What does sorting out information governance involve? Following one record from the day it arrives to the day it goes, and seeing who decides at every turn.
What Is Information Governance? One Record's Life Under UK Rules
By James Cotton · Last updated · Sources checked · 13 min read
Part of our topic guide on AI Governance & Data Strategy.
By James Cotton, Founder, iO-Sphere
What information governance covers
ISO 24143:2022, the international standard on the subject, "establishes concepts and principles for Information Governance". It applies to "the governance of the organisation's past, current and future information assets", in "organisations of all sizes in all sectors".
The wording closest to a set of decisions is Gartner's definition as AHIMA quoted it in 2013, in the journal of that US health information body: "The specification of decision rights and an accountability framework to ensure appropriate behavior in the valuation, creation, storage, use, archiving, and deletion of information".
One large public body, NHS England, defines it in the information governance policy for its own organisation, version 5.5, as "a broad framework for managing and controlling all forms of recorded information" and "an umbrella term which includes data protection, confidentiality and records management".
Data protection is the narrower subject. The UK GDPR's principles reach personal data only; these sources take in all of an organisation's information, whether or not it identifies anyone.
How it relates to data governance
ISO files ISO 24143 and ISO 15489-1, its records management standard, under ISO/TC 46, the committee for "Information and documentation". ISO/IEC 38505-1:2026, on the governance of data, sits with ISO/IEC JTC 1/SC 40, the committee for "IT service management and IT governance".
Our reading of those listings is that ISO handles information governance and data governance as subjects for different committees; ISO's own pages say nothing about how the two standards relate.
The 2013 AHIMA article took a side: "Data governance is a component of information governance." Information governance, it said, "speaks to the accountability framework or who is responsible for what, as well as who can make decisions about the information asset."
The Government Digital Service left the choice open. Its data ownership model, published in April 2026 for government bodies, called the two "distinct responsibilities", then let each body join them either way: "Some organisations may choose to integrate data ownership into their existing information asset ownership approach. Others may choose to wrap information asset owner activities into their data ownership approach."
These sources give no single answer to which of the two contains the other.
When a record is made or received
The first decision is whether something is a record at all. The 2021 records code quotes ISO 15489-1:2016, which ISO confirmed in 2021 and still lists as current: records are "recorded information created, received, and maintained as evidence and as an asset by an organisation or person, in pursuit of legal obligations or in the transaction of business."
The Information Commission, which succeeded the ICO on 30 September 2026, sees records across the same life: its records management toolkit runs from "Data collection" and "Record creation" to "Retention" and "Disposal and deletion".
Then the record needs an asset and an owner. The code's glossary defines an information asset as "a body of information, defined and managed as a single unit so it can be understood, shared, protected and exploited efficiently."
The regulator looks for minimum standards for creating records and effective ways to locate and retrieve them, and its records management and security guidance suggests an asset register holding each asset's owner, location, retention period and security measures.
For public sector bodies, The National Archives' section 46 maturity assessment tool (August 2025) lists email, cloud document systems, collaborative workspaces and paper among its collection types, with "Shadow IT and non-corporate communication channels" ("Slack, Trello, WhatsApp etc.").
While it is held and used
Once a record is held, someone must decide who may open it, whether it is right and how it is protected. The regulator expects access to personal information to be limited to authorised staff, with access rights reviewed regularly.
For personal data, the UK GDPR's accuracy principle requires data "accurate and, where necessary, kept up to date", its integrity and confidentiality principle requires "appropriate security", and Article 32 asks for measures giving "a level of security appropriate to the risk".
Quality is a wider test. In 2020 the Government Data Quality Hub's framework said data quality "can be thought of as 'fitness for purpose'", and asked: "is this data set good enough for what I want to use it for?"
These calls belong to the asset's owner. In government that is the information asset owner, who needs the authority to make decisions on the asset's access, use, retention and disposal, in the Cabinet Office's guidance on the role, last updated on 1 October 2025.
The same guidance asks owners to ensure "that an AI service has been assessed before it's allowed access to information", and that staff are trained in their record-keeping responsibilities "including when using AI tools".
Where a new use involves personal data, it can be weighed in a data protection impact assessment, a written assessment of the risks the use poses to the people the data describes; rules for everyday AI tools belong in a staff AI use policy.
When someone asks for it
"Citizens and businesses can access information about themselves" is one of The National Archives' information principles for the UK public sector, beside "Information is published"; both date from December 2011, under an earlier government. For personal data, that access is a legal right with a clock.
A request must be answered within one month of "the relevant time", which Article 12A, in force since 5 February 2026, fixes as the latest of receiving the request, any information asked for, and any fee. A notice giving reasons inside that month can add two further months for complex or numerous requests.
