ISO 27001 A.5.33: Protection of Records

Quick Reference: A.5.33 in 60 Seconds

What the Standard Actually Requires

Figure · Process

What A.5.33 asks you to do

ISO 27001:2022 A.5.33 Text

ISO 27001:2022 Annex A 5.33 asks organizations to protect records from loss, destruction, falsification, unauthorized access, and unauthorized release.

ISO 27002:2022 Implementation Guidance (Section 5.33)

ISO 27002:2022 expands A.5.33 into a complete records management framework. The guidance states that organisations should:

1. Establish records management guidelines that address usability, integrity, authenticity, and reliability of records, supported by topic-specific policies for storage, handling, disposal, and preventing manipulation.
2. Maintain a records retention schedule specifying how long different record types are kept, linked to their business purpose and legal/regulatory obligations.
3. Define storage and handling processes that consider prevailing laws for commercial record keeping and societal expectations for responsible information governance.
4. Destroy records securely as soon as the retention period expires, using methods appropriate to the sensitivity of the information and the media type.
5. Categorise records according to security risk, retention period, and media type, covering personnel, legal, accounting, and business transaction records.
6. Ensure adequate retrieval times for records requested internally or by third parties (regulators, auditors, courts).
7. Address technology obsolescence for electronic records by maintaining cryptographic details, format documentation, and migration plans so records remain recoverable.
8. Consider media deterioration and follow manufacturer instructions for storing and managing electronic records, including environmental controls and media refresh cycles.

Shall vs. Should Analysis

What Auditors Actually Check

Why Protection of Records Matters

The Business Risk Narrative

Records are the evidentiary backbone of your organisation. Every invoice, contract, audit log, employee file, customer consent, security incident report, and board resolution is a record that proves what happened, when, and who was responsible. Unlike documents, records are historical evidence, once created, they must not be altered. If records are lost, destroyed, falsified, leaked, or accessed without authorisation, the consequences go far beyond operational inconvenience:

• Legal and regulatory action: Inability to produce records during litigation, tax assessment, or regulatory inquiry can lead to adverse inference, penalties, or criminal liability.
• Reputational damage: Customers, investors, and partners lose trust when an organisation cannot account for its own data.
• Financial loss: Fines, litigation overhead, contract termination, and lost business opportunities can run into crores.
• Operational paralysis: Without reliable records, business continuity, dispute resolution, and knowledge management break down.

A 2024 study by the Association for Intelligent Information Management (AIIM) found that 47% of organisations have experienced a serious records management failure in the past two years, and 60% of those failures resulted in regulatory, legal, or customer-impact consequences. For Indian organisations, the risk is amplified by overlapping and increasingly stringent regulatory requirements.

Indian Regulatory Context

Indian organisations operate in a layered compliance environment where record protection is not optional:

Specific Retention Periods by Indian Law

Industry-Specific Consequences

• Banking and Financial Services: Inability to produce loan documentation, KYC records, or transaction logs can trigger RBI enforcement, customer disputes, and fraud investigations.
• Healthcare: Loss or tampering of patient medical records violates DPDP Act obligations and can lead to malpractice claims and loss of accreditation.
• SaaS and Technology: Customer audit logs and consent records are essential for enterprise sales; gaps can block deals and trigger SLA penalties.
• Manufacturing: IP records, quality control logs, and supplier certifications must be preserved for product liability and export compliance.
• Government and Public Sector: Citizen service records, grievance records, and audit trails are subject to RTI, CAG audits, and public accountability.

impact of Non-Compliance: Statistics

• The average impact of a data breach in India reached in 2024 (IBM impact of a Data Breach Report), with regulatory fines and notification overhead rising sharply.
• DPDP Act penalties can reach **** for failure to implement reasonable security safeguards.
• Tax and GST disputes where records are missing or incomplete result in disallowance rates exceeding 30% of contested amounts in many cases.
• Litigation support overhead increase by 40–60% when records are poorly indexed or inaccessible.

