Action: Automatic Part closure at end Retention Period: Review 7 years after of business year. Non PHSO cases with end of Business Year. Legal Adviser PHSO involvement Review Instruction: Move any documents Reason: Business Use required for permanent preservation to the Archive. Delete Part. Retention Period: Review 7 years after Meridio Action: Close folder when non-Judicial end of non-Judicial Review casework Review casework case closed. Non-judicial review case closed. Archive historical records Legal Adviser permanently. casework litigation Review Instruction: Delete any documents no longer required, move folder to the Archive. Reason: Business Use Possible judicial reviews Legal Adviser Retention Period: Review 7 years after Meridio Action: Close folder when possible end possible Judicial Review case Judicial Review casework case is closed. closed. Archive historical records permanently. Review Instruction: Delete any documents no

of 153 Information Asset Register v2.0 81 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Reason: Business Use longer required, move folder to the Archive.

4.08 Ombudsman’s Casework

Casework handled specifically by the Ombudsman's Office

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Automatic Part closure at end Retention Period: Review 7 years after of business year. Ombudsman’s Casework Ombudsman’s Casework end of Business Year. Archive historical records permanently. Meetings Manager Review Instruction: Move any documents required for permanent preservation to the Reason: Business Use Archive. Delete Part. Meridio Action: Close folder on completion of Retention Period: Apply casework case. Special Cases Ombudsman’s Casework retention and disposal 14 months after case completed. Manager Review Instruction: Apply casework retention and disposal 1st Review (move relevant Reason: Business Use documents to section 4.10) and delete folder.

4.09 Casework Panels

Information relating to decision panels on casework recommendations

of 153 Information Asset Register v2.0 82 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Assessment Panel Director of Customer required for business use 2 years after of Business Year. end of Business Year. Administration Services and Assessment Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Recommendations and Director of Outcomes required for business use 2 years after of Business Year. Outcomes Panel end of Business Year. and Learning Administration Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

4.10 Post-14 month review casework

Information relating to cases after the first retention and disposal review has taken place.

4.10 POST-14 MONTH REVIEW CASEWORK / ONGOING CORRESPONDENCE

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Close folder when Equitable Retention Period: Review 2 years after Life closed. Equitable Life Ombudsman’s Casework end of Equitable Life Case. Correspondence Manager Review Instruction: Move any documents Reason: Business Use required for permanent preservation to the Archive. Delete folder. Ongoing Correspondence Ombudsman’s Casework Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Manager required for business use 2 years after of Business Year. end of Business Year.

of 153 Information Asset Register v2.0 83 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

4.10 POST-14 MONTH REVIEW / RETAINED MATERIAL

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: IRM select appropriate Retention Period: Apply 2nd Review ‘Document Category’ with retention period period 5 years 10 months after 1st applied. Retained material from Head of Information and Review (see casework retention and disposal schedule). Reviewed Case files Records Management Review Instruction: Move any documents required for permanent preservation to the Reason: Business Use Archive.

Change Management Description of assets:

The section on Change Management contains assets relating to projects or initiatives to manage change within PHSO. Currently the main assets in this section relate to Equality and Diversity, Knowledge and Information Management (KIM), Governance and Strategy and Casework Quality.

In terms of Equality and Diversity (E&D), the assets contain records relating to accessibility, E&D groups at PHSO such as the Staff E&D Forum or The Network, E&D Strategy and Equal Pay.

The KIM assets include records of projects and their associated boards relating to changes in information management across PHSO. It is unlikely that any of the assets in this section contain personal data. There may be some sensitive corporate information, particularly in relation to the KIM Programme, but the levels of this are likely to below.

The Governance and Strategy assets relate to projects held at corporate/directorate level involving change to strategy, or short term projects relating to governance issues.

Casework Quality Projects are concerned mostly with improving standards in Operations.

Information risks:

The level of information risk for this section is considered to be low. As indicated above, there is little personal or sensitive corporate data within this area of the file plan and therefore the risks of internal threat or inappropriate use are low. None of this information is transferred externally and therefore the risk of data loss is also minimal.

Given that the assets contained within this section are likely to change as new programmes are introduced, the risk level will need to be monitored and reviewed on a regular basis.

of 153 Information Asset Register v2.0 86 5.01 EQUALITY AND DIVERSITY (E&D)

5.01 EQUALITY AND DIVERSITY / E&D GROUPS AND FORUMS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 3 years after Meridio Action: Close folders at end of financial Dignity at Work Network end of Business Year. year. Director of POD Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folders at end of financial E&D Action Group end of Business Year. year. Director of POD Reason: Business Use Review Instruction: Delete folder. Human Rights Steering Retention Period: Destroy 3 years after Meridio Action: Close folders at end of financial end of Business Year. year. Group Deputy Ombudsman Reason: Business Use Review Instruction: Delete folder. Staff Equality and Director of Finance, Retention Period: Destroy 3 years after Meridio Action: Close folders at end of financial end of Business Year. year. Diversity Forum Planning and Performance Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folders at end of financial The Network end of Business Year. year. Director of O&L Reason: Business Use Review Instruction: Delete folder. 5.01 EQUALITY AND DIVERSITY / E&D STRATEGY AND RESEARCH

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of required for business use 3 years after of Business Year. Accessibility end of Business Year. Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. Disability Good Practice Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. E and D Activity Plans Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end E and D External required for business use 3 years after of Business Year. Director of POD end of Business Year. Reviews Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end E and D Internal required for business use 3 years after of Business Year. Director of POD end of Business Year. Assessments Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. E and D Progress Reports Director of Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Communications required for business use 3 years after of Business Year. end of Business Year.

