Records classification, retention and disposition

Most organisations that come to us for records management services in the UAE do not have a records problem. They have a decision problem. Nobody has been given the authority to say what can go, so everything stays, and every year the cost of storing, searching and securing it rises. A retention schedule is not paperwork. It is the written record of decisions that would otherwise be made informally, inconsistently, and by whoever happens to be clearing a cupboard.

Why retention comes before digitization

There are three reasons, and the third is the one people miss.

The first is cost. You pay per page to convert, and again indefinitely to store, index, back up and secure the result. Scanning a box that should have been dispositioned two years ago converts a storage cost into a permanent one. The second is exposure. Content that still exists is content that can be requested, and a searchable digital archive is dramatically easier to search under compulsion than the same material in unlabelled boxes.

The third is mechanical. Retention almost never runs from the date a document was created. It runs from an event: contract expiry, employee leaving date, matter closure, final payment. If that trigger date is not captured as an index field at the moment of digitization, your repository has no way of ever applying the schedule automatically. You are then left with the choice between a manual review of everything you have digitized, or keeping it all forever. Adding one date field during capture costs very little. Adding it retrospectively to a loaded archive means opening every document again.

Classification: organise by function, not department

A classification scheme groups records by the business activity that produced them. The instinctive alternative, organising by department, fails the first restructure. Functions are stable in a way org charts are not: an organisation still procures, still hires, still manages contracts, whatever the current department names are. Build the scheme around those functions, keep it shallow enough that people can hold it in their heads, and resist the urge to create a category for every document type. A scheme too detailed to be applied consistently is worse than a coarse one that everyone actually uses.

What a retention schedule contains

One row per record series, and each row must answer every one of these. A schedule missing the trigger column cannot be operated, only admired.

• Record series name and a description clear enough that staff can tell what belongs in it
• The function it sits under in the classification scheme
• The retention trigger: the event that starts the clock, not the creation date
• The retention period measured from that trigger
• The disposition action at the end: destroy, transfer to archive, or review again
• The owner accountable for that series
• The basis for the period, whether regulatory, contractual or a business decision recorded as such

Legal hold overrides the schedule

When litigation, an investigation or a regulatory request is reasonably anticipated, routine disposition has to stop for the affected records. That means a documented process, not an email asking people to be careful. It needs a way to identify and freeze the affected series, a suspension of automated destruction for those items, a record of when the hold was applied and by whom, and a release step. The failure most often seen is the reverse of what people expect: not deliberate destruction, but automated disposition continuing quietly because nobody connected the hold to the system that runs the schedule.

Disposition is a decision, not a delete

At the end of a retention period something has to happen, and the schedule should already say what. Destruction needs review against holds, written authorisation, execution, and evidence retained afterwards. The destruction record is itself a record, and it is what you produce to show disposal was routine and authorised rather than convenient. Some series will instead transfer to permanent archive, which is a different discipline again and needs a preservation plan rather than a delete date.

The UAE picture

Retention and records governance are genuinely regulated here. Obligations arise from data protection requirements, from sector regulators, from tax and corporate law, and often from free zone authorities with their own rules. The periods and the responsible authority differ by sector, and a bank, a clinic, a contractor and a school will not have the same schedule. Cross-border and cloud residency questions frequently come attached, since where the data sits can matter as much as how long it is kept.

Making it operate on its own

A schedule kept as a document is a schedule nobody applies. The point of doing this alongside digitization is that the rules can be embedded where the records live: the trigger date captured as a field, the series recorded as metadata, disposition surfaced as a review task to a named owner instead of depending on somebody remembering. That is the difference between a policy and a practice, and it is why the sequencing matters so much.