Scope and Applicability

What This Control Covers

A.5.33 applies to all records created, received, or maintained by the organisation in the course of business, regardless of form or medium:

• Digital records: Databases, files, emails, instant messages, audit logs, system logs, configuration files, video recordings, audio files, images, and metadata.
• Physical records: Paper files, signed contracts, invoices, personnel files, board minutes, cheques, vouchers, and microfilm.
• Hybrid records: Scanned documents with embedded signatures, printed reports generated from systems, and backup tapes stored off-site.
• Records held by third parties: Cloud storage providers, archiving vendors, payroll processors, legal counsel, and auditors.

Who It Applies To

Size-Based Applicability

Records That Must Be Protected (Examples)

Key Definitions and Terminology

Relationship to Other Controls

Upstream Controls (Provide Inputs to A.5.33)

Downstream Controls (A.5.33 Provides Inputs To)

Parallel Controls (Work Together)

Detailed Implementation Guidance

Establish Governance for Records Protection

Before implementing tools, define who owns records protection and how decisions are made:

1. Appoint a Records Protection Owner. In most Indian organisations this is the CISO, Compliance Officer, or a dedicated Records Manager. For regulated entities, a Data Protection Officer (DPO) under the DPDP Act also plays a key role.
2. Form a cross-functional Records Governance Committee with representatives from Legal, IT, HR, Finance, Operations, and Information Security. Meet quarterly.
3. Publish a Records Protection Policy approved by top management. The policy must mandate the retention schedule, classification, storage, access, integrity, and disposal requirements.
4. Create a Records Master Index listing all record categories, owners, systems, retention periods, and disposal methods.
5. Integrate with the ISMS. Records protection must be part of risk assessments, internal audits, and management reviews.

Develop a Records Retention Schedule

The retention schedule is the heart of A.5.33 compliance. It must be:

• Complete: Cover all record categories across the organisation.
• Legally grounded: Cite the specific law, regulation, or contract requiring retention.
• Business justified: When no legal requirement exists, state the business reason.
• Media aware: Address digital, physical, and hybrid records.
• Disposal linked: Specify the authorised disposal method for each category.

Example retention schedule excerpt:

Classify Records

Use a classification scheme aligned with A.5.12 and A.5.13. For records, classification determines storage, access, encryption, and disposal rigour.

Protect Record Integrity

Integrity is the assurance that a record has not been altered, corrupted, or tampered with since creation or last authorised modification.

Technical controls for integrity:

1. WORM Storage: Use WORM-enabled storage for audit logs, financial records, and any record where tamper-proofing is required. Major cloud providers offer WORM/object lock (AWS S3 Object Lock, Azure Immutable Blob Storage, GCP Bucket Lock).
2. Cryptographic Hashing: Compute SHA-256 hashes for critical records at creation and store hashes separately. Periodically recompute and compare.
3. Digital Signatures: Apply PKI-based digital signatures to contracts, approvals, and regulatory filings where non-repudiation is required.
4. Version Control: For records that legitimately have versions (e.g., contract amendments), maintain an immutable version history with audit trail.
5. Audit Logging: Log every access, modification, copy, move, and deletion of protected records. Logs themselves are records and must be protected.
6. Time Stamping: Use trusted time sources (NTP with authentication) so record timestamps are reliable and defensible.

Ensure Record Availability and Retrieval

Records must remain usable for as long as they are retained. Availability controls include:

1. Backup Strategy: Align with A.8.13. Back up records according to criticality: daily for transactional systems, weekly for document repositories, monthly for archives.
2. Restore Testing: Test backup restoration quarterly for critical records and annually for archives.
3. Geographic Redundancy: Store copies in multiple availability zones or regions, respecting data localisation requirements under the DPDP Act.
4. Format and Technology Obsolescence Management: Maintain documentation of file formats, database schemas, encryption keys, and software versions. Plan migrations before formats become obsolete.
5. Media Refresh: For tapes, optical media, and other degradable media, refresh copies every 3–5 years or per manufacturer guidance.
6. Search and Indexing: Implement metadata tagging and full-text indexing so records can be retrieved within defined timeframes (e.g., 24 hours for active records, 48 hours for archived records).

