The Turkish branch’s final working day is fixed. Furniture removal and return of the keys are scheduled. Yet nobody may have decided who will locate an earlier incident record, follow an outstanding official request or arrange closure of a supplier’s access after the office shuts.
Ownership of records here means responsibility for safeguarding a record, assessing access requests and referring matters to the appropriate process. Closing the premises does not automatically complete those decisions.
Closure creates a new information-flow decision
Nissenbaum’s contextual-integrity approach is a normative account of information sharing in relation to recipients and use. It provides no legal retention timetable for closure, but helps frame questions about a record’s next custodian. [1]
First distinguish record types and continuing business needs. Relevant legal, data-protection and records-management owners should assess the appropriate treatment.
Track access and records separately
One list can cover keys, cards, system accounts and supplier access. Another can cover incident notes, handover records and outstanding requests. Closing access does not mean every associated record should be deleted at the same time. Retaining a record does not require keeping the old account open.
NPSA’s staff-exit guidance addresses responsibility for departure procedures alongside physical and digital access. [2] A branch closure is broader; our recommendation extends the working checklist beyond individuals to responsibilities that remain between organisations.
Keep three counterparties distinct
Building management may handle the returned premises and its own systems. The branch’s authorised corporate representative may remain the contact for continuing business records and requests. The security provider performs actions within its own contract and obligations. Translate these general headings into specific agreed responsibilities.
For example, the person accepting the building keys should not automatically be treated as authorised to receive historical incident reports. Equally, ending a service contract does not automatically make it appropriate for the provider to send all records to any address requested by the business.
Decide retention by record type
The Turkish Data Protection Authority explains the obligation to erase, destroy or anonymise personal data when the grounds for processing cease. [3] The closure file should bring together relevant grounds, continuing obligations and the authorised decision. Record the retention periods assessed for each record type.
If overseas transmission is proposed, assess that transfer separately. The authority’s international-transfer guide is an official starting point. [4] An internal instruction to archive the files does not, by itself, define the recipient or transfer arrangements.
Add six explicit answers to the closure record
- Which access items were returned, and which remain under action?
- Who approved changes to system permissions, and who checked the result?
- Who will be responsible for each group of records?
- Who retains ownership of outstanding official or business requests?
- Who will assess retention, destruction or transfer decisions?
- Through which corporate channel can these people be reached after closure?
If the keys have been returned but responsibility for records remains unclear, that action is still open. An orderly closure connects physical handover, access changes and continuing records responsibilities. At the closure meeting, the parties should review these tasks together with their owners and follow-up dates.