of 153 Information Asset Register v2.0 88 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of required for business use 3 years after of Business Year. E and D Research end of Business Year. Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end E and D Scheme required for business use 3 years after of Business Year. Director of POD end of Business Year. Memberships Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end E and D Sources of Good Director of required for business use 3 years after of Business Year. end of Business Year. Practice Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of required for business use 3 years after of Business Year. E and D Strategy end of Business Year. Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. Equality Act 2010 Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Equality Analysis Director of POD Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. end of Business Year.

of 153 Information Asset Register v2.0 89 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Improving Workforce required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Diversity Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. Positive Action Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

5.02 KNOWLEDGE AND INFORMATION MANAGEMENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation of Post Implementation Review. KIM Programme Groups Deputy Chief Executive Review. Review Instruction: Delete folder. Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation KIM Programme of Post Implementation Review. Deputy Chief Executive Review. Management Review Instruction: Delete folder. Reason: Business Use KIM Project Boards Deputy Chief Executive Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation of Post Implementation Review.

of 153 Information Asset Register v2.0 90 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Review. Review Instruction: Delete folder. Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation Project – Electronic Director of Health of Post Implementation Review. Review. Working Investigations Review Instruction: Delete folder. Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Project – Integrated completion of Post Implementation of Post Implementation Review. Information Systems Deputy Chief Executive Review. (IIS) Review Instruction: Delete folder. Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation Project – Internet, Director of of Post Implementation Review. Review. Extranet, Intranet (IEI) Communications Review Instruction: Delete folder. Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation Project – Records of Post Implementation Review. Deputy Chief Executive Review. Management (RM) Review Instruction: Delete folder. Reason: Business Use

of 153 Information Asset Register v2.0 91 5.03 GOVERNANCE AND STRATEGY

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Meridio Action: Close folder(s) after completion Retention Period: Destroy 3 years after Corporate Resources of the review. Deputy Chief Executive completion of Review. Reviews 2011-2012 Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of project. of project. Olympics 2012 Deputy Chief Executive Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation Strategic Development Director of of Post Implementation Review. Review. Programme Governance Communications Review Instruction: Delete folder. Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Strategic Development completion of Post Implementation Director of of Post Implementation Review. Programme Governance Review. Communications - Restricted Review Instruction: Delete folder. Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation Director of of Post Implementation Review. Strategic Plan Project Review. Communications Review Instruction: Delete folder. Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation Strategic Plan Project - Director of of Post Implementation Review. Review. Restricted Communications Review Instruction: Delete folder. Reason: Business Use

of 153 Information Asset Register v2.0 92 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation Strategy Refresh Project Director of of Post Implementation Review. Review. 2012 Communications Review Instruction: Delete folder. Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation Strategy Refresh Project Director of of Post Implementation Review. Review. 2012 - Restricted Communications Review Instruction: Delete folder. Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation Director of of Post Implementation Review. Transition 2012 Review. Communications Review Instruction: Delete folder. Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of Post Implementation Transition 2012 - Director of of Post Implementation Review. Review. restricted Communications Review Instruction: Delete folder. Reason: Business Use

5.04 CASEWORK QUALITY PROJECTS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Casefile Structure completion of Review. of the review. Director of O&L Review Reason: Business Use Review Instruction: Delete folder.

of 153 Information Asset Register v2.0 93 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Casework News Re- completion of project. of the project. Director of O&L launch Project Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Customer Service completion of project. of the project. Deputy Ombudsman Strategy Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion completion of project. of the project. Interface Project Director of O&L Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Language, Letters and completion of project. of the project. Director of O&L Reports Project Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Length of Investigations completion of project. of the project. Director of O&L Project Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Premature Assessments completion of Review. of the review. Director of O&L Review Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Resolution Through completion of Review. of the review. Director of O&L Intervention Review Reason: Business Use Review Instruction: Delete folder. Specific Discretion Director of O&L Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Review completion of Review. of the review.

Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Typology of Injustice completion of Review. of the review. Director of O&L Review Reason: Business Use Review Instruction: Delete folder.

5.05 EXTERNAL AFFAIRS PROJECTS AND PROGRAMMES

Cross Government Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Director of completion of Programme. of the programme. Complaints System Communications Programme Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Health Complaints Director of completion of Programme. of the programme. System Programme Communications Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder(s) after completion Working with Parliament Director of completion of Programme. of the programme. Programme Communications Reason: Business Use Review Instruction: Delete folder.

People Management and Development Description of assets:

The section on People Management and Development relates to the way in which PHSO manages and develops staff. It contains assets relating to employee files, employee relations, HR Policy and Guidance, internal communication, investors in people, learning and development, payroll and pensions and recruitment and selection.

Given the nature of the assets, there is a large amount of personal data contained within this section, particularly within employee files and payroll and pensions. Others do not contain personal or sensitive corporate data such as internal communications and learning and development

Information risks:

The level of information risk for this section is considered to be high. As indicated above, there is a large amount of personal data within this area of the file plan and therefore the risks of internal threat or inappropriate use are potentially high.

