A common question amongst our international clients is: “which jurisdictional law should our retention schedule follow?” From a records management perspective, the general rule of thumb is to focus on the “place of the regulated activity.” Applying this rule can be difficult, however, when there are regulated activities with legal and operational implications beyond the borders in which the activity takes place. This becomes an issue in particular when retention requirements between jurisdictions that use the same types of record vary greatly in the retention periods. Of course, there are exceptions to every general rule, and this guidance must be qualified with an “it depends…”
Limited Place of Regulated Activity
The simplest approach is to follow requirements across jurisdictions while addressing outliers on a country-by-country basis. This method assumes the adoption of a global baseline which generally covers retention requirements across jurisdictions. The country-exception is then reserved for outliers to the global baseline retention period. Deciding to implement a country-exception is appropriate where a country has a retention requirement that is significantly longer or shorter than the other jurisdictions. This approach is most fitting to address records related to a regulated activity that takes place strictly within national borders. Generally, this includes the vast majority of company’s regulated records — think employee records, time and attendance records, national income tax, payroll records, etc.
Regulated Activities with Implications Across Borders
For records related to activities with broader cross-border implications, an alternative approach is to adopt the most stringent requirement from among the multiple jurisdictions considered. This is most appropriate where the place of regulated activity is not limited to a jurisdiction, as is often the case with product manufacturing and distribution, and particularly true of pharmaceutical drug and device manufacturing.
To illustrate difficulties in determining a controlling jurisdiction for retention requirement purposes, consider the following scenario:
Your Company manufactures products in jurisdiction A, but distributes its products in jurisdictions A, B, and C. The manufacturing records from jurisdiction A now reach across other jurisdictions, as jurisdictions B and C also have their own manufacturing quality standards and retention requirements in relation to products authorized for marketing and distribution within their borders. If jurisdiction A requires manufacturing quality records to be maintained for 5 years, jurisdiction B requires 10 years, and C requires 15 years for the same records, then which jurisdiction is controlling for retention period purposes?
Under a scenario similar to the foregoing, one must decide whether to follow the 5, 10, or 15-year requirement for the Company’s quality manufacturing record series. This is not a decision to be taken lightly, as there is a big difference between 5 and 15 years. Deciding either way carries potential risks and costs associated with over-retention or under-retention of records. In making this decision, one should consider the following factors:
- Do manufacturing standards in A satisfy the standards in Jurisdictions B and C?
- Will Jurisdiction A’s quality records be subject to similar audits and inspections as those required in Jurisdictions B and C?
- Are there Mutual Recognition Agreements between any of the jurisdictions recognizing the quality standards of one another?
- Are there cross-jurisdictional reach considerations during investigations regarding the production of records?
- How does the Company’s risk profile guide the appropriate course of action?
In addition to these factors, any other considerations unique or pertinent to your Company should also be reviewed. Information gathered from stakeholders and record-owners will also be helpful for this analysis as well. These individuals are most knowledgeable about the records and can provide information regarding audit and inspection standards across jurisdictions, including any unwritten rules surrounding recordkeeping requirements. Finally, it is important to gather feedback from legal and privacy professionals while determining an appropriate harmonized or country-specific retention period. Through proper information gathering and analysis of jurisdictional activities and requirements you can arrive at a balanced strategy that addresses overlapping recordkeeping requirements while still staying agile, streamlined, and compliant.
If you would like more information or need help navigating multiple jurisdictional requirements for your company, contact Zasio.
Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.