Control Access to Records

Access controls for records should be at least as strict as for operational data:

1. Role-Based Access Control (RBAC): Map roles to record categories. A junior accountant should not access board minutes; a developer should not access HR files.
2. Least Privilege: Grant minimum access necessary for the job function.
3. Need-to-Know: Even within a role, access should be justified on a per-record or per-category basis.
4. Multi-Factor Authentication (MFA): Enforce MFA for all repositories holding Confidential or Restricted records.
5. Privileged Access Management (PAM): Administrators with access to record storage must use PAM with session recording and approval workflows.
6. Access Reviews: Recertify access quarterly for Restricted records, semi-annually for Confidential, and annually for Internal.
7. Logging and Monitoring: Log all record access and generate alerts for anomalous activity (bulk downloads, off-hours access, external sharing).

Secure Storage of Physical Records

Physical records require the same rigour as digital records:

1. Secure Storage Areas: Use lockable cabinets, access-controlled rooms, and fireproof safes for Restricted records.
2. Environmental Controls: Maintain appropriate temperature, humidity, and fire suppression for paper and media archives.
3. Access Logs: Maintain sign-in/sign-out logs for physical files and media.
4. Transport Security: Use sealed, tamper-evident packaging and tracked courier services for physical records moved off-site.
5. Off-Site Archives: Use certified records management vendors with contractual security clauses and periodic audit rights.
6. Media-Specific Handling: Store backup tapes in anti-static cases, away from magnetic fields, and rotate media per manufacturer specifications.

Implement Secure Disposal

Disposal must be secure, irreversible, and auditable:

Digital records:

• Use cryptographic erasure (erase encryption keys) or secure wipe tools that overwrite data multiple times (e.g., NIST SP 800-88 Clear/Purge/Destroy methods).
• For cloud records, ensure provider deletion propagates to all replicas, backups, and logs.
• For SSDs and mobile devices, use vendor-specific secure erase commands.

Physical records:

• Use cross-cut shredders (DIN P-4 or higher) for Confidential records.
• Use pulverisation or incineration for Restricted records.
• Use certified destruction vendors and obtain certificates of destruction.

Disposal workflow:

1. Retention period expires.
2. Record owner reviews and approves disposal (unless legal hold applies).
3. Disposal method selected per classification.
4. Disposal executed by authorised personnel.
5. Disposal log updated with date, method, record description, and witness (for Restricted).
6. Certificate of destruction retained.

Manage Legal Holds

A legal hold overrides normal retention and disposal schedules:

1. Trigger: Litigation, regulatory investigation, audit, or reasonable anticipation of any of these.
2. Notification: Legal counsel issues a hold notice to record owners and IT.
3. Suspension: Relevant records are protected from disposal, even if retention expires.
4. Scope: Hold covers all locations, local drives, email, mobile devices, cloud apps, backups, and physical files.
5. Monitoring: Track compliance with the hold; document any exceptions.
6. Release: Disposal resumes only after Legal formally releases the hold.

Address Records in Third-Party Custody

When records are stored or processed by vendors:

1. Contractual clauses: Require the vendor to protect records per your policy and applicable law.
2. Right to audit: Include audit rights and incident notification obligations.
3. Data localisation: Ensure DPDP Act and RBI data localisation requirements are met.
4. Return and disposal: Define procedures for returning or securely disposing of records at contract end.
5. Due diligence: Assess vendor security before engagement and periodically thereafter.

Tiered Implementation by Organisation Maturity

Industry-Specific Records Protection Requirements

Records protection requirements vary significantly by industry. The following guidance helps Indian organisations align A.5.33 with sector-specific obligations.

Banking, Financial Services, and Insurance (BFSI)

BFSI organisations should map every record category to RBI Master Direction on KYC, RBI Cyber Security Framework, SEBI circulars, IRDAI guidelines, and PMLA obligations. Annual internal audits must verify retention and disposal compliance.

Healthcare and Pharma

Healthcare providers must balance clinical accessibility with confidentiality. Emergency access procedures should be documented and audited.

SaaS and Technology

SaaS companies should design records protection into their multi-tenant architecture, ensuring tenant isolation and customer-specific retention rules.

Manufacturing and Industrial

Manufacturers must protect intellectual property records with particular rigour, as these are high-value targets for industrial espionage.