As a result of the level of risk, the access controls in Meridio are extremely tight and only HR Operations, the Head of Information and Records Management and the Information and Records Manager have access to the relevant HR related areas. These assets will be audited to ensure there is no inappropriate access to the records. Other areas, which do not contain personal data, have greater access as is appropriate to the type of records and the information risks associated with these assets is lower.

of 153 Information Asset Register v2.0 97 6.01 EMPLOYEE FILES

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 100 years Meridio Action: Add employee’s date of birth to from employee’s date of birth. Class metadata. Employee A-Z Head of HR Ops Reason: Pension Administration Review Instruction: Delete folder(s) Retention Period: Destroy 100 years Meridio Action: Add employee’s date of birth to from employee’s date of birth. Class metadata. Ex-Employees Head of HR Ops Reason: Pension Administration Review Instruction: Delete folder(s)

6.02 ORGANISATION DEVELOPMENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Employee Engagement Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Archive final report 5 Meridio Action: Close folder at end of People years after end of strategy; Destroy strategy. People Strategy Director of POD remainder. Review Instruction: Move final report to the Reason: Business Use Archive. Delete folder. Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Archive final report 5 Meridio Action: Close folder at end of People years after end of Survey; Destroy Survey. People Survey Director of POD remainder. Review Instruction: Move final report to the Reason: Business Use Archive. Delete folder.

6.03 Employee Relations

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. end of Business Year. Absence Management Head of HR Ops Review Instruction: Move any documents still Reason: Statutory Sick Pay (General) being used to new Part. Delete Part. Regulations 1982 Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Childcare Voucher required for business use 7 years after of Business Year. Head of HR Ops end of Business Year. Scheme Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Clinical Advice required for business use 7 years after of Business Year. Head of HR Ops end of Business Year. (Employee Relations) Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Contract Issues Head of HR Ops Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year.

of 153 Information Asset Register v2.0 99 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Business Year. Review Instruction: Move any documents still Reason: Limitations Act 1980 being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Disability Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Equality Act 2010 being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Employee Relations – required for business use 7 years after of Business Year. Head of HR Ops end of Business Year. Advice Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Employee Relations – required for business use 7 years after of Business Year. Head of HR Ops end of Business Year. Leave Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Equality and Diversity required for business use 7 years after of Business Year. Head of HR Ops end of Business Year. (Employee Relations) Review Instruction: Move any documents still Reason: Equality Act 2010 being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Family Leave Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Flexible Working Head of HR Ops Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Administration required for business use 7 years after of Business Year.

of 153 Information Asset Register v2.0 100 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Job Evaluations Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Leaving the Office Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Loans and Secondments Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Management required for business use 7 years after of Business Year. Head of HR Ops end of Business Year. Information Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Probation Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. References Head of HR Ops Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year.

of 153 Information Asset Register v2.0 101 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Staff Changes Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Tracker Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Trade Unions Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

6.03 EMPLOYEE RELATIONS / HEALTHY WORKFORCE

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Advice, Awareness and required for business use 7 years after of Business Year. Head of HR Ops end of Business Year. Promotions Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Employee Assistance Head of HR Ops Retention Period: Destroy 7 years after Meridio Action: Close folder when Employee Programmes end of Employee Assistance Programme Assistance Programme contract ceases.

of 153 Information Asset Register v2.0 102 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction contract. Review Instruction: Delete folder(s). Reason: Business Use Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Health Management Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Schemes and required for business use 7 years after of Business Year. Head of HR Ops end of Business Year. Programmes Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

6.03 EMPLOYEE RELATIONS / PDRS ADMINISTRATION

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 7 years after Meridio Action: Close folder when the annual completion of annual end of year PDRS. end of year PDRS has been completed. End of Year PDRS Head of HR Ops Reason: Business Use Review Instruction: Delete folder(s). Retention Period: Destroy 7 years after Meridio Action: Close folder when the annual completion of annual mid year PDRS. mid year PDRS has been completed. Mid Year PDRS Head of HR Ops Reason: Business Use Review Instruction: Delete folder(s). Retention Period: Destroy 7 years after Meridio Action: Close folder when the annual Performance Award award of annual performance awards. performance awards have been completed. Head of HR Ops Nominations Reason: Business Use Review Instruction: Delete folder(s).

of 153 Information Asset Register v2.0 103 6.04 HR POLICY AND GUIDANCE DEVELOPMENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Capability Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Conflict of Interest required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Policy - Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Data Protection required for business use 3 years after of Business Year. (Employees) Policy - Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Dignity at Work Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Disciplinary Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 104 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Equality and Diversity required for business use 3 years after of Business Year. Impact Screening Policy Head of HR Ops end of Business Year. - Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Equality and Diversity required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Policy - Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Family Leave (including required for business use 3 years after of Business Year. Maternity) Policy - Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Flexible Working Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Gifts and Hospitality required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Policy - Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Grievance Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 105 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Healthy Workforce required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Policy - Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Job Evaluation Policy - required for business use 3 years after of Business Year. Consultation & Head of HR Ops end of Business Year. Feedback Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Job Evaluation Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. Learning & Development Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Leave and Working required for business use 3 years after of Business Year. Hours Policy - Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Leaving the Office required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Policy - Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 106 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Pay Flexibility Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Pay Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end PDRS Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Probation Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Recruitment and required for business use 3 years after of Business Year. Appointments Policy - Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Relocation Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 107 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Secondment Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Whistleblowing Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Work Experience Policy - required for business use 3 years after of Business Year. Head of HR Ops end of Business Year. Development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. Z-Timetable Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

6.05 INTERNAL COMMUNICATIONS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction All Staff Event Director of Retention Period: Destroy 3 years after Meridio Action: Close folder after event held. Communications end of all staff event. Review Instruction: Delete folder.

Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder at end of calendar Director of end of calendar year. year. InPHOmation Communications Reason: Business Use Review Instruction: Delete folder. Internal Retention Period: Destroy 3 years after Meridio Action: Close folder at end of calendar Director of end of calendar year. year. Communications Communications Cascade Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of calendar Internal Director of end of calendar year. year. Communications Emails Communications Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of calendar Director of end of calendar year. year. Intranet Communications Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of calendar Director of end of calendar year. year. Intranet Development Communications Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business end of business year. year. Keeping in Touch Head of HR Ops Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business end of business year. year. L and D Communications Director of POD Reason: Business Use Review Instruction: Delete folder.

of 153 Information Asset Register v2.0 109 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 3 years after Meridio Action: Close folder at end of calendar Director of end of calendar year. year. News Alert Communications Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of calendar Director of end of calendar year. year. Staff Briefings Communications Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of calendar Director of end of calendar year. year. Weekly Posters Communications Reason: Business Use Review Instruction: Delete folder.

