How do records management, IT, legal, and the privacy office divide responsibility for protecting PII without gaps or overlap?

Protecting personally identifiable information (PII) is a team effort. No single office can do it alone, and gaps appear most often where functions assume someone else has it covered. The fix is not more rules but a shared map of who owns what across the information lifecycle.

Four functions, four lenses

Each office looks at PII through a different lens, and those lenses are meant to overlap by design, not by accident:

• Records management / information governance decides what is a record, how long PII must be kept, and when it must be defensibly disposed. RM owns the retention schedule and the lifecycle from creation to final disposition.
• IT / security protects PII while it exists: access controls, encryption, monitoring, backups, and secure destruction of media. IT enforces how data is safeguarded technically.
• Legal interprets statutes, contracts, and litigation obligations. Legal issues holds that pause disposition and advises on breach notification and regulatory exposure.
• The privacy office sets policy on what PII may be collected, for what purpose, and how individuals’ rights are honored. It often owns privacy impact assessments and data inventories.

Where gaps and overlaps hide

Trouble clusters at the handoffs. Two common failure points:

• Disposition versus holds. RM wants to dispose of expired PII to shrink risk; legal may need it preserved. Neither should act without the other. A single, authoritative hold process bridges them.
• “Keep everything” drift. If no one is accountable for disposition, PII accumulates indefinitely, and IT must defend an ever-growing attack surface. Clear retention authority prevents this.

Making the division work

A few practices keep responsibilities clean:

1. A shared data inventory so every office sees where PII lives and who is accountable for it.
2. A RACI-style matrix mapping each lifecycle stage to one accountable owner and named consulted parties.
3. One retention schedule that legal, privacy, and IT all reference, rather than competing rules.
4. Joint review when systems change, so new PII flows are classified at creation.

The goal is a single, agreed lifecycle in which records management governs the schedule, IT enforces safeguards, legal manages obligations and holds, and the privacy office sets collection and use policy. Coordinated, these functions cover the whole field without stepping on one another.

Explore related guidance on the privacy and PII topic hub.