Government and Public Sector

Government organisations must align records protection with the Public Records Act, 1993, and relevant MeitY/NCIIPC directives.

Tools, Technologies, and Solutions

Records Management and ECM Platforms

Backup and Archive Solutions

WORM and Immutable Storage

Data Discovery and Classification

Secure Disposal and Destruction Services (India)

Open-Source and lightweight Tools

Emerging Technologies for Records Protection

• AI-Powered Classification: Machine learning models can automatically classify records based on content, reducing manual labelling effort and improving consistency. Tools like Microsoft Purview auto-labelling and third-party AI classifiers are increasingly affordable for growing Indian organisations.
• Blockchain Audit Trails: For high-integrity requirements (board resolutions, regulatory filings, land records), blockchain or distributed ledger technology can provide tamper-evident timestamping and proof of existence.
• Federated Search: Unified search across email, SharePoint, databases, and physical archives helps locate records quickly during audits, litigation, or customer requests.
• Data Loss Prevention (DLP) Integration: Modern DLP tools can enforce records protection policies by blocking unauthorised sharing of classified records via email, cloud apps, or removable media.
• e-Discovery Platforms: For litigation and regulatory response, e-discovery tools index records across sources and support legal hold, review, and production workflows.

Policy and Procedure Templates

Records Protection Policy (Extract)

RECORDS PROTECTION POLICY
[Organisation Name]
Version: 1.0
Approved by: [CEO / Managing Director]
Date: [Date]
Review Date: [Date + 12 months]
Classification: Internal

1. PURPOSE
This policy establishes the framework for protecting [Organisation Name] records
from loss, destruction, falsification, unauthorised access, and unauthorised release
throughout their lifecycle.

2. SCOPE
This policy applies to all records, in any form or medium, created, received, or
maintained by [Organisation Name], its employees, contractors, and third parties.

3. POLICY STATEMENTS
3.1 All records shall be classified according to the Information Classification Policy.
3.2 A records retention schedule shall be maintained and reviewed annually.
3.3 Records shall be stored securely with access restricted to authorised personnel.
3.4 Confidential and Restricted records shall be encrypted at rest and in transit.
3.5 Critical records (audit logs, financial records, board minutes) shall be stored
      on WORM or otherwise integrity-protected media.
3.6 Records shall be disposed of securely and irreversibly when the retention
      period expires, unless a legal hold is in effect.
3.7 All record disposal shall be logged and, for Restricted records, witnessed.
3.8 Records held by third parties shall be protected by contract and audited.
3.9 Record access, modification, and disposal events shall be logged and monitored.
3.10 Employees shall complete records protection training annually.

4. ROLES AND RESPONSIBILITIES
4.1 CISO / Records Manager: Own the policy, retention schedule, and compliance metrics.
4.2 Legal Counsel: Identify legal and regulatory retention requirements and issue legal holds.
4.3 Department Heads: Classify records in their domain and approve disposals.
4.4 IT: Implement technical controls for storage, access, backup, encryption, and logging.
4.5 All Employees: Handle records per policy and report incidents.

5. COMPLIANCE
Violation of this policy may result in disciplinary action, including termination and
legal proceedings where applicable.

6. REVIEW
This policy is reviewed annually and when significant legal, regulatory, or business
changes occur.

Record Handling Procedure (Extract)

RECORD HANDLING PROCEDURE
[Organisation Name]

1. CREATION / RECEIPT
   • Create records in approved systems or forms.
   • Capture required metadata: title, owner, date, classification, retention category.
   • Do not store business records on personal drives, USB devices, or unapproved cloud services.

2. CLASSIFICATION
   • Apply the classification label at creation: Public, Internal, Confidential, Restricted.
   • For Restricted records, request approval from the record owner and CISO.

3. STORAGE
   • Store records in the designated repository based on classification.
   • Encrypt Confidential and Restricted records at rest.
   • Apply RBAC and MFA to repositories holding Confidential/Restricted records.

4. USE AND SHARING
   • Share records only with authorised recipients using approved channels.
   • External sharing of Restricted records requires encryption and approval.
   • Do not print Restricted records unless approved and physically secured.