6.06 INVESTORS IN PEOPLE

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 7 years after Meridio Action: Close folder on completion of IiP assessment. IiP assessment. IiP Assessments Director of POD Reason: Business Use Review Instruction: Delete folder. Retention Period: Archive 7 years after Meridio Action: Close folder on completion of IiP Assessments - Final IiP assessment. IiP assessment. Director of POD Reports Reason: Business Use Review Instruction: Archive folder. IiP Communications and Director of POD Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Resources required for business use 7 years after of Business Year. end of Business Year.

of 153 Information Asset Register v2.0 110 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

6.07 LEARNING AND DEVELOPMENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Away days and team required for business use 7 years after of Business Year. Director of POD end of Business Year. events Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Casework skills training Director of O&L end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Continuing professional required for business use 7 years after of Business Year. Director of POD end of Business Year. development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Equality and Diversity required for business use 7 years after of Business Year. Director of POD end of Business Year. development Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Further education Director of POD Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year.

of 153 Information Asset Register v2.0 111 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end General learning and required for business use 7 years after of Business Year. Director of POD end of Business Year. development activities Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Induction Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Knowledge, Information required for business use 7 years after of Business Year. and Records Director of POD end of Business Year. Management Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. L and D ICT Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Meridio Action: Automatic Part closure at end Retention Period: Destroy 7 years after of Business Year. L AND D Learning end of Business Year. Director of POD Agreement Forms Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Management and Director of POD Retention Period: Destroy if no longer Meridio Action: Close folder at end of calendar leadership required for business use 7 years after year.

of 153 Information Asset Register v2.0 112 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Calendar Year. Review Instruction: Delete folder. Reason: Business Use Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. New caseworker training Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Personal effectiveness Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Talent management Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

6.08 PAYROLL AND PENSIONS

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 7 years after Meridio Action: Close folder after completion of end of pay review. pay review. Pay Reviews Head of HR Ops Reason: Business Use Review Instruction: Delete folder. Payroll Administration Head of HR Ops Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year.

of 153 Information Asset Register v2.0 113 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Business Year. Review Instruction: Move any documents still Reason: Tax Management Act 1970 being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Pensions Administration Head of HR Ops end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

6.09 RECRUITMENT AND SELECTION

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 7 years after Meridio Action: On completion of recruitment completion of campaign. (Ensure campaign, move successful candidate successful candidate documentation is documentation and the job description to their Band A Head of HR Ops in employee folder before destruction) employee folder. Close the folder. Reason: Business Use / Equality Act Review Instruction: Delete folder. 2010 Retention Period: Destroy 7 years after Meridio Action: On completion of recruitment completion of campaign. (Ensure campaign, move successful candidate successful candidate documentation is documentation and the job description to their Band B Head of HR Ops in employee folder before destruction) employee folder. Close the folder. Reason: Business Use / Equality Act Review Instruction: Delete folder. 2010 Band C Head of HR Ops Retention Period: Destroy 7 years after Meridio Action: On completion of recruitment completion of campaign. (Ensure campaign, move successful candidate

of 153 Information Asset Register v2.0 114 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction successful candidate documentation is documentation and the job description to their in employee folder before destruction) employee folder. Close the folder. Reason: Business Use / Equality Act Review Instruction: Delete folder. 2010 Retention Period: Destroy 7 years after Meridio Action: On completion of recruitment completion of campaign. (Ensure campaign, move successful candidate successful candidate documentation is documentation and the job description to their Band D1 Head of HR Ops in employee folder before destruction) employee folder. Close the folder. Reason: Business Use / Equality Act Review Instruction: Delete folder. 2010 Retention Period: Destroy 7 years after Meridio Action: On completion of recruitment completion of campaign. (Ensure campaign, move successful candidate successful candidate documentation is documentation and the job description to their Band D2 Head of HR Ops in employee folder before destruction) employee folder. Close the folder. Reason: Business Use / Equality Act Review Instruction: Delete folder. 2010 Retention Period: Destroy 7 years after Meridio Action: On completion of recruitment completion of campaign. (Ensure campaign, move successful candidate successful candidate documentation is documentation and the job description to their Band E1 Head of HR Ops in employee folder before destruction) employee folder. Close the folder. Reason: Business Use / Equality Act Review Instruction: Delete folder. 2010 Band E2 Head of HR Ops Retention Period: Destroy 7 years after Meridio Action: On completion of recruitment completion of campaign. (Ensure campaign, move successful candidate successful candidate documentation is documentation and the job description to their in employee folder before destruction) employee folder. Close the folder.

Reason: Business Use / Equality Act Review Instruction: Delete folder. 2010 Retention Period: Destroy 7 years after Meridio Action: On completion of recruitment completion of campaign. (Ensure campaign, move successful candidate successful candidate documentation is documentation and the job description to their Band PA Head of HR Ops in employee folder before destruction) employee folder. Close the folder. Reason: Business Use / Equality Act Review Instruction: Delete folder. 2010 Retention Period: Destroy 7 years after Meridio Action: On completion of recruitment completion of campaign. (Ensure campaign, move successful candidate successful candidate documentation is documentation and the job description to their Board recruitment Head of HR Ops in employee folder before destruction) employee folder. Close the folder. Reason: Business Use / Equality Act Review Instruction: Delete folder. 2010 Retention Period: Destroy 7 years after Meridio Action: On completion of recruitment completion of campaign. (Ensure campaign, move successful candidate successful candidate documentation is documentation and the job description to their Clinical advisers Head of HR Ops in employee folder before destruction) employee folder. Close the folder. Reason: Business Use / Equality Act Review Instruction: Delete folder. 2010 Recruitment Head of HR Ops Retention Period: Destroy 7 years after Meridio Action: On completion of recruitment administration completion of campaign. (Ensure campaign, move successful candidate successful candidate documentation is documentation and the job description to their in employee folder before destruction) employee folder. Close the folder.