The search owed is "reasonable and proportionate", words inserted into Article 15 by the Data (Use and Access) Act 2025 with effect back to 1 January 2024. Here the decisions made at creation come due: the regulator warns that records nobody can locate may breach Articles 12 to 21 of the UK GDPR or section 10 of the Freedom of Information Act.
A refusal must, under Article 12(4), give the person the reasons and tell them they can complain to the organisation under section 164A of the Data Protection Act 2018, complain to the regulator under section 165, or seek a judicial remedy.
Public authorities also answer under the Freedom of Information Act 2000, which covers "most public authorities", as the ICO's annual report says, and leaves most private companies outside; the deadline is "the twentieth working day following the date of receipt".
The Environmental Information Regulations 2004 also allow 20 working days, and, the same report says, "cover more organisations than FOIA, including some private sector bodies". The ICO's figures for 2025/26, the year to 31 March 2026, count 76,743 data protection complaints against 42,315 the year before, and 10,713 FOI complaints against 7,369.
When it is shared, moved or lost
The regulator's audit framework has toolkits for both decisions this stage brings: whether to share a record, and how to manage a personal data breach.
When personal data goes astray, Article 33 requires the organisation to notify the regulator "without undue delay and, where feasible, not later than 72 hours after having become aware of it", unless the breach is unlikely to result in a risk to people's rights and freedoms. A late notification must give reasons.
Every breach must be documented, reported or not, with its facts, effects and remedial action, so the regulator can verify compliance. The ICO's 2025/26 report counts 17,431 data breaches reported, against 12,412 the year before.
How long it is kept, and how its life ends
The last decisions are how long to keep a record, under which rules, and how it ends. For personal data, storage limitation allows identifiable data to be kept "for no longer than is necessary" for the purposes it is processed for.
The regulator suggests a retention schedule for all personal information, reviewed regularly and "based on business need with reference to statutory requirements", with publishing it as an option. A disposal schedule, in ISO 15489-1's words as the code quotes them, says how long information "will be kept before it is either reviewed, designated for permanent preservation or destroyed."
Gov.uk's company and accounting records guidance says to keep records "for 6 years from the end of the last company financial year they relate to", sometimes longer; section 388(4) of the Companies Act 2006 gives a private company's accounting records "three years from the date on which they are made".
The two run for different periods from different starting points, so a schedule names the rule behind each period. Destruction, where a schedule ends there, means eliminating or deleting a record "beyond any possible reconstruction", in the same standard's words, by methods the regulator suggests a policy sets.
For public authorities in England, Wales and Northern Ireland, the records code issued under section 46 of the Freedom of Information Act 2000, the current one from July 2021, applies whatever their size, to a public inquiry as to a school. An authority that does not conform can receive a practice recommendation, a power the regulator now holds.
Its Value principle has authorities keep information "as long as they can show it has value", and the code asks for "written rules on what to keep and when to destroy information". In government departments the Departmental Record Officer "oversees the appraisal, selection, review, retention and destruction of records".
Some records are kept for good: the Public Records Act 1958 gives "every person responsible for public records" a duty to arrange "the selection of those records which ought to be permanently preserved". In the code's glossary these are the records of government departments and their executive agencies, some non-departmental public bodies, the courts, the NHS and the armed forces, and of local government only in Northern Ireland.
Who makes these decisions, and which role does the law require?
| Role | Where it comes from | Required by law? |
|---|---|---|
| Data protection officer | UK GDPR Article 37; Data Protection Act 2018 section 69 | Yes, where Article 37(1) or section 69 applies; otherwise voluntary |
| Senior information risk owner | Cabinet Office Data Handling Review, 2008 | No: Cabinet Office guidance no longer refers to it as a mandated post |
| Information asset owner | The same review; Cabinet Office guidance, 2025 | No: "mandated as part of the 2008 Data Handling Review", a requirement the government set for its own departments |
| Departmental Record Officer | The records code, issued under FOI Act section 46 | No: the code's "designated manager" in government departments |
| Caldicott Guardian | National Data Guardian statutory guidance, 2021 | No: in-scope health and adult social care bodies in England "must have regard to" it, and may depart from it for "good reasons" |
| Records manager | The records code; the regulator's records toolkit | No, on our reading: the code asks for a "designated manager", the regulator for "an appropriate manager", and neither creates the title |
Article 37(1) requires a data protection officer where processing is carried out by a public authority or body (courts and tribunals acting judicially excepted), or where core activities consist of processing that requires "regular and systematic monitoring of data subjects on a large scale", or of large-scale processing of special category or criminal offence data.
Section 69 adds one for law enforcement bodies such as the police; any other organisation "may" designate one. Article 39 sets the officer's minimum tasks, from advising staff and monitoring compliance to cooperating with the regulator, and Article 38(3) has the officer "directly report to the highest management level".
