One of our customers, a very large bank, has sent us a "non-negotiable" amendment to it's contract. In it is a clause that requires us to keep certain classes of internal control documents for certain amount of time (7 years .... go figure). These are not documents we create specifically for the customer or documents the customer provides us, but our own internal process documents -- mostly QC and regulatory compliance type stuff. Our own retention schedule has retention for the specified classes anywhere from 2 to 20 years.

They also require us to maintain personal custody of documents they provide to us for the term of the contract (I can't recall the exact wording, but I, and our attorneys reading the clause, interpreted it to mean we could not use an offsite vendor).

Our attorneys asked my opinion. I said that it's pretty common, and in fact suggested, that if a third-party vendor maintains records on your behalf you should make sure that the contract contains a clause that requires records to be retained for your retention periods. But I didn't think that a customer should be able to mandate retention for our own internal records. I also thought that if our normal course of business was to send records to an offsite vendor, we should be able to do so as long as the vendor can prove they have appropriate security in place -- such as providing their SAS70 or similar.

Have any of you had a similar request from a customer? How was it ultimately resolved?


Nolene Sherman
[log in to unmask]

Records Manager since 1996. Gone wonky since 1998.

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]