e records creator and its legitimate successors. 
Although the practice of outsourcing these functions to specialized commercial operators is 
authorized and regulated under most existing privacy legislation, the practice should still be 
avoided whenever possible to minimize the number of individuals authorized to access and/or 
process the records, thus reducing the risk of unauthorized disclosure of personal information in 
InterPARES 2 Project, Policy Cross-domain 
 
Page 11 of 11 
Policy Framework, v1.