The Cabinet Office's 2008 Data Handling Review, under an earlier government, formalised the senior information risk owner (SIRO) in every department and gave the information asset owner's role as "to understand what information is held and in what form, how it is added and removed, who has access, and why."
Cabinet Office guidance no longer refers to the SIRO as a mandated post, and in 2025 spoke of "the senior person accountable for information security risk (sometimes called the SIRO)". Its asset owner is senior and accountable, and "can delegate operational responsibilities but not accountability".
The regulator's records toolkit gives oversight to a board member, operations to a manager and implementation to local business areas, naming the SIRO and asset owners and administrators only after "eg". The Cabinet Office leaves the overlap to each organisation: "one person may carry out more than one role".
The person who runs it day to day
The Department for Science, Innovation and Technology published its UK Business Data Survey 2026 on 18 June 2026; 4,450 businesses took part in the mainstage, surveyed between October 2025 and January 2026.
Of UK businesses that handle personal data and employ staff, 44% employ nobody whose primary role is data protection compliance and 38% the equivalent of one to two full-time staff. Among large businesses, 14% employ nobody in that role and 13% eleven or more.
Asked about the statement "My business finds the regulatory guidance published by the Information Commissioner's Office (ICO) clear and easy to understand", 46% of UK businesses that handle personal data agree, as do 73% of large and 44% of micro businesses.
The regulator expects an all-staff training programme in data protection and information governance, and more for specialised roles "such as DPOs, subject access and records management teams".
That specialist has its own Level 4 standard on Skills England's register, ST0967, "Data protection and information governance practitioner", version 2.0, approved for delivery. Its broad purpose is advice "providing assurance to key stakeholders and regulators of compliance with information governance (IG) and data protection (DP) requirements".
The practitioner develops "briefings for senior leadership on data protection and information governance controls"; duties 4, 5 and 12 cover the "record of processing activities", reporting on "key risk, trend and performance indicators" and regulatory toolkits. Skill S12 is to "Make decisions on data protection and information governance issues raised and ensure that any areas of concern are escalated to the stakeholders."
We recommend training whoever makes those decisions every day to that standard: the additional training the regulator expects for specialised roles. We deliver ST0967 as one programme, Data & AI Governance (Level 4), for people doing information governance, data protection, data governance, data quality and data management work, and the same work for AI in AI governance, AI risk and AI assurance; we teach AI governance within the standard.
The programme's projects are governance work in the apprentice's own organisation, such as a data protection impact assessment on its own AI use. Before a start, an employer will want the apprenticeship's assessment and funding to hand.
Where to start
In the first week, we would start by settling the data protection officer question against Article 37(1) and writing the answer down either way. The regulator's leadership and oversight guidance suggests documenting "the decision and rationale for not appointing a DPO, if that is the case" and, where none is required, assigning responsibility for data protection compliance with enough staff and resources.
Next comes the self-assessment that fits: for large organisations, the regulator's data protection audit framework, under review, which suggests starting with its Accountability toolkit (formerly the Accountability framework); for small ones, its web hub and self-assessment toolkit; for public bodies, The National Archives' section 46 maturity assessment tool.
Then take one record type the organisation holds in volume, customer complaints for instance, and follow a single complaint through its life. At each stage, from the email that brings it in to the day it is destroyed or kept for good, write down who decides what happens to it and under which rule.
Frequently asked questions
Does a small organisation need a record of processing activities?
Article 30(5) exempts an organisation employing fewer than 250 people from keeping the record of processing activities that Article 30(1) requires, unless its processing is likely to result in a risk to people's rights and freedoms, is not occasional, or includes special category or criminal offence data.
Can the data protection officer hold other duties, or come from outside the organisation?
Article 38(6) lets the officer "fulfil other tasks and duties", provided they cause no conflict of interests, and Article 37(6) allows a staff member or someone working "on the basis of a service contract". Either way the officer is chosen for expert knowledge of data protection law and practice, and "does not receive any instructions regarding the exercise of those tasks".
Is the ICO still the regulator?
The Information Commission replaced the ICO on 30 September 2026 under The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/1015). The government said "the transition does not change the regulator's role, responsibilities, or powers" over data protection and freedom of information. ICO now means "Information Commission's Office"; the UK GDPR, FOI Act and Data Protection Act 2018 say "Commission".
What should an information governance framework cover?
The regulator's Accountability toolkit names the areas it considers, in this order: "Leadership and oversight", "Policies and procedures", "Training and awareness", "Individual rights", "Transparency", "Records of processing and lawful basis", "Contracts and data sharing", "Risks and data protection impact assessments (DPIA)", "Records management and security" and "Breach response and monitoring".
Want to own AI governance in your organisation?
Our Level 4 Data & AI Governance programme builds the frameworks that make data trustworthy and AI accountable, funded through the Growth & Skills Levy.