5. RETENTION
   • Retain records per the approved retention schedule.
   • Do not delete records before the retention period expires unless authorised.

6. DISPOSAL
   • Review records approaching disposal date.
   • Confirm no legal hold applies.
   • Dispose using the method defined in the retention schedule.
   • Complete the Record Disposal Log.

7. INCIDENT REPORTING
   • Report suspected loss, unauthorised access, or unauthorised disclosure immediately
     to the CISO / Information Security team.

Record Disposal Log Template

Risk Assessment and Treatment

Risk Identification

Risk Treatment Plan

Audit and Compliance Checklist

Auditor Questions and Expected Evidence

Metrics and KPIs

Common Pitfalls / Audit Failures & How to Avoid Them

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Mumbai NBFC, Ransomware Exposes Backup Gap

Background: A mid-sized Non-Banking Financial Company (NBFC) in Mumbai with 400 employees held customer loan records, KYC documents, and transaction logs on on-premise servers and network-attached storage. The company had backups but had never tested restoration.

The Incident: In October 2024, a ransomware attack encrypted the primary file server and spread to the backup server because both were on the same network segment. The attackers demanded . The NBFC discovered that their "daily backups" had been failing silently for six weeks and that no immutable backup copies existed.

Impact:

• Customer records for the past six weeks were unrecoverable.
• RBI was notified under the 6-hour serious incident reporting rule.
• The NBFC had to reconstruct transaction data from email trails and partner statements, and 3 months of effort.
• RBI issued a supervisory letter citing inadequate records protection and backup controls.

Root Cause Analysis:

1. Backups were not segregated from production networks.
2. No immutable or air-gapped backup strategy.
3. Backup restore testing was not performed.
4. Records protection was not part of the ISMS risk assessment.
5. No WORM or integrity protection for critical financial records.

Remediation with Singahi:

• Week 1–2: Incident response and containment; rebuilt servers from last known good backup.
• Week 3–4: Deployed immutable backup solution (Veeam with S3 Object Lock) and segregated backup network.
• Week 5–8: Created records retention schedule aligned with RBI, Companies Act, and Income Tax Act requirements.
• Week 9–12: Implemented WORM storage for audit logs and transaction records; configured quarterly restore testing.
• Ongoing: Added records protection to internal audit scope and management review agenda.

Results:

• Zero unrecoverable record loss in a subsequent simulated ransomware exercise.
• RBI follow-up inspection passed with no major findings.
• Backup restore RTO reduced from "unknown" to 4 hours.
• Records retrieval SLA improved from days to under 4 hours.

Illustrative Scenario 2: Bengaluru SaaS Company, DPDP Consent Records Chaos

Background: A 250-employee SaaS company in Bengaluru provided HR-tech software to Indian enterprises. After the DPDP Act, 2023 came into force, the company needed to demonstrate consent, data principal rights, and breach records to customers and regulators. However, consent records were scattered across CRM, email, and spreadsheet exports.

The Incident: During an enterprise customer audit in January 2025, the company failed to produce a complete audit trail of consent for 12,000 employee records processed on behalf of a client. Consent forms existed but were not version-controlled, some were missing, and withdrawal requests were tracked in personal inboxes. The customer suspended a contract renewal pending remediation.

Impact:

• Contract renewal delayed by 6 months.
• DPDP Act compliance gap identified.
• Potential penalty exposure under Section 8(5) and Section 12 of the DPDP Act.
• Engineering resources diverted for 4 months to rebuild consent infrastructure.

Root Cause Analysis:

1. No records protection policy for personal data records.
2. Consent records were not classified as Restricted records.
3. No WORM or immutable storage for consent and rights-request logs.
4. Disposal of old consent records was uncontrolled.
5. No integration between marketing consent tools and the central records repository.

Remediation with Singahi:

• Week 1–2: Declared consent records, data principal request records, and breach logs as Restricted records under the Records Protection Policy.
• Week 3–6: Migrated consent and rights records into a centralised, immutable repository with WORM locks.
• Week 7–10: Built automated workflows for consent capture, withdrawal, and deletion requests with full audit trail.
• Week 11–12: Trained customer success, legal, and engineering teams on DPDP record-keeping requirements.
• Ongoing: Quarterly internal audits of consent record completeness and integrity.