Reason: Business Use / Equality Act Review Instruction: Delete folder.

2010 Retention Period: Destroy 7 years after Meridio Action: On completion of recruitment completion of campaign. (Ensure campaign, move successful candidate successful candidate documentation is documentation and the job description to their Senior Head of HR Ops in employee folder before destruction) employee folder. Close the folder. Reason: Business Use / Equality Act Review Instruction: Delete folder. 2010

External Communications Description of assets:

Section 7 of the corporate file plan relates to External Communications and includes stakeholder files, stakeholder activities, press and publishing and the external environment.

All correspondence, briefings, presentations and contact with external stakeholders are recorded in this section. Further, all records relating to publications and media branding of PHSO are contained here, together with policy development and analysis of the external environment.

There is little personal data contained within these assets. There may be some sensitive corporate information, particularly in relation to the draft publications, research and policy development.

Information risks:

Given the low levels of personal or corporate data within these assets, the level of information risk is considered to be low. Much of the information is accessible to all staff as the level of internal threat or inappropriate access is considered low.

The main information risk is when records are transferred externally to design agencies or publishing houses for preparation prior to publication. However, this risk is mitigated by use of secure communication methods and contractual agreements with third parties to manage and handle the information securely.

of 153 Information Asset Register v2.0 119 ENGAGE STAKEHOLDER DATABASE

The Engage Stakeholder Database stores the contact details of our stakeholders. It contains a significant number of personal details which need to be carefully managed through regular updating and disposal. The below table lists the types of data stored and the retention and disposal schedule for the data.

Information Asset Owner: Director of Communications

Record Type Data collected Retention Period and Reason Retention and Disposal Action Data Ambassador: Deactivate Organisation when it ceases to exist. Organisation Name Retention Period: Destroy 6 months Organisation Contact after organisation ceases to exist Address Data Administrator: Confirms Organisation Details ceases to exists and deletes organisation after 6 Phone numbers Reason: Business Use months.

Title First name Data Ambassador: Deactivate contact when they leave the organisation. Last name Retention Period: Destroy 6 months Individual Contact Email address after contact has left organisation. Data Administrator: Confirms contact has left Details Job function the organisation and deletes contact after 6 Reason: Business Use Organisation months. Address Phone numbers

7.01 STAKEHOLDER FILES Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 3 years after Meridio Action: Close folder after completion of Stakeholder database Director of PIR. PIR. project Communications Reason: Business Use Review Instruction: Delete folder. Meridio Action: Automatic Part closure at end Retention Period: Destroy if no longer of Business Year. Director of required for business use 7 years after Stakeholders A-Z end of Business Year. Review Instruction: Move any documents still Communications being used to new Part. Delete Part. Move any Reason: Business Use documents not being used but considered to be of historical interest to the Archive.

7.02 Stakeholder activities

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business External Presentations Director of end of business year. year. and Talks Communications Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of required for business use 3 years after of Business Year. Health Liaison Visits end of Business Year. Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Parliamentary Liaison Director of Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Visits Communications required for business use 3 years after of Business Year. end of Business Year. Review Instruction: Move any documents still

Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business PHSO Stakeholder Director of event. year. Events Communications Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business Stakeholder – Corporate Director of end of business year. year. Queries Communications Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Stakeholder Director of required for business use 3 years after of Business Year. end of Business Year. Administration Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

7.03 PRESS AND PUBLISHING

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of required for business use 3 years after of Calendar Year. Branding end of calendar Year. Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Digital Communications Director of Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Communications required for business use 3 years after of Calendar Year. end of calendar Year. Review Instruction: Move any documents still

Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of required for business use 3 years after of Calendar Year. Image library end of calendar Year. Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of required for business use 7 years after of Calendar Year. Leaflets and forms end of calendar Year. Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of required for business use 3 years after of Calendar Year. Media end of calendar Year. Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Archive final published report 7 years after Meridio Action: Close folder on publication. Press and published Director of publication, destroy all other reports Communications documentation. Review Instruction: Move final published report to Archive. Delete folder. Reason: Business Use Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of required for business use 3 years after of Calendar Year. Publication scheme end of calendar Year. Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Social Media Director of Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Communications required for business use 3 years after of Calendar Year.

of 153 Information Asset Register v2.0 123 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of calendar Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

7.04 EXTERNAL ENVIRONMENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end External environment Director of required for business use 3 years after of Calendar Year. end of calendar Year. analysis Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of required for business use 3 years after of Calendar Year. External relations end of calendar Year. Communications Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Archive policy 7 Meridio Action: Close folder on policy Ombudsman’s Policy years after policy complete. completion. MP filter Manager Reason: Business Use Review Instruction: Move folder to the archive. Retention Period: Archive policy 7 Meridio Action: Close folder on policy Ombudsman’s Policy years after policy complete. completion. Policy development Manager Reason: Business Use Review Instruction: Move folder to the archive. Research and feedback Director of Finance, Retention Period: Archive final Meridio Action: Close folder on publication. Planning and published report 7 years after Performance publication, destroy all other Review Instruction: Move final published report documentation. to archive. Delete folder.

