5.15 Record Maintenance and Retention
Related Minnesota State Board Policies:
5.22 Acceptable Use of Computers and Information Technology Resources
5.23 Security and Privacy of Information Resources
Related MnSCU Board Procedure:
5.22.1 Acceptable Use of Computers and Information Technology Resources
5.23.1.3 Guideline for Data Sanitization
Purpose: Data maintained by Normandale Community College is subject to applicable employee and student data practices laws, including the Minnesota Government Data Practices Act and the federal Family Educational Rights and Privacy Act. Users are responsible for handling government data to which they have access or control in accordance with applicable data practices laws.
Part 1: Definitions.
- Data. Data refers to any information maintained on an individual.
- Data Privacy Compliance Officer (DPCO). Data Privacy Compliance Officer refers to the Chief Human Resources Officer, who is responsible for compliance with employee data practices regulations, and the College Registrar, who is responsible for compliance with student data practices regulations; and the Chief Information Officer, who is responsible for all other data compliance practices regulations.
Part 2: Responsibility for data privacy. Under the guidance of the DPCOs, all employees are responsible for maintaining the confidentiality and security of employee, student and other college records in accordance with applicable law.
Part 3: Record retention schedule.
Subpart A: The college adopts the Statewide HR Records Retention Schedule (06-137) for general HR, Safety, Affirmative Action, and ADA records.
Subpart B: The college adopts the Statewide Financial General Records Retention Schedules (06-047 and 06-076) for general accounting, payroll, budget, and agency use form records.
Subpart C: The college adopts the Statewide Property Management Records Retention Schedule (014-037) for general inventory, asset, land, and construction records.
Subpart D: Each administrative area that collects and maintains data shall implement a record retention schedule that complies with applicable laws and industry best practices.
Part 4: Access to private data. Access to private data shall be restricted to those with legitimate interest, as defined by law. The DPCO, in consultation with the Office of General Counsel, shall respond to third party requests for private data.
Policy History:
Date of Adoption: Prior to 2011
Date of Implementation: Prior to 2011
Date and Subject of Revisions:
Fall 2025 – updated format to comply with college template; added related MinnState policies and procedures; formally adopted several approved statewide retention schedules.
Next Review Date: 2029-2030