Results:

• Contract renewal secured with added security commitments.
• DPDP Act readiness assessment passed.
• Consent record retrieval time reduced from days to under 30 minutes.
• No consent-related findings in subsequent ISO 27001 surveillance audit.

Illustrative Scenario 3: Delhi Manufacturing Company, Physical Records Fire and Compliance Penalty

Background: A 600-employee automotive component manufacturer in Delhi maintained a mix of digital ERP records and physical quality control sheets, supplier certifications, and environmental compliance files. Physical records were stored in a basement archive with minimal fire protection and no inventory system.

The Incident: In November 2024, an electrical short circuit caused a fire in the basement archive. Approximately 40% of physical records from the past 8 years were destroyed, including ISO/TS 16949 quality records, supplier audit reports, and environmental audit evidence required by the State Pollution Control Board.

Impact:

• ISO 9001 and IATF 16949 surveillance audit was suspended pending reconstruction of quality records.
• A major OEM customer placed the company on probation, threatening a annual contract.
• The State Pollution Control Board issued a show-cause notice for inability to produce environmental compliance records.
• Insurance claim was partially denied due to lack of inventory and off-site backup of critical records.
• Estimated direct and indirect overhead exceeded .

Root Cause Analysis:

1. No physical records inventory or classification.
2. No fire suppression, environmental monitoring, or off-site backup for physical records.
3. Critical records existed only in paper form with no digitisation.
4. No business impact analysis for records storage.
5. No periodic review of physical record protection by the ISMS.

Remediation with Singahi:

• Week 1–2: Emergency salvage and documentation of surviving records; notified insurers, customers, and regulators.
• Week 3–6: Digitised active quality and environmental records using scanning and OCR; implemented document management system with metadata tagging.
• Week 7–10: Established fire-resistant archive room, off-site storage with certified vendor, and environmental monitoring.
• Week 11–14: Rebuilt retention schedule for manufacturing records aligned with ISO 9001, IATF 16949, and environmental laws.
• Ongoing: Quarterly physical archive inspections and annual fire drill for records storage areas.

Results:

• ISO surveillance audit completed 5 months later with only minor observations.
• OEM customer lifted probation after demonstrating digitised records and off-site backup.
• Pollution Control Board accepted the reconstructed records with an improvement plan.
• Insurance premium reduced in the following year after demonstrating improved controls.
• Physical record retrieval time reduced from days to under 2 hours.

Multi-Framework Mapping

Implementation Roadmap

12-Week Implementation Roadmap

90-Day Sprint for Regulated Organisations

FAQ

What is the difference between a document and a record?

A document provides instructions and can be updated (e.g., a policy). A record is historical evidence of an activity and should not be altered after creation (e.g., an audit report, signed contract, or incident log). A.5.33 protects records; A.5.1 protects policies and documents.

Is a records retention schedule mandatory for ISO 27001?

Yes. A.5.33 and ISO 27002:2022 explicitly require a retention schedule that specifies how long records are kept and the basis for retention. Auditors will ask for it.

How long should we keep security audit logs?

The retention period depends on your legal and regulatory environment. In India, RBI/SEBI regulated entities often retain security logs for 1–3 years. CERT-In directions and the DPDP Act also support retention for investigation purposes. Define the period in your retention schedule.

Do we need WORM storage for all records?

No. WORM or immutable storage is typically required for high-integrity records such as audit logs, financial transaction records, board minutes, incident reports, and DPDP consent records. Other records may use standard access controls and backups.

How do we handle records on employee laptops?

Business records should not be stored solely on employee laptops. Use a centralised document management system with MFA, encryption, and remote wipe capability. If local copies are necessary, encrypt the device and synchronise to the approved repository.

What is a legal hold and when do we need one?

A legal hold suspends normal record disposal when litigation, investigation, or audit is anticipated or active. It is issued by Legal Counsel and remains in effect until formally released. Failing to implement a hold can lead to sanctions and penalties.

How do we protect records stored in the cloud?

