Records guidance is mostly written for institutions with registries, records officers and statutory obligations. Applied to a fifty-person business it reads as overwhelming, and the usual response is to do nothing until a dispute or an inspection forces the issue.
A proportionate starting point is narrower. Three things cover most of the exposure: access control over HR and finance material, a retention rule that is actually applied, and reliable capture of contracts so they are not living in personal drives and email.
Access control first, because it is the cheapest risk reduction available. Employment files, payroll and disciplinary records are personal data with real sensitivity, and in most small organisations they sit on a shared drive that half the company can open.
Retention second, because without a rule nothing is ever destroyed and the volume compounds. And contracts third, because the document you cannot produce during a dispute or a due diligence exercise is almost always a contract or its amendment. A full records programme can follow later, if the organisation grows into needing one.
Working through this in your own institution? We can look at what you hold and come back with a structured next step.
Request a Consultation
Comments0
No comments yet. If this raised a question about your own records, add it below.