Policy on Use, Retention, and Deletion of University Records

Policy Number: 704

University Records and Information Systems

The permanent link for this policy is: https://policies.northeastern.edu/policy704/

I. Purpose and Scope

This policy and its implementing procedures help the university meet its obligations under various laws and regulations on the use, retention, and deletion of specific University Records; reduce the risk of unauthorized access to confidential University Records; and optimize the use of storage space while minimizing the associated cost.

This policy applies to all University Records, and to all members of the Northeastern community who store, manage, or maintain University Records.

II. Definitions

University Record means any document, data, or other recorded information created or received by Northeastern in the course of university business. These records can exist in hard copy (such as paper, photographs, microfiche, or phonographs) or digital form (such as e-mail, Teams or Zoom messages, texts, chats, and other data stored in IT tools, applications, and databases). Some examples of University Records include, without limitation: employee files, student records, research proposals and related documentation, contracts, meeting minutes, correspondence, memoranda, financial records, policies and similar standards, marketing materials, drawings, and maps.

Official Repository means the repository for which a university department has primary responsibility to maintain specific University Records. The department is designated as having responsibility for retention and timely destruction or transfer to the University Archives of particular types of official University Records (as applicable). The department’s administrative manager or a designee is responsible for handling any Official Repository for which they are assigned ownership in accordance with this policy. 

Record Hold means any of the three following requests issued by the Office of the General Counsel (OGC) to identify, collect, or preserve University Records that relate in any way to:  

1. an ongoing or reasonably anticipated subpoena, court order, discovery order, government audit, lawsuit, government investigation, or other legal proceeding (“Litigation Hold”);
2. an investigation of an allegation, or reasonable suspicion, of misconduct, including, but not limited to, a violation of law, regulation, or Northeastern policy (“Investigation Hold”); or
3. the need to preserve an e-mail or other IT system account or record for a certain period, including, for example, in the event of voluntary and involuntary departures, leaves of absence, suspensions, or an internal audit (“Continuity Hold”).

III. Policy

A. General Obligations

University Records may be used only for approved university purposes and by authorized members of the university community. During the term of use, University Records must be handled in accordance with university security and privacy policies and standards, including, without limitation, the Policy on Information Technology System Security, the Policy on Appropriate Use of Computer and Network Resources, the Policy on Protecting Confidential Information, the Data Classification Guidelines, and the policies governing student privacy and employee privacy. When University Records are no longer needed, are of no value (including historic value, if applicable), or their retention is no longer required as set forth below, they must be securely destroyed or deleted.

B. Record Retention Schedule

Notwithstanding the foregoing, Northeastern must retain certain types of University Records for specific periods of time. These records and their minimum and maximum retention periods are set forth in the university’s Record Retention Schedule. 

The university has designated Official Repositories for University Record maintenance. Departments with primary responsibility for specific records are designated as Official Repositories and are responsible for regularly consulting the Record Retention Schedule and implementing its retention and deletion requirements. Note that copies made of University Records are subject to the same deletion period as the original record. The department that maintains the Official Repository is responsible for ensuring that any department or function that receives a copy of a University Record also implements the process to delete the record at the end of the applicable retention period. 

Anyone covered by this policy who believes that a local country requirement requires a University Record to be retained for a period longer than currently specified in the Record Retention Schedule should contact the OGC at privacy@northeastern.edu.

C. Record Holds

Members of the Northeastern community may receive a Record Hold request from the OGC. Someone who receives such a request, until they are otherwise instructed, must not dispose of the identified record even if it would otherwise be disposed of in accordance with the Record Retention Schedule or would not otherwise be required to be retained by the Record Retention Schedule. 

Instead, appropriate steps must be taken to preserve the record and ensure it is not destroyed or altered in any way until the OGC conveys in writing that the Record Hold has been lifted. The OGC must be alerted if anyone subject to this policy is aware of records responsive to a Record Hold that may be stored in an Official Repository they do not own or control. Note that destroying or altering a University Record subject to a Record Hold is a violation of the university’s Code of Ethical Conduct and may subject Northeastern (and the destroyer or alterer personally) to civil or criminal penalties.

In certain cases, members of the Northeastern community have an obligation to preserve University Records even before the OGC issues a Record Hold notice. If anyone covered by this policy believes that a University Record has become subject to (or may in the future become subject to) a subpoena, court order, discovery order, government audit, lawsuit, government investigation, or other legal proceeding, they must notify the OGC immediately.

See the University Policies home page for important information on disciplinary and other actions that can result from violating this policy.

IV. Additional Information

N/A

V. Contact Information

For questions about document-retention periods on the document-retention schedule, or questions about records management and disposition, please contact the Records Management Team. 

For questions about a Record Hold, please contact the OGC at +1 617-373-2157 or office_of_the_general_counsel@northeastern.edu.