Reason: Business Use

Information Management Description of assets:

The penultimate section of the corporate file plan is information management and contains assets relating to the management, preservation, protection and reporting of PHSO’s physical and electronic information.

Specifically, the assets in this section relate to the Historical Volumes project, Freedom of Information (FOI) and Data Protection (DP), information management policy and guidance development, information and communications technology administration, information security, learning and resource centre management and information requests.

Some of the assets in this section contain sensitive corporate data particularly in relation to management of PHSO’s information technology, information security and FOI/DP.

Information risks:

The level of information risk is considered to be medium overall, although some assets within the ICT and information security areas would be considered a high risk. Should information in these areas suffer from inappropriate access or internal threat, there would be a potential impact on the internal systems and PHSO’s ability to continue its work. To mitigate these risks, the access controls are tightly restricted and access will be audited to ensure the mitigating actions are sufficient.

In addition, the assets within information and records management include the casework archive which contains electronic versions of final reports, decisions and any records of historical interest or wider application. As these contain personal data, access to these assets will need to reflect access to Visualfiles and regular access audits will confirm that this risk continues to be mitigated.

of 153 Information Asset Register v2.0 127 8.01 HISTORICAL VOLUMES

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Archive final Meridio Action: Close folder on completion of published landmark reports 3 years the Historical Volumes project. Historical Volumes - Head of Information and after completion of project, destroy all other documentation. Landmarks Records Management Review Instruction: Move final published reports to the Archive. Delete folder. Reason: Business Use Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Historical Historical Volumes - Head of Information and end of Historical Volumes project. Volumes project. Management Records Management Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Historical Historical Volumes - Head of Information and end of Historical Volumes project. Volumes project. Principles Records Management Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Historical Historical Volumes - Head of Information and end of Historical Volumes project. Volumes project. Stakeholder Engagement Records Management Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Historical Historical Volumes - Head of Information and end of Historical Volumes project. Volumes project. Statute Volumes Records Management Reason: Business Use Review Instruction: Delete folder. 8.02 FREEDOM OF INFORMATION / DATA PROTECTION

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. FOI/DP Articles Legal Adviser end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end FOI/DP Examples and required for business use 7 years after of Business Year. Legal Adviser end of Business Year. Briefing Notes Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end FOI/DP External required for business use 7 years after of Business Year. Legal Adviser end of Business Year. Guidance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end FOI/DP External required for business use 7 years after of Business Year. Legal Adviser end of Business Year. Training Material Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Meridio Action: Automatic Part closure at end Retention Period: Destroy if no longer of Business Year. FOI/DP Internal required for business use 7 years after Legal Adviser end of Business Year. Guidance Review Instruction: Move any documents still being used to new Part. Delete Part. FOI/DP Legal Advice & Legal Adviser Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Case Law required for business use 7 years after of Business Year. end of Business Year.

of 153 Information Asset Register v2.0 129 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end FOI/DP Reports to EB & required for business use 7 years after of Business Year. Legal Adviser end of Business Year. briefings to senior staff Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. FOI/DP Reviews Legal Adviser end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. FOI/DP Request Log Legal Adviser end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end ICO and Tribunal required for business use 7 years after of Business Year. Legal Adviser end of Business Year. Decisions Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

8.03 INFORMATION MANAGEMENT POLICY AND GUIDANCE DEVELOPMENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction ICT Policy and Guidance Director of Service Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Development Delivery required for business use 3 years after of Business Year.

of 153 Information Asset Register v2.0 130 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of Information Promise Information Promise end of Information Promise project. Information Promise project. Project Project Manager Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Records management Head of Information and required for business use 3 years after of Business Year. end of Business Year. policy and guidance Records Management Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

8.04 INFORMATION AND COMMUNICATIONS TECHNOLOGY ADMINISTRATION

8.04 INFORMATION AND COMMUNICATIONS TECHNOLOGY ADMINISTRATION / ICT MANAGEMENT AND PERFORMANCE

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. ++PHSO Announcements end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. Client Hardware end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 131 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. ICT Infrastructure end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end ICT Manchester Director of Service required for business use 6 years after of Business Year. end of Business Year. performance Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end ICT Strategy Director of Service required for business use 6 years after of Business Year. end of Business Year. Development Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. ICT Work In Progress end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. Internet Use and Speed end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. Remote Working end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 132 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Security and System Director of Service required for business use 6 years after of Business Year. end of Business Year. Controls Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end System Management Director of Service required for business use 6 years after of Business Year. end of Business Year. Documents Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. Telephony end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

8.04 INFORMATION AND COMMUNICATIONS TECHNOLOGY ADMINISTRATION / ICT SYSTEMS, SOFTWARE AND SERVICE ADMINISTRATION

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folder when system Director of Service system ceases. ceases. Accelerator Delivery Reason: Business Use Review Instruction: Delete folder. Albacs Director of Service Retention Period: Destroy 6 years after Meridio Action: Close folder when system system ceases. ceases.

Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when system Director of Service system ceases. ceases. Analyst Financials Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when contract Director of Service contract expires. expires. Blackberry Devices Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when contract Director of Service contract expires. expires. Capita Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when system Director of Service system ceases. ceases. DB Forms Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when software Director of Service software ceases. ceases. Google Search Appliance Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when system Director of Service system ceases. ceases. HiPath ProCentre Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when system Director of Service system ceases. ceases. HR Pro Delivery Reason: Business Use Review Instruction: Delete folder.

of 153 Information Asset Register v2.0 134 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 6 years after Meridio Action: Close folder when system Director of Service system ceases. ceases. ICT Audio Visual Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when system Director of Service system ceases. ceases. Meridio Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when system Director of Service system ceases. ceases. Microsoft Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when system Director of Service system ceases. ceases. Pentaho Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when system Director of Service system ceases. ceases. Printers Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when system Director of Service system ceases. ceases. Real Asset Management Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when system Director of Service system ceases. ceases. Sage Delivery Reason: Business Use Review Instruction: Delete folder. Sharepoint Director of Service Retention Period: Destroy 6 years after Meridio Action: Close folder when system Delivery system ceases. ceases.

Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when contract Director of Service contract expires. expires. SPSS Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when contract Director of Service contract expires. expires. Virgin Media Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when software Director of Service software ceases. ceases. VMWare Delivery Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder when software Director of Service software ceases. ceases. WebSense Delivery Reason: Business Use Review Instruction: Delete folder.

8.04 INFORMATION AND COMMUNICATIONS TECHNOLOGY ADMINISTRATION / INTRANET AND WEBSITE

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. Intranet Development end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

of 153 Information Asset Register v2.0 136 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. Website Development end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

8.04 INFORMATION AND COMMUNICATIONS TECHNOLOGY ADMINISTRATION / VISUALFILES

Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder when Visualfiles Visualfiles ceases. ceases. Awaiting Release Planning and Procurement Reason: Business Use Review Instruction: Delete folder. Visualfiles Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder when Visualfiles Visualfiles ceases. ceases. Administration and Planning and Support Procurement Reason: Business Use Review Instruction: Delete folder. Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder when Visualfiles Visualfiles Release Visualfiles ceases. ceases. Planning and (number) Procurement Reason: Business Use Review Instruction: Delete folder.

of 153 Information Asset Register v2.0 137 8.04 INFORMATION AND COMMUNICATIONS TECHNOLOGY ADMINISTRATION / VISUALFILES USERGROUP

Director of Finance, Retention Period: Destroy 6 years after Meridio Action: Close folder at end of business Visualfiles User Group end of business year. year. Planning and (annual folders) Procurement Reason: Business Use Review Instruction: Delete folder.

8.05 INFORMATION SECURITY

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. GSI Authorisation end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. Information Assurance end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Service required for business use 6 years after of Business Year. Penetration Testing end of Business Year. Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Security issues and their Director of Service Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 6 years after of Business Year.

of 153 Information Asset Register v2.0 138 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Business Year. impact on operations Delivery Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. 8.06 Learning and Resource Centre Management

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. Copyright and Licensing Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Limitations Act 1980 being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end E-Library - Guidance - required for business use 3 years after of Business Year. Director of POD end of Business Year. Maintenance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end LRC Access External required for business use 3 years after of Business Year. Director of POD end of Business Year. Information Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 7 years after of Business Year. LRC Catalogues-Listings Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. LRC Guides and Director of POD Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Handouts required for business use 3 years after of Business Year. end of Business Year.

of 153 Information Asset Register v2.0 139 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. LRC Labels and Signage Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. LRC Newsletter Articles Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. LRC Policies Guidelines Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. LRC Posters and Screens Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end LRC Promotions and required for business use 3 years after of Business Year. Communications Director of POD end of Business Year. Planning Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. LRC Services - LGO Director of POD Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. end of Business Year.

of 153 Information Asset Register v2.0 140 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end LRC Services - required for business use 3 years after of Business Year. Director of POD end of Business Year. Manchester Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. LRC Specific Events Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

8.07 Information requests

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end External data required for business use 3 years after of Business Year. Director of POD end of Business Year. information requests Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Information Requests - required for business use 7 years after of Business Year. Director of POD end of Business Year. Copyright Forms Review Instruction: Move any documents still Reason: Limitations Act 1980 being used to new Part. Delete Part. Information Requests Director of Finance, Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Reporting Planning and required for business use 3 years after of Business Year.

of 153 Information Asset Register v2.0 141 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Business Year. Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Director of Finance, Internal data required for business use 3 years after of Business Year. Planning and end of Business Year. information requests Performance Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end LRC Administration - required for business use 3 years after of Business Year. Director of POD end of Business Year. Information Requests Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. LRC Requests Director of POD end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end LRC Responses Sent - required for business use 3 years after of Business Year. Director of POD end of Business Year. Health Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end LRC Responses Sent - required for business use 3 years after of Business Year. Director of POD end of Business Year. LGO Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. LRC Responses Sent - Director of POD Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Other required for business use 3 years after of Business Year.

of 153 Information Asset Register v2.0 142 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end LRC Responses Sent - required for business use 3 years after of Business Year. Director of POD end of Business Year. Parliamentary Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

8.08 INFORMATION AND RECORDS MANAGEMENT

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business LIRA Network Head of Information and end of business year. year. Records Management Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business Head of Information and end of business year. year. Managing Meridio Records Management Reason: Business Use Review Instruction: Delete folder. Records Management Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business Head of Information and end of business year. year. Advice, Guidance and Records Management Enquiries Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of business Records Management Head of Information and end of business year. year. Audit and Compliance Records Management Reason: Business Use Review Instruction: Delete folder.

of 153 Information Asset Register v2.0 143 8.08 INFORMATION AND RECORDS MANAGEMENT / MANAGING PAPER FILES

Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Monitoring File Requests Head of Information and required for business use 6 years after of Business Year. end of Business Year. Records Management Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end Head of Information and required for business use 6 years after of Business Year. TNT Asset Lists end of Business Year. Records Management Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of business Head of Information and end of business year. year. TNT Enquiries 2011-2012 Records Management Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of business Head of Information and end of business year. year. TNT Enquiries 2011-2012 Records Management Reason: Business Use Review Instruction: Delete folder.

8.08 INFORMATION AND RECORDS MANAGEMENT / MANAGING RETENTION AND DISPOSAL

of 153 Information Asset Register v2.0 144 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business Head of Information and end of business year. year. Archive Management Records Management Reason: Business Use Review Instruction: Delete folder. Retention Period: Archive 3 years after Meridio Action: Close folder at end of business end of business year. File Destruction Head of Information and year. Certificates Records Management Reason: Business Use / Destruction Review Instruction: Archive folder. Evidence Retention Period: Destroy 6 years after Meridio Action: Close folder at end of business Head of Information and end of business year. year. File Holds Records Management Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business Locating and Sourcing Head of Information and end of business year. year. Files Records Management Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy 3 years after Meridio Action: Close folder at end of business R&D Administration and Head of Information and end of business year. year. Planning Records Management Reason: Business Use Review Instruction: Delete folder.

Team Administration Description of assets:

This section of the corporate file plan contains the team administration areas. Here, each team has an area for records relating to its own correspondence, administration, finance, planning, performance and meetings or away days. There is likely to be substantial personal data contained within these assets for the staff members within the team. However, there should not be any corporate data as this should be contained within the other sections of the file plan.

Information risks:

Given the personal data contained within these assets, the level of information risk is considered to be high. Access controls restrict access to these assets either to the management teams or staff within the team as appropriate.

of 153 Information Asset Register v2.0 147 Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. Team administration Team director/ manager end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. Team correspondence Team director/ manager end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy 6 years after Meridio Action: Close folder at end of business end of business year. year. Team finance Team director/ manager Reason: Business Use Review Instruction: Delete folder. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. Meetings and away days Team director/ manager end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. Team planning Team director/ manager end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Team performance Team director/ manager Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. Information Asset Information Asset Owner Retention Period and Reason Meridio Action and Review instruction end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part. Retention Period: Destroy if no longer Meridio Action: Automatic Part closure at end required for business use 3 years after of Business Year. Team staffing Team director/ manager end of Business Year. Review Instruction: Move any documents still Reason: Business Use being used to new Part. Delete Part.

PHSO Archive Description of assets:

This section of Meridio contains all records selected for permanent preservation, as instructed by the retention schedules for sections 1-9 of the corporate fileplan.

When assets are acquisitioned into the PHSO Archive, ownership transfers to the Head of Information and Records Management. There will be personal data contained within section ARCH 1 CASEWORK.

Information risks:

Given the personal data contained within ARCH 1, the level of information risk is considered to be high. Access controls restrict access to this section. Tight access controls within Meridio and Visualfiles should help to mitigate these risks. For the purpose of external access, all records are assumed ‘closed’ unless requested under FOI or Data Protection legislation and the appropriate consideration to release is given. All hardcopy archived material is scanned and stored on Meridio, with most originals destroyed. Scanned images are saved in PDF/A format to ensure their digital preservation and lower the risk of information loss through inaccessibility.

of 153 Information Asset Register v2.0 151 PHSO ARCHIVE

Series Sub-Series ARC 1 CASEWORK ARC 1.01 BASIC CASE DATA

ARC 1.02 INVESTIGATION REPORTS

ARC 1.03 SPECIFIC INTEREST/LANDMARK CASES

ARC 1.04 CASEWORK POLICY AND GUIDANCE

ARC 1.05 CASEWORK LITIGATION

ARC 1.06 CASEWORK QUALITY AND MANAGEMENT

ARC 1.07 OUTCOMES FROM OUR CASEWORK ARC 2 LEGISLATION AND ARC 2.01 PCS JURISDICTION MATTERS JURISDICTION ARC 2.02 HSC JURISDICTION MATTERS ARC 2.03 JURISDICTION REVIEWS AND LEGISLATIVE REFORM ARC 2.04 ACCESS TO OFFICIAL INFORMATION AND ANHSI ARC 3 GOVERNANCE AND ARC 3.01 GOVERNANCE STRATEGIC MANAGEMENT ARC 3.02 CORPORATE MEETINGS

ARC 3.03 STRATEGIC AND BUSINESS PLANNING

ARC 3.04 RISK AND AUDIT

ARC 3.05 OFFICE ACCREDITATION ARC 3.06 ORGANISATIONAL CHANGE AND OFFICE REVIEWS ARC 4 EXTERNAL ARC STAKEHOLDERS STAKEHOLDERS ARC 5 PUBLICATIONS AND ARC 5.01 REPORTS TO PARLIAMENT PRESS ARC 5.02 RESOURCE ACCOUNTS ARC 5.03 OFFICE LEAFLETS AND PUBLICITY MATERIAL ARC 5.04 ARTICLES AND SPEECHES Series Sub-Series

ARC 5.05 PUBLICATION POLICY AND PRACTICE

ARC 5.06 PRESS CUTTINGS

ARC 5.07 SPECIAL EVENTS ARC 6 RESEARCH AND ARC 6.01 AWARENESS AND SATISFACTION SURVEYS FEEDBACK ARC 6.02 PEOPLE MANAGEMENT AND DEVELOPMENT RELATED ARC 6.03 DIRECT ACCESS TO PCA ARC 7 NON-CASEWORK ARC – BUSINESS POLICY AND GUIDANCE POLICY AND GUIDANCE ARC – FINANCIAL POLICY AND GUIDANCE ARC – FREEDOM OF INFORMATION AND DATA PROTECTION ARC – HR POLICY AND GUIDANCE

ARC – OFFICE CIRCULARS

ARC – OFFICE PROCEDURES (GENERAL)

ARC – RECORDS MANAGEMENT

of 153 Information Asset Register v2.0 153