Privacy, PII & Data Protection

Records management and privacy were once treated as separate disciplines, each with its own vocabulary, professionals, and governing rules. That separation no longer holds. Every record an organization creates, receives, or keeps is a potential repository of personal information, and the moment a record describes an identifiable human being it becomes subject not only to records law but to a fast-growing body of privacy and data-protection obligation. The result is a field where two questions must be answered together: How long must we keep this? and Are we allowed to keep it at all, and under what conditions? When those answers conflict — when retention rules pull toward preservation while privacy rules pull toward deletion — the organization must reconcile them deliberately rather than by accident.

This hub introduces the concepts, laws, and practices that sit at the intersection of recordkeeping and personal privacy. It is written for records managers, privacy professionals, archivists, compliance officers, and students who need a grounded understanding of how protecting personally identifiable information reshapes the entire records lifecycle, from the instant data is collected to the moment it is destroyed or permanently archived.

What Privacy and Data Protection Mean for Records

Privacy, in this context, is the principle that individuals have a legitimate interest in how information about them is collected, used, shared, and retained. Data protection is the operational discipline — the controls, policies, and accountabilities — that gives that principle effect. Records management is where the two become concrete, because records are the durable artifacts in which personal information actually lives. A retention schedule that ignores privacy can quietly turn an organization into a long-term store of sensitive data it no longer needs and can no longer justify keeping.

The core unit of analysis is personally identifiable information, or PII: any data that can identify a specific person, either on its own or when combined with other available information. PII ranges from the obvious — names, addresses, government identifiers, financial and health details — to the contextual, where seemingly innocuous fields become identifying in combination. A subset is often treated as sensitive or special category data, including health, biometric, racial, religious, and similar attributes, which typically carry heightened handling and retention obligations. Understanding what counts as PII, and recognizing that the boundary shifts as datasets are linked and re-identification techniques improve, is the foundation on which everything else in this cluster rests.

Aligning Retention With Privacy

The defining tension of this field is between retention and minimization. Records management traditionally optimizes for keeping the right things for the right length of time; privacy law adds a competing imperative — keep personal data only as long as there is a lawful, documented purpose, then dispose of it. This is the principle of storage limitation, and it turns the retention schedule into a privacy instrument as much as a recordkeeping one.

Reconciling the two requires several disciplined practices working together:

• Purpose-bound retention. Each category of personal data should be tied to a specific, defensible reason for keeping it, and to a defined disposition date once that reason expires.
• Defensible disposition. Routine, documented destruction at end of life is not merely permitted but expected; over-retention is itself a risk, because data that no longer exists cannot be breached, subpoenaed, or misused.
• Legal holds as exceptions, not habits. Litigation or investigation can suspend disposition, but holds must be scoped and lifted promptly so they do not become a backdoor to indefinite retention.
• Handling conflicts of law. Where a records requirement and a privacy requirement genuinely collide, the organization must analyze which obligation controls and record the reasoning behind its decision.

The cluster article on records retention and privacy explores how schedules can be redesigned so that minimization and recordkeeping reinforce rather than undermine each other.

The Governing Laws and Authorities

There is no single global privacy statute; instead, records professionals navigate a layered patchwork. In the United States, the Privacy Act of 1974 governs how federal agencies collect, maintain, use, and disclose records about individuals held in systems of records, establishing rights of access and correction and the principle that agencies should keep only relevant and necessary personal information. It remains a touchstone for understanding government recordkeeping obligations and is treated in depth in its own article.

Beyond it sits a broad and expanding landscape. Sector-specific U.S. laws govern health information, financial data, children’s data, and educational records, each with its own retention and protection expectations. A growing number of U.S. states have enacted comprehensive consumer privacy laws granting rights to access, correct, and delete personal data. Internationally, the European Union’s General Data Protection Regulation has become the most influential model, articulating principles — lawfulness, purpose limitation, data minimization, storage limitation, accountability — that increasingly shape practice worldwide, including a qualified right to erasure that directly engages retention decisions. The cluster article on RM and privacy laws maps how these regimes interact with recordkeeping duties.

Standards and frameworks complement the law. Information-governance and risk-management frameworks provide structure for assessing and controlling privacy risk, and electronic records management requirements increasingly fold in privacy considerations. It is worth noting that the U.S. National Archives and Records Administration revoked its long-standing endorsement of the DoD 5015.2 records-management standard in 2022, shifting its emphasis toward the Universal Electronic Records Management Requirements developed through the Federal Electronic Records Modernization Initiative. The practical effect is a move away from a single certification baseline toward functional requirements that any compliant system — and the privacy controls within it — should satisfy.

Privacy Across the Records Lifecycle

Privacy is not a single checkpoint; it must be designed into every phase of the lifecycle. At creation and collection, the questions are whether the personal data is necessary, whether collection is lawful, and whether individuals have been told how it will be used. During active use and maintenance, controls govern access, accuracy, security, and the boundaries of permissible use. At sharing and disclosure, the focus shifts to lawful transfer, contractual safeguards, and cross-border transfer rules. And at disposition, privacy demands timely, irreversible destruction or, where records carry enduring value, careful archival treatment that may include anonymization or restricted access. Embedding these controls from the outset — privacy by design — is far more effective than bolting them on after data has accumulated.

Common Challenges and Good Practice

The recurring difficulties are practical. Organizations struggle to locate PII scattered across systems, shared drives, email, and collaboration tools, which makes both protection and deletion hard. Over-retention persists because deleting data feels riskier than keeping it, even though the reverse is often true. Reconciling individual rights — such as requests to access or erase data — with overriding records obligations requires case-by-case judgment. And data spread across jurisdictions invites conflicting rules.

Good practice responds with a few durable habits: maintain an inventory of where personal data lives and why; classify data by sensitivity so controls match risk; integrate privacy review into retention scheduling rather than treating it separately; default to routine defensible disposition; and document decisions so they can withstand scrutiny. Strong cross-functional collaboration between records, privacy, legal, and security functions turns these habits into a coherent program.

Where the Topic Is Heading

The trajectory is toward convergence. New privacy laws keep arriving, individual rights keep expanding, and automated systems are increasingly used to discover, classify, and dispose of personal data at scale. As artificial intelligence consumes ever more records as training and operational input, questions of consent, minimization, and lifelong data governance grow sharper. The records professional of the coming years will not choose between recordkeeping and privacy but will treat them as a single, integrated obligation — keeping what must be kept, protecting it rigorously while it is held, and ensuring that nothing outlives the lawful reason for its existence. Mastering the concepts in this cluster is how that integrated practice begins.