Use cloud providers with appropriate certifications (ISO 27001, SOC 2). Enable encryption at rest and in transit, MFA, RBAC, immutable backups, and audit logging. Include records protection clauses in contracts and exercise audit rights.

What disposal method is acceptable for physical records?

Confidential paper records should be cross-cut shredded (DIN P-4 or higher). Restricted records should be pulverised or incinerated. Use certified destruction vendors and obtain certificates of destruction.

How does the DPDP Act, 2023 affect records protection?

The DPDP Act requires data fiduciaries to protect personal data, maintain consent records, honour data principal rights, report breaches, and delete data when no longer necessary. These obligations directly map to A.5.33 controls for retention, integrity, access, and disposal.

How often should we review the records protection programme?

Review the policy and retention schedule annually at minimum. Also review after significant legal/regulatory changes, major incidents, mergers/acquisitions, new technology adoption, or audit findings.

Do backup copies also need to follow the retention schedule?

Yes. Backups are records too. Define backup retention periods in the schedule and ensure that backups are disposed of securely when retention expires. For regulatory or audit purposes, you may need to retain certain backup copies even after original production records are deleted.

Can we keep all records forever "just to be safe"?

No. Over-retention increases breach risk, storage overhead, and DPDP Act liability. The DPDP Act requires that personal data not be retained longer than necessary. Keep records only as long as legally or business required, then dispose securely.

How do we protect records in email and chat applications?

Email and chat records should be subject to the same classification and retention rules. Use archiving solutions (e.g., Microsoft Purview, Google Vault, Zoho Mail archival) with retention policies, e-discovery capabilities, and access controls. Prohibit use of personal email for business records.

What is event-based retention?

Event-based retention starts the retention clock from a specific event rather than creation date. For example, employee records may be retained for 7 years from the date of termination, not from the date of creation. This requires tracking the triggering event accurately.

How do we handle records in foreign jurisdictions?

If your organisation operates globally, you may need to maintain records in specific jurisdictions to comply with data localisation laws. In India, the DPDP Act and RBI requirements may restrict cross-border transfers of certain records. Maintain local copies where required and document the legal basis for transfer.

What should a records disposal log contain?

A disposal log should include: disposal ID, record category, description, retention expiry date, legal hold status, disposal method, person who executed disposal, witness (for Restricted records), date, and certificate of destruction reference.

How do we prove record integrity to an auditor?

Provide evidence of WORM configuration, cryptographic hashes, digital signatures, immutable audit logs, access control matrices, and backup restore test results. Demonstrate that critical records cannot be altered or deleted without authorisation and detection.

Are system-generated logs considered records under A.5.33?

Yes. System logs, audit logs, access logs, and security event logs are records. They often require special protection because they provide evidence of system activity and security incidents. Treat them as Confidential or Restricted depending on content.

How does records protection support business continuity?

By ensuring records are backed up, recoverable, and stored in multiple locations, records protection supports rapid recovery from disasters, ransomware, and system failures. It also ensures that critical evidence remains available during investigations and disputes.

References and Further Reading

Standards and Frameworks

• ISO/IEC 27001:2022, Annex A 5.33, Protection of Records
• ISO/IEC 27002:2022, Section 5.33, Protection of Records
• ISO 15489-1:2016, Information and documentation, Records management
• ISO 23081, Information and documentation, Metadata for records
• NIST SP 800-88 Rev 1, Guidelines for Media Sanitization
• NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organisations

Indian Regulations

• Digital Personal Data Protection Act, 2023
• Information Technology Act, 2000 (as amended)
• CERT-In Directions, 2022
• Reserve Bank of India, Cyber Security Framework in Banks, Master Direction on IT Framework for NBFCs
• Securities and Exchange Board of India, Cyber Security and Cyber Resilience Framework
• Insurance Regulatory and Development Authority of India, Cyber Security Guidelines
• Companies Act, 2013
• Income Tax Act, 1961
• Central Goods and Services Tax Act, 2017
• Prevention of Money Laundering Act, 2002
• Right to Information Act, 2005

Industry Guidance

• Association for Intelligent Information Management (AIIM), Records Management Best Practices
• International Council on Archives, Records Management Principles
• Indian Institute of Banking and Finance, Cyber Security Guidelines for Banks