REG - 01.04.2 University Record Retention and Disposition Schedule Regulation

1. Purpose

1.1 State law requires agencies, including North Carolina Central University (“NCCU” or the “University”), to retain Public Records and prohibits their destruction except in accordance with the guidelines established by the North Carolina Department of Natural and Cultural Resources (DNCR). The DNCR has approved a University General Records Retention and Disposition Schedule ("University General Schedule") that governs the destruction or other disposition of University records.

1.2 The University General Schedule may be supplemented by campus-wide schedules and individual unit specific schedules ("Unit Specific Addenda") submitted to the DNCR pursuant to the procedures outlined in this regulation.

1.3 The purpose of this Regulation is to ensure compliance of NCCU personnel with the University General Schedule and applicable state and federal laws related to those records.

2. Scope

This regulation applies to all university personnel and covers all records, regardless of form, made or received, in connection with the transaction of university business.

3. Definitions

3.1 "Public Record" means all documents, papers, letters, maps, books, photographs, films, sound recordings, electronic data-processing records such as Email and other electronic documents, magnetic or other tapes, electronic data-processing records, artifacts or other documentary material, regardless of physical form or characteristics, made or received pursuant to law or ordinance in connection with the transaction of public business by any agency of North Carolina government or its subdivisions. Personal records such as personal email messages do not constitute public records. (North Carolina General Statute §132-1).

3.2 "University Personnel" includes all employees of the university whether permanent, temporary, full-time or part-time, faculty, staff, administrators, student employees and agents of the university (including volunteers but not including independent contractors) to the extent they are acting within the scope of their agency authority.

3.3 "Unscheduled Record" means any record not listed in a retention and disposition schedule or unit specific schedule approved by the Chancellor, Office of Legal Affairs, University Archivist and DNCR.

3.4 “Historical Value" means records that have administrative, legal, fiscal or evidential importance as well as documenting significant events, actions, decisions, conditions, relationships and similar developments.

3.5 “Public Record with Short-Term Value" means those records possessing only brief administrative, fiscal, legal, research or reference value. This category of record includes, but is not limited to, the following: reservations, routing slips, facsimile cover sheets, and those records that do not contain information necessary to conduct official business, meet statutory obligations, carry out administrative functions, or meet organizational objectives.

3.6. “Computer system” references Information Technology Services (ITS) server-based computer systems and the data stored on them, which must be periodically copied and preserved to ensure continued computer system viability and functionality.

4. Records Retention and Disposition Policy Statement

4.1 NCCU is committed to responsible records management to ensure compliance with legal obligations, preserve the history of the University, and minimize the cost and inefficiency of storing records beyond their necessary lifespan. University personnel have responsibilities for the records they create and receive. Unit/department heads are responsible for ensuring the records in their areas are managed according to the University General Schedule.

4.2 The University General Schedule, campus-wide schedules and all approved supplemental institutional unit specific addenda govern the retention and disposition of all university records. Public records, including electronic records, not listed in a schedule or in an official approved unit specific addenda may not be destroyed unless specific approval from the DNCR is obtained.

4.3 Public Records Destruction (subject to 4.3)

4.3.1 Public records may be destroyed when they have met their retention requirements under an approved schedule.

4.3.2 Public records with short-term value may be destroyed or otherwise disposed of when their reference value ends.

4.3.3 Unscheduled public records that the DNCR has specifically approved for destruction may then be destroyed by the University.

4.4 Notwithstanding the instructions of the University General Schedule, campus-wide schedule and approved institutional unit specific addenda, any records subject to audit or official investigative proceedings or that relate to pending or probable litigation must be retained until the final conclusion of the audit, official proceedings or litigation and an official release has been communicated by either the Auditor or the Vice Chancellor and Office of Legal Affairs, as applicable.

5. Procedures for Approval of Unit Specific and Campus-Wide Schedules

5.1 University units may need to seek approval for new or revised unit specific addenda when specific unit records are not included in the University General Schedule or other campus-wide schedule, or when existing approved unit specific addenda needs revision. If units cannot locate particular records in the University General Schedule, a campus-wide schedule or unit specific addenda, the unit should contact the Office of Legal Affairs or the University Archivist for assistance.

5.2 If the Office of Legal Affairs and the University Archivist determine that there is no appropriate record series in the University General Schedule, a campus-wide schedule or existing unit specific addenda that meet the needs of the unit, the unit must submit a “Request for Approval of Unit Specific Schedule/Addenda” form to the Office of Legal Affairs who will consult with the University Archivist. If the request is approved, the Office of Legal Affairs shall forward the form to the Chancellor or designee for approval and then to DNCR for final approval. Unit specific addenda are not effective until approved by the DNCR and electronically published by the University as unit specific addenda.

5.3 A request for approval of unit specific schedule/addenda must be consistent with and meet the minimum retention and other requirements set forth in the University General Schedule and other campus-wide schedules.

5.4 Any campus-wide retention schedule may only supplement, and must be consistent with, the University General Schedule. The Office of Legal Affairs, in consultation with the University Archivist, is responsible for creating or revising campus-wide retention schedules utilizing appropriate procedures.

6. Procedures for Seeking Approval of the Destruction of Unscheduled Records

6.1 Authorization and regulation for destruction of unscheduled records may be obtained from the DNCR. To obtain such approval, the unit must submit a "Unit Request for Destruction of Unscheduled Records" to be reviewed by the Office of Legal Affairs and University Archivist. If the University Archivist determines that the record has historical value, the unit will be notified of the possibility of transferring the record(s) to the Archives or to another designated, authorized permanent storage area. If the University Archivist determines that the records do not have historical value, and the Office of Legal Affairs determines that they no longer have administrative value, the Office of Legal Affairs will forward the Unit Request for Destruction of Unscheduled Records to the DNCR. No destruction of any unscheduled record may take place until the unit is notified in writing of the approval of the DNCR.

6.2 Public records shall be destroyed only in accordance with Rule 07 NCAC 04M .0510 and approved retention schedules.

6.2.1 When used in an approved records retention and disposition schedule, the provision that paper records are to be destroyed means that the records shall be burned, unless prohibited by local ordinance; shredded or torn to destroy record content, reduced to pulp by placement in acid vats, or sold as waste paper, provided that the purchaser agrees in writing that the documents or materials concerned will not be resold without pulverizing or shredding the documents so that the information contained within cannot be practicably read or reconstructed.

6.2.2 When used in an approved records retention and disposition schedule, the provision that electronic records are to be destroyed means that the data and metadata are to be overwritten, deleted, and unlinked so the data and metadata may not be practicably reconstructed.

6.2.3 When used in an approved records retention and disposition schedule, the provision that confidential records of any format are to be destroyed means the data, metadata, and physical media are to be destroyed in such a manner that the information cannot be read or reconstructed under any means.

6.3 For all records with a specified retention period, the University must maintain a destructions log as part of the Records Management File.

7. Unit and Individual University Personnel Responsibilities

7.1 University Personnel Termination or Transfer. When university personnel terminate or change his/her affiliation with the university, it is the responsibility of the relevant unit administrator to ensure that records under the responsibility of that university personnel are retained or disposed of in compliance with this regulation and all applicable retention schedules and addenda. This action should be taken before the university personnel leaves.

7.2 Email Retention and Disposition. The custodian of email messages will normally be the originator if that person is university personnel; otherwise, it will be the individual university personnel to whom the message is addressed once the message is received at the university. The custodian is responsible for preserving the emails, notwithstanding any automatic repository as mentioned in section 8 or computer backup. The DNCR and the North Carolina Department of Information Technology provide guidance on the methods for managing, storing, preserving and destroying emails.

7.3 Non-University E-Mail Accounts. University personnel should use an NCCU email account to create or receive email that relates to university business. If university personnel use email addresses not maintained by the University (e.g. Google Gmail, Microsoft Outlook.com, Apple iCloud Mail, etc.) to create or receive email that relates to university business, then the university personnel, as the email custodian, is under a legal obligation to preserve, maintain and present upon request that email according to applicable retention schedules or addenda.

7.4 Third Parties and Service Agreements

7.4.1 All University Personnel that engage with any third party or outside provider on behalf of the University, whether such engagement is memorialized in a formal contract or any other acknowledgement of agreement, for any University related business, are responsible for ensuring that those third parties are aware of the legal obligations for maintaining public records in accordance with the Schedule. In addition, any confidentiality requirements established for records apply to such third parties in the same manner they apply to the University.

7.4.2 Written agreements with third parties regarding electronically stored information should address requirements for records retention and procedures for records export to be followed in the event a contractor ceases business operations, or the University transfers the contract to another party.

8. Email Retention Archive and Computer Systems Back-Up Protocol:

8.1 The University utilizes information technology (IT) resources such as computer systems to send, receive, and store public records in electronic or digital form. This protocol is based on Security Backup Files as Public Records in North Carolina: Guidelines for the Recycling, Destruction, Erasure, and Re-use of Security Backup Files published by the Archives and Records Section of the N.C. Division of Historical Resources.

8.2 ITS archives all emails sent or received externally through the University's centralized email system, creating a searchable repository. This repository will be used to assist University units and University personnel in responding to appropriate data requests.

8.3 Electronic data centrally stored on ITS-managed systems will be backed up and stored in secure locations. These backups can be used to restore the integrity of NCCU electronic data in the event of a system failure, natural disaster, or other catastrophic event. Although security backup files are public records pursuant to G.S. 121-2(8) and 132-1, systems backups are not intended to serve as an archival copy or to meet records retention requirements.

8.3.1 Procedures for electronic data backups for centrally managed systems.

8.3.2 Backup processes for centrally managed systems shall include full, incremental, differential, or other appropriate backup methodologies based on system requirements, recovery objectives, and operational needs. Backups for departmental systems will be determined in consultation with the data steward and/or application owner.

8.3.3 Data backups shall be securely stored using mechanisms to protect against unauthorized access, environmental hazards, ransomware, and physical loss.

8.3.4 Backup media and backup storage repositories that are no longer needed shall be disposed of using approved destruction or sanitization methods to prevent unauthorized data recovery. Media or storage resources intended for reuse shall be securely erased or sanitized in accordance with University data handling standards.

8.3.5 ITS will perform periodic tests to validate that the data being backed up can be accurately restored when needed.

8.4 Departments not using centrally managed data storage systems must document, maintain, and follow their own appropriate data backup procedures. ITS will provide consultation and design services in alignment with NIST frameworks.

9. Document Holds

9.1 The Office of Legal Affairs is the only unit with authority to place a Document Hold.

9.2 Procedures

9.2.1 A Document Hold will be initiated when either (a) an official discovery order is served on the University requesting the production of the records in question, or (b) litigation is pending or reasonably anticipated in the judgment of the Office of Legal Affairs. Any University personnel who become aware of any University-related litigation, threat of litigation, claim, administrative action or other legal action must immediately notify the Office of Legal Affairs.

9.2.2 The Office of Legal Affairs will notify Affected University Personnel that a Document Hold has been initiated. The notice will inform Affected University Personnel of their obligation to identify and preserve all Evidence that may be relevant to the Document Hold.

9.2.3 Upon notice of a Document Hold, Affected University Personnel are required to do the following:

9.2.3.1 Immediately suspend deletion, alteration, overriding, or any other destruction of records, including electronic records, under their control that are relevant to the Document Hold. Electronic records must be preserved so that they can be retrieved at a later time, and the records must be preserved in their original electronic form. It is not sufficient to make a hard copy.

9.2.3.2 Preserve any electronic records that are generated or received after receipt of the Document Hold notice if such information is relevant to the subject of the notice.

9.2.3.3 Preserve hard copies of documents under their control. Affected University Personnel must identify all relevant hard copy documents or files and ensure the retention of such. Affected University Personnel may make hard copies of electronically stored information; however, as set forth in item

9.2.3.1 above, the information must also be preserved in its original electronic form.

9.2.4 Affected University Personnel must acknowledge receipt, understanding, and compliance with a Document Hold in a timely manner by email or written memorandum to the University General Counsel.

9.2.5 The Office of Legal Affairs will notify ITS of a Document Hold and provide the relevant information.

9.2.6. If Affected University Personnel separate from employment during the course of a Document Hold, department heads, unit directors, or another appropriate administrator must take possession of any and all evidence under the control of the separated personnel and notify the Office of Legal Affairs.

9.2.7. Once notice of a Document Hold has been issued, the Office of Legal Affairs will continue to monitor compliance with this policy and any notices required, including the notice that the need for a Document Hold has expired.

10. Violations

Violations of this policy are subject to disciplinary action up to and including dismissal. It is also a criminal misdemeanor violation under North Carolina law to destroy public records except as authorized