Policy and Procedures Frequently Asked Questions

What is the difference between information governance and records management?

Information governance is the overarching approach Monash uses to manage its information assets responsibly — covering everything from data quality and privacy to security, compliance and ethical use.
Records management is a subset of information governance. It focuses specifically on how records are created, maintained, accessed, stored, and ultimately disposed of, ensuring they remain reliable and usable throughout their lifespan.

What is a record, and how do I know if I need to keep it?

A record is information that documents a Monash decision, action, or obligation. If the information supports legal, business, audit, or historical needs, it must be retained.
Not all documents are records. Drafts, duplicates and transitory notes may be disposed of under Normal Administrative Practice (NAP).
View the NAP guidance

What is the lifespan of a record?

A record’s lifespan spans from its creation to lawful disposal or permanent preservation. During that time, it may serve multiple uses, e.g. student admission data may later be reused for reporting. Monash ensures records are securely stored, accessed only by authorised staff, and properly disposed of or archived when required.

What is an information asset?

An information asset is any recorded information that has value to Monash, including documents, databases, emails, images, and other formats – whether digital or physical.

What are my obligations when I initially capture, collect or create information? The capture, collection or creation of information by or on behalf of Monash must:

• accurately reflect the context and entirety of the activity that it records;
• consider the primary purpose and potential secondary uses for the information, within the limitations set out by any applicable legislation;
• comply with applicable confidentiality, data protection and privacy, and security requirements; and
• ensure the accuracy and quality of the information at the time of recording.

How should I store information to meet Monash’s requirements?

All records and data must be stored in approved Monash systems and follow classification rules set out in the Information Classification and Handling Standard.
Do not use personal USBs, external drives, or non-Monash cloud services.

When can I dispose of information, and how should I do it?

Information, records and data that is managed locally or in collaborative spaces, like email, file shares, etc, should be reviewed against the disposal criteria outlined under Normal Administrative Practice (NAP) as a first step.

Where NAP does not apply, it is important to refer to the Information and Records Management team for additional advice.

For straight forward matters regarding retention and disposal advice, the Retention and Disposal Authority website can be referred to as a next step. However, for information, records and data held in systems and/or information assets which may contain evidence of key University decisions, actions of obligations, advice should be obtained by completing an Information and Data Assessment (IDA) form. This assessment helps confirm retention requirements and provides tailored advice to:

• Confirm the record is no longer needed for legal, audit, or business purposes; and
• Ensure disposal is done securely using approved methods (e.g. confidential waste for paper records or secure deletion protocols for digital content).

Who is responsible for information governance and recordkeeping at Monash?

Under the Information Governance and Recordkeeping Procedure, all Monash staff and associates have a role to play in managing information and records responsibly. Key responsibilities are distributed across the University as follows:

All staff and associates

Everyone is responsible for:

• Creating and managing records and information ethically and transparently;
• Storing information in approved Monash systems;
• Following classification, security and disposal requirements; and
• Ensuring records are accessible to those with a legitimate business need and protected from unauthorised access or loss.

Information Governors

Senior staff accountable for specific information assets or systems. They ensure:

• Records are compliant with Monash policies and legal obligations;
• Relevant assessments (e.g. Privacy Impact Assessments, Information Security Risk Assessments, IDAs) are completed;
• Information is accurate, current, and fit for use;
• Access is appropriately controlled; and
• Permanent records are identified and preserved.

Information Stewards

Appointed by Information Governors to manage information on a day-to-day basis. They ensure:

• Records and data remain accurate, reliable and secure;
• Policies and assessments are implemented;
• System-generated information is trustworthy and usable over time.

Group Information and Records Management

This team leads operational implementation and oversight. They:

• Develop and maintain the Retention and Disposal Authority;
• Approve Notices to Delete and support archiving;
• Provide training, tools, and assessments (including the Information and Data Assessment); and
• Offer expert guidance on